Cyber Essentials Plus: IASME, the hands-on test, and why the badge is not a pen test

Cyber Essentials Plus builds on the self-assessment scheme by adding independent technical verification. The assessor checks a sample of devices and services against requirements for firewalls, secure configuration, user access control, malware protection, and security update management.

The scheme is intentionally baseline-focused. It does not certify that the organization has a full information-security management system, strong application security, or mature incident response. Its value is that it forces basic hygiene to be true across the scoped environment, including devices that touch government work or sensitive customer activity.

The practical object of CE+ is the real endpoint and service estate, not the policy boundary a team wishes it had. Laptops used by contractors, remote devices that reach email, mobile devices with corporate data, and cloud services that expose administration all need to be understood before sampling begins. The assessor's test is strongest when it reflects how work is actually done, including hybrid work patterns that rarely appear in neat network diagrams.

The checklist cannot decide what is legitimately in scope. Leadership must determine which networks, endpoints, cloud services, home-working devices, BYOD arrangements, and subsidiaries support the work that requires CE+. Scoping out devices that perform government work because they are inconvenient is a readiness failure, not a strategy.

It also cannot decide how strict the organization will be about unmanaged devices. BYOD without mobile device management, weak patch visibility, or local admin rights may be culturally accepted, but the technical test will evaluate control reality rather than policy intent.

The checklist will not tell you whether to delay the assessment. If external services are unpatched, unsupported systems remain active, or the questionnaire answer cannot be demonstrated, the decision is whether to remediate first or risk a failed test.

The most common failure is scope optimism. Teams exclude laptops, home-working setups, mobile devices, or cloud admin paths that genuinely support in-scope activity. The assessor then finds the forgotten device class, or the buyer asks why the scope does not match the service being procured.

Another failure is passing the questionnaire but failing Plus. A policy may say patches are applied within the required window, but the sample includes an unpatched browser, unsupported operating system, or internet-facing service with a known vulnerability. CE+ rewards operational truth, not documentation.

BYOD and mobile are frequent pain points. If personal devices access corporate mail or customer data without MDM, secure configuration, patch enforcement, and access controls, the organization may not be able to prove the baseline. Teams often discover this only after the assessment is booked.

Internet-facing services deserve their own pre-test review. A forgotten VPN portal, remote desktop service, admin console, or legacy web server can fail the assessment even if the internal endpoint sample is healthy. Asset discovery should include DNS, cloud accounts, external scanning, and ownership checks so the assessment does not uncover an avoidable surprise.

Use the checklist first to define scope in plain operational terms: who does the work, which devices they use, which cloud services they access, which networks and remote paths are involved, and which internet-facing services belong to the organization.

Then test the answers before the assessor does. Pull patch reports, review local admin, inspect endpoint protection, scan external services, validate firewall rules, and confirm unsupported software has been removed. Treat every checkbox as something that may need technical evidence.

After certification, keep the checklist tied to asset and change management. CE+ can fail again next year if a new unmanaged device group, exposed service, or BYOD exception enters the environment without the same hygiene controls. Treat every new device class, remote-access path, and external service as a potential scope change rather than waiting for the renewal assessment.