Assessment preparation

Before the assessment

Preparation checklist

This confirms that the agreed devices, accounts and access will be available. Your assessor will separately verify the scope, sample and test results.

Progress0 of 12

Authorisation and scope

Written permission has been providedInfoSec Governance is authorised to carry out the agreed Cyber Essentials Plus testing. The Cyber Essentials certificate and scope are currentThe systems being assessed match the valid Cyber Essentials self-assessment scope. External addresses and cloud infrastructure have been declaredThis includes public IP addresses, relevant DNS names and internet-facing IaaS resources. Any scoped subset and its segregation have been explainedIf the scope is not the whole organisation, the excluded systems and separation method have been documented.

Devices and vulnerability scanning

An up-to-date device and system inventory is availableIt identifies operating systems, servers, IaaS and any materially different configurations. Agreed sample devices will be powered on, connected and availableUsers responsible for the devices will also be available at the agreed assessment time. Sample devices are ready for authenticated vulnerability scanningNessus Agents are installed and linked where required by the agreed scanning method. Systems are supported and relevant security fixes have been appliedAvailable vulnerability fixes older than 14 days have been reviewed and applied where required.

Accounts and security testing

Working email and browser access will be availableApplicable sample environments can receive external email and use their normal internet filtering. Do not test the supplied files in advance. Malware protection is installed and operating normallyThe protection method and relevant status information or logs will be available to the assessor. In-scope cloud services and MFA accounts are availableAt least one normal user and one administrative user can demonstrate access to each authentication service. Standard and separate administrative accounts are availableA standard user can attempt an agreed administrative process on each applicable sampled device.

Privacy information

Checklist record

We record checklist responses, the customer assessment, date and time, source IP address, and browser or device user-agent as assessment evidence. This information is restricted to authorised InfoSec Governance personnel and retained for 12 months.

Unsure about an item?

Save your progress and contact your assessor before confirming it.

info@isgovern.com

Checking secure assessment link…

Access link required

Preparation checklist

Authorisation and scope

Devices and vulnerability scanning

Accounts and security testing

Checklist record