Problem
Cyber Essentials Plus testing found vulnerabilities despite established patching and endpoint monitoring.
Diagnosis
Findings spanned software, runtimes, security configuration and incomplete update states.
Fix
Targeted remediation followed by direct endpoint checks and wider estate assurance.
Result
The organisation successfully completed its independent Cyber Essentials Plus assessment.
The work showed why a healthy patching dashboard is only part of the picture. Readiness also depends on what is installed, how devices are configured and whether the required controls can be verified on the endpoint.
The Challenge
The organisation operated a predominantly Microsoft-based environment with Windows endpoints, Windows Server and a range of specialist business applications.
Cyber Essentials Plus vulnerability testing identified issues across several areas, including:
- Windows and Microsoft Office security updates
- .NET and ASP.NET runtimes
- Specialist application components
- Hardware manufacturer utilities and drivers
- Windows security configuration
- Registry-based vulnerability mitigations
- Outstanding reboot and update states
Some findings could be resolved with conventional updates. Others needed investigation, configuration changes, removal of obsolete components or verification of specific security controls.
“Cyber Essentials Plus readiness is not the same as patch management.”
From patching to security assurance
Altitude IT treated the remediation as a wider security-assurance exercise rather than simply installing updates. Each finding was understood, addressed and checked against the actual condition on the device.
-
Understand
Analyse each vulnerability and establish what the scanner is actually detecting.
-
Remediate
Apply operating system updates, application updates, runtime upgrades, configuration changes or component removal as required.
-
Verify
Check the endpoint directly to confirm the vulnerable condition is genuinely gone rather than relying only on a successful deployment status.
-
Estate-wide assurance
Build remote monitoring checks for important conditions and run them across the available estate.
-
Pre-flight
Carry out additional checks before allowing the final assessment to proceed.
The Difficult Findings
One particularly difficult finding involved a Windows security mitigation. The required configuration existed in one Windows registry location but not in the corresponding native location. The device therefore looked substantially correctly configured, but the vulnerability scanner still identified an incomplete mitigation.
Altitude IT investigated the exact condition, corrected the missing configuration, independently verified both required locations and expanded the check across the wider managed estate.
Another finding involved a separately installed Microsoft .NET runtime. It required a newer security release even though normal Windows patch-management checks appeared healthy.
Why the Second Sample Mattered
Modern Cyber Essentials Plus assessments may test additional devices after the initial remediation phase. Organisations therefore cannot simply fix the machines selected first.
“Remediation has to work across the estate, not just across the original sample.”
This makes estate-wide verification and vulnerability management important: the same issue may exist beyond the first devices checked, and repeatable checks help identify it before assessment time.
Cyber Essentials Plus: PASS
Independent assessment result
PASS
The organisation successfully completed its Cyber Essentials Plus assessment.
PASS
Cyber Essentials Plus completed successfully
Broader assurance
Configuration and runtime vulnerabilities addressed alongside conventional patches
Reusable process
Pre-flight checks developed for future assessments
The final assessment confirmed that the required technical controls had been implemented successfully. But the bigger outcome was a clearer security-assurance process for maintaining the estate between annual assessments.
Altitude IT provided technical remediation, readiness and assurance support around an independent Cyber Essentials Plus assessment. The assessment and certification decision remained independent.
Five lessons from a difficult CE+ assessment
1. Patching is only one layer
Vulnerability fixes can also involve configuration, runtimes, drivers, applications and other vendor-prescribed mitigations.
2. Deployment success is not verification
A successful patch or script job does not prove the vulnerable condition has disappeared.
3. Check the endpoint
Security assurance should interrogate the actual state of the device.
4. Test broadly
Random sampling makes estate-wide remediation more important, not less.
5. Learn from every finding
Each vulnerability discovered should become another repeatable detection and verification check.
Patch Management → Configuration Assurance → Vulnerability Assurance
-
Stage 1
Patch management
Keep supported operating systems and applications updated.
-
Stage 2
Configuration assurance
Verify security settings, mitigations, runtimes and other technical controls.
-
Stage 3
Vulnerability assurance
Use vulnerability assessment to find conditions that conventional monitoring may not identify.
No single tool provides complete assurance. The strongest approach combines endpoint management, deterministic security checks, vulnerability assessment and technical judgement.
From Annual Project to Continuous Readiness
Organisations should not wait until immediately before CE+ renewal to discover whether their estate is ready.
- Discover
- Understand
- Remediate
- Verify
- Automate the check
The objective is not to promise continuous Cyber Essentials certification. Certification remains a formal assessment.
The objective is to operate the IT estate so that it remains continuously close to the current Cyber Essentials technical baseline and exceptions are identified before assessment time.
Related Support
Altitude IT provides technical remediation, readiness and assurance support around Cyber Essentials Plus. The formal assessment is independent; preparation and remediation can help an organisation understand and address technical gaps before it begins.
Cyber Essentials support
Readiness and remediation
Preparation, gap identification and technical remediation support around an independent Cyber Essentials or Cyber Essentials Plus assessment.
Explore Cyber Essentials supportCyber security
Security services
Endpoint security, vulnerability management and security assurance for North West businesses.
Explore security services