Cyber Essentials Plus notes. What to check, and what to fix first.
Cyber Essentials Plus rarely fails because of an exotic finding. It fails because of evidence gaps, scope confusion and unmanaged devices. These notes are written for UK Microsoft 365 teams who need to pass without theatre.
Notes on this topic
Short guides on what to check and why it matters.
Cyber Essentials Plus BYOD and Mobile MAM Policy
Personal smartphones accessing Microsoft 365 fall in scope for Cyber Essentials Plus. Intune MAM app protection protects corporate data without full MDM enrolment.
Defender for Business Web Content Filtering
Microsoft 365 Business Premium includes native web content filtering. Protect remote laptops and block malicious web categories without third-party agents.
Windows LAPS with Entra ID Cloud Setup Guide
Shared local admin passwords are a finding waiting to happen in a Cyber Essentials Plus assessment. Windows LAPS with Entra ID rotates a unique password per device.
UK Cyber Resilience Pledge: M365 Evidence
The UK Cyber Resilience Pledge is voluntary, but its board, Early Warning and supply-chain commitments are specific. Treat it as operating work, not website copy.
Security policies vs helpdesk reality
I have run an internal helpdesk and watched theoretical security policies crumble on day one. Here is why external advice usually misses the mark, and how to fix it.
Cyber Essentials Plus Readiness Guide
This is the readiness guide I would want before booking a Cyber Essentials Plus assessment for a Microsoft 365-heavy environment: scope first, MFA proof, device evidence, patch records, mail controls and a dry run before assessment week.
Microsoft 365 Security Backlog 2026
A backlog is useful when it reflects operational reality, not product marketing. This one is built around the problems smaller Microsoft 365 tenants keep tripping over.
Cyber Essentials Plus Endpoint Samples
The assessor does not care about your best three laptops. They care whether an ordinary sample of business devices reflects the controls you say are in place.
Cyber Essentials Patch Evidence
The new patching conversation is not just about whether you patch. It is about proving supported software, timely updates, and controlled exceptions across the endpoint estate.
Cyber Essentials v3.3: Missing MFA on Cloud Services Is an Automatic Fail
Cyber Essentials v3.3 is blunt on MFA. In-scope cloud service access must use it, and Microsoft 365 teams need to prove policy enforcement across users, admins, guests, exclusions and emergency accounts.
Cyber Essentials v3.3: Cloud Services Scope for Teams on Microsoft 365
Cyber Essentials v3.3 removes a lot of wiggle room around cloud scope. For Microsoft 365 teams, that matters more than most people first think.
Audit Logs and Evidence: What to Capture Before Assessment Week
Good evidence packs are not glamorous. They are dated, easy to navigate, and strong enough that nobody reconstructs the tenant from memory under pressure.
Windows 10 After End of Support: Microsoft 365 and Cyber Essentials Risk
What Windows 10 end of support really changes for Microsoft 365 teams, and where people overstate or understate the risk.
Cyber Essentials in practice
Few UK businesses hold the certificate. Far more have controls in all five areas than can show it.
- Aware of Cyber Essentials17%
- Controls in all five areas24%
- Hold Cyber Essentials5%
- 5%All businesses
- 12%Small
- 35%Large
Why customers ask for it
Larger businesses review their suppliers’ cyber risk far more often. The certificate is often how a small supplier answers.
- 12%Micro
- 22%Small
- 30%Medium
- 48%Large
Cyber Essentials Plus readiness service
Bring the declared scope, current device list, assigned assessor name and any prior assessment report. The most useful additions are the controls that felt uncertain in the last assessment or annual review.
Ask yourself first
If any of these is hard to answer, a review will help. Move from reading to action when the assessment date, device list or evidence owner is unclear.
- 01
Which devices and users are in scope for the assessment sample?
- 02
Can patching, malware protection and MFA be evidenced without last-minute screenshots?
- 03
Who owns remediation when assessor feedback points to Microsoft 365 or endpoint controls?
Common questions
What does a review look like?
A typical review checks scope, users, devices, evidence speed and the Microsoft 365 controls behind the assessor story. It names the evidence owner, first remediation step, missing proof, sign-off owner and handover path.
Keep exploring
