Penetration testing for Cyber Essentials Plus.
Cyber Essentials Plus includes a hands-on technical check, but that assessment is carried out by a Cyber Essentials certification body, not by us. Where we help is before and beyond it: a penetration test finds the gaps a real attacker would use, so you go into your CEP assessment with no surprises, and it goes deeper than CEP requires. We are not a Cyber Essentials certification body.
What Cyber Essentials Plus asks for.
Independent testing is a big part of how you satisfy it. On the testing side, this is what the process expects.
- A hands-on technical verification, performed by a CE certification body
- Patching, secure configuration, access control and malware protection in place
- Systems that stand up to common, internet-based attacks
Who does what.
A penetration test is one piece of the picture. Here is the clean line between the testing we do and the certification a separate, independent party provides.
We do the testing
- A penetration test that finds the gaps before your CEP assessment
- Testing that goes deeper and wider than CEP requires
- Prioritised fixes so your assessment holds no surprises
They do the rest
- The Cyber Essentials Plus assessment and certification
- The official pass or fail against the CEP requirements
Cyber Essentials Plus, answered.
Straight answers to what clients ask most.
Can you certify us for Cyber Essentials Plus?
No, and we are careful to be clear about that. The CEP assessment and certificate come from an approved Cyber Essentials certification body. What we do is the penetration testing around it: finding and fixing the gaps first, and testing further than CEP itself goes.
Do we still need CEP if we have a penetration test?
They do different jobs. CEP is a baseline certification that customers and frameworks ask for; a penetration test is deeper assurance. Many organisations do both, and a pen test is a good way to prepare for a smooth CEP assessment.
Will a pen test help us pass CEP?
It gives you the best possible chance. We find the patching, configuration and access-control gaps a CEP assessor would flag, so you can fix them before the assessment rather than during it.
Need a pen test for Cyber Essentials Plus?
Tell us where you are in the process and who is asking. We will come back within one working day with a suggested approach and a fixed-price scope, with no sales theatre.