Cyber Essentials Plus: When Theory Meets Reality
In December, we wrote about how Cyber Essentials gets harder the more you understand it. On paper, many of the questions look simple. In practice, once you stop guessing and start proving, things change quickly.
Cyber Essentials Plus Certified Feb 2026 This month, we went through a Cyber Essentials Plus assessment ourselves, under the same scrutiny our clients face.
It was a useful exercise, not because anything surprised us, but because it reinforced a point we see again and again with clients: the difference between “this should be fine” and “this is demonstrably compliant” is huge.
A real example: mobile devices without screenshots
One of the areas that often causes friction in Cyber Essentials Plus is mobile devices.
- Assessors will typically expect evidence that:
- Devices accessing company data are secured
- Software is supported
- Updates are enforced
- Controls are consistent
Traditionally, this can turn into requests for screenshots from individual phones. That approach doesn’t scale, and it doesn’t actually prove much long term.
We didn’t submit screenshots of mobile phones.
Instead, we provided the Mobile Application Management policies we have in place that enforce the required settings.
Why that worked:
- The controls are defined centrally
- They apply to every device accessing company data
- They don’t rely on users behaving correctly
- They remain in place after the assessment ends
That distinction matters.
To us, Cyber Essentials Plus isn’t about a device being secure on a specific day. It’s about the organisation having controls that ensure security continuously.
Why this matters for clients
The security setup we use for our business is the same setup we deploy for clients on our Compliant tier.
As a result, most of the assessment answers weren’t written just for us. They already apply to customers on this Compliant tier.
This means for our clients who are on this tier, their involvement in getting CE+ comes down to a small number of checks and confirmations:
1. Unsupported applications
Making sure the business is not using apps that are no longer supported or patched.
2. Third-party portals and services
Reviewing external systems (accounting platforms, suppliers, line-of-business tools) and confirming they are secured with MFA.
3. Out-of-scope systems
Identifying anything not directly supported by TechSolvers — for example, specialist systems, legacy kit, or third-party managed platforms — and confirming they meet the same baseline requirements.
That’s it. No panic. No scrambling for evidence at the last minute.
That’s it. No panic. No scrambling for evidence at the last minute.
What this means if you’re looking to certify
If you’re already working with us on the Compliant tier, most of that groundwork is already done. It just needs reviewing and confirming.
If you’re not, we can:
- Run a Cyber Essentials readiness review
- Help you identify gaps before submission
- Put the right controls in place so compliance becomes routine, not stressful
Cyber Essentials shouldn’t be a guessing game. Done properly, it becomes a by-product of running your IT securely day to day.
If you want to talk it through before submitting, get in touch. It’s always easier to fix these things upfront than explain them after an assessor starts asking questions.
Written by Tom Mitchell (Febuary 2026).