Find Cyber Essentials Plus blockers before assessment week
Find assessment blockers across scope, endpoints, updates, access and malware protection, then leave with an evidence tracker and ordered remediation plan. £2,500 to £5,000; usually 2 to 3 weeks.
What the work covers
What usually blocks assessment
The practical blockers are unclear scope, unmanaged or unsupported devices, update evidence that cannot be reproduced, weak access control, missing malware protection and proof with no named owner.
Scope, output and handover
Confirm the assessment boundary, review the five technical control themes across the agreed Microsoft 365 and endpoint scope, rank remediation, and leave an evidence list, tracker and internal handover notes.
From scope to assessment readiness
Few businesses hold the certificate
A quarter of UK businesses report controls in all five Cyber Essentials areas. Only 5% hold the certificate, rising to 35% of large firms.
- Aware of Cyber Essentials17%
- Controls in all five areas24%
- Hold Cyber Essentials5%
- 5%All businesses
- 12%Small
- 35%Large
Why customers start asking
Larger firms check their suppliers far more often, which is usually where a Cyber Essentials Plus request comes from.
- 12%Micro
- 22%Small
- 30%Medium
- 48%Large
The handover
The work ends with written outputs you keep.
- Prioritised remediation plan tied to controls.
- Approved fixes implemented where change risk allows.
- Evidence pack ready for assessor review.
- Internal IT notes for recurring checks.
- Clear yes/no on assessment readiness and what still blocks it.
Not ready to book?
Try the free Microsoft 365 self-check first. It starts with 12 questions.
Questions teams ask before the work
Can you certify Cyber Essentials Plus?
No. Readiness and remediation only — certification stays with an authorised Certification Body.
What does the sprint cost and take?
The fixed-scope readiness sprint is £2,500 to £5,000 and usually takes 2 to 3 weeks, depending on access, device scope and change approval.
Related work
