A Cyber Essentials Plus assessment is not the time to find out that the computer running a critical machine has not been updated for three years, or that every warehouse supervisor shares one login. Cyber Essentials Plus preparation gives you the chance to fix these issues in a controlled way, without turning an audit requirement into an avoidable production problem.
For manufacturing and engineering businesses, the objective is straightforward: meet customer or supply-chain requirements while protecting the systems that keep orders, drawings, materials and production moving. The assessment is independently verified, so good intentions and a tidy policy folder will not be enough. Your controls need to work on the devices and services within scope.
What Cyber Essentials Plus preparation should achieve
Cyber Essentials Plus builds on Cyber Essentials by testing whether key technical controls are actually in place. The assessment examines areas including firewalls, secure configuration, user access, protection from malware and security updates. The precise assessment approach and scope should always be confirmed with your certification body, particularly where a site has specialist equipment or unusual network arrangements.
For a typical office-only business, preparation may focus on laptops, Microsoft 365 accounts and internet routers. A factory has more dependencies. A production planner may rely on an ERP or MRP system, engineers may need access to CAD files, and a machine-connected PC may run software that cannot simply be upgraded on a Friday afternoon. A failed change can mean lost output, delayed deliveries and a difficult conversation with a customer.
That does not mean a legacy device can be ignored. It means its risk must be understood and managed properly. Certification is not achieved by describing a problem well. You need a defensible arrangement that meets the scheme requirements for the assessed scope, while keeping the operation safe and reliable.
Start with an accurate view of what you have
The most common cause of a difficult assessment is not a sophisticated cyber attack. It is uncertainty. Businesses often know their office computers, but have less visibility of shared workshop terminals, test rigs, tablets, old servers, Wi-Fi access points and remote access tools installed by equipment suppliers.
Begin by mapping the people, devices, software and connections involved in daily operations. Include the systems that store drawings, process orders, run finance, schedule work and connect to machinery. Record who owns each system, whether it is still supported, how it connects to the network and what would happen if it became unavailable.
This exercise often exposes useful operational issues beyond certification. For example, an engineering firm may find that a single PC holds the only configuration files for a machine, or that a former employee’s account still has access to Microsoft 365. Neither is just an audit concern. Both are avoidable business risk.
Do not forget supplier access. Remote support can be necessary when a machine fault threatens production, but unrestricted permanent access creates a weak point. Establish who can connect, what they can reach, how access is approved and how it is removed when no longer needed. Where practical, use named accounts rather than shared credentials and protect remote access with multi-factor authentication.
Deal with unsupported production equipment sensibly
Unsupported operating systems are one of the hardest issues in Cyber Essentials Plus preparation. They are common around machinery, laboratory equipment and specialist controllers because the software may only run on a particular version of Windows. Replacing the PC may require supplier testing, revalidation or a production stoppage.
The wrong response is to update it without checking the consequences. The equally wrong response is to leave it connected to the same network as office computers, assuming nobody will notice.
First, speak to the machine or software supplier. Establish whether there is a supported upgrade path, what testing is required and whether an approved replacement computer is available. If replacement is viable, plan it around production and retain a tested rollback option where possible.
If immediate replacement is not viable, reduce exposure while you agree a longer-term plan. Network segregation is often central here. Put the production device on a separate network segment, limit its communications to only what it needs, prevent casual internet access and restrict who can administer it. This can reduce the chance that a compromised office device reaches a machine-connected computer, or vice versa.
Segregation is not a magic compliance label. Its suitability depends on the device, the assessor’s scope and the controls around it. You may also need compensating operational measures such as controlled USB use, a tightly managed support account and a reliable backup of the machine configuration. The point is to make a known risk smaller and more manageable, not to pretend it has disappeared.
Get the everyday controls right before the assessment
Most assessment failures are avoidable because they relate to routine IT discipline. Busy teams tend to focus on the unusual legacy machine, while ordinary laptops, accounts and network equipment quietly fall behind.
Patch management needs particular attention. You should know which devices receive updates, who checks that updates have installed and how exceptions are handled. Production systems may need a test window before changes are applied. Office laptops normally do not need the same caution. Treating every device identically can create disruption; treating every device as an exception creates gaps.
User access should reflect real jobs. A production manager does not need administrative rights simply because it is quicker when software asks for permission. Separate standard user accounts from administrator accounts, remove access promptly when staff leave and avoid shared logins wherever possible. Shared devices can be managed, but accountability and access controls must be clear.
Multi-factor authentication should be enabled for appropriate cloud services and remote access. It is one of the most effective ways to reduce the impact of a stolen password. Make the rollout practical: plan for staff who work on the shop floor, keep recovery methods controlled and ensure that account ownership does not sit with one person who happens to be on holiday.
Check security settings on routers, firewalls and wireless networks too. Default passwords, old firmware and broad rules allowing traffic between networks can undermine otherwise sensible work. Factory and warehouse Wi-Fi deserves the same attention as office Wi-Fi. Scanners, handheld devices and visitor networks should not automatically have access to systems holding drawings or financial information.
Test the evidence, not just the technology
A certification assessment tests the environment as it exists. Preparation should therefore include an internal readiness check using real devices and real accounts, rather than relying on what a policy says ought to happen.
Choose a representative sample across office, warehouse and production areas. Confirm that supported devices are receiving security updates, anti-malware protection is active where applicable, unnecessary software has been removed and users do not have more privilege than they need. Review firewall and remote-access settings against the documented design.
It is also worth checking whether security tools are visible and manageable. If an IT provider cannot show the patch status of devices or identify unmanaged computers, problems will be discovered late. A clear asset register and central device management make preparation less stressful and help prevent the same gaps returning after certification.
Backups are essential for resilience, but they do not replace the controls assessed by Cyber Essentials Plus. Test restoration of priority systems separately. Can you recover the ERP data, CAD files, machine settings and Microsoft 365 data within a timeframe that protects delivery commitments? A backup that has never been restored is closer to a hopeful theory than a recovery plan.
Plan the assessment around production reality
Avoid booking an assessment before you have resolved known issues and agreed how testing will be carried out safely. Assessors need to verify controls, but they should not be left to guess which devices are business-critical or where a scan could affect specialist equipment.
Provide a clear scope, current device list, network overview and named technical contact. Explain any production constraints in advance. A well-planned assessment should minimise disruption, but it cannot compensate for incomplete information or unowned risks.
For businesses in Hampshire, Surrey and West Sussex, this is often where manufacturing-focused IT support adds value. The challenge is not simply ticking security boxes. It is coordinating software suppliers, internal staff and production requirements so that security improvements do not create a new source of downtime.
Before committing to an assessment date, ask for a practical readiness review. Syn-Star can help identify the gaps, set out ownership and build a remediation plan that protects both certification progress and production continuity.
