// Technology & Software

CYBER ESSENTIALS PLUS
FOR TECHNOLOGY & SOFTWARE.

Enterprise clients and supply chain contracts increasingly require Cyber Essentials Plus - independent technical verification, not just self-assessed CE. Under Danzell v3.3 your SaaS platform and cloud services are explicitly in scope. As an IASME Approved Certification Body, we provide the independent audit your clients and contracts demand. Pre-Assessment Check included as standard. Fixed pricing, IASME fee included.

Get Certified Today →CE Plus Overview →
FROM £1,195 + VATNCSC SUPPLY CHAIN ALIGNEDSAAS & CLOUD IN SCOPEIASME APPROVED BODY
v3.3
Danzell: SaaS & Cloud Explicitly In Scope
CE+
Enterprise Supply Chains Specify CE Plus
100%
Remote Assessment
Fixed
All-In Pricing, IASME Fee Included
// Tech Sector Requirements

WHAT THE TECH SUPPLY CHAIN REQUIRES

Technology and software companies face CE Plus requirements from two directions: enterprise clients specifying independent verification in their supplier due diligence, and supply chain contracts where the buyer requires a higher level of assurance than self-assessed CE provides. The Danzell v3.3 update tightened cloud scoping - under v3.3, any cloud service that stores or processes your data must be included and cannot be excluded.

Enterprise Client Due Diligence - CE Plus Increasingly Specified

Enterprise clients - financial services firms, large corporates, public sector bodies - are pushing CE Plus into their supplier onboarding and annual re-qualification processes. Standard CE is a self-assessed questionnaire: the supplier declares their controls are in place, but no independent party verifies them. For clients giving a supplier privileged access to their data, systems, or customer records, that is limited assurance. CE Plus adds an independent technical audit. The NCSC's Cyber Essentials Supply Chain Playbook supports a tiered approach where higher-risk suppliers are required to hold CE Plus. St. James's Place has mandated CE Plus across its network of over 2,800 partner organisations, verified through IASME. See our CE for Technology & Software page for standard CE requirements →

Danzell v3.3 - SaaS and Cloud Services Are In Scope

The v3.3 update to the Cyber Essentials technical standard (Danzell, April 2026) tightened cloud scoping. Cloud services have been in scope since earlier CE versions; v3.3 removed the ability to exclude them - any service that stores or processes your data, or is accessible from in-scope devices, must now be included. For a software company, this means your cloud-hosted application environments, admin accounts on cloud platforms, development tools, collaboration services, and CI/CD pipelines are all in scope - the hyperscaler-managed infrastructure itself is excluded, but your own services and configurations on top of it are not. This change directly affects technology companies seeking CE Plus - and means the certificate covers the environments your clients actually care about.

Government Contracts and G-Cloud

UK government procurement requires CE for contracts involving handling personal data, and the G-Cloud Digital Marketplace specifies CE as a baseline requirement. Where a government or public sector buyer specifies CE Plus for a higher-risk contract or framework, standard CE will not satisfy it. Technology companies on G-Cloud or pursuing public sector work benefit from CE Plus as the independently verified credential that distinguishes them from self-assessed suppliers in competitive procurement.

Technology and software company team - Cyber Essentials Plus certification for SaaS, MSPs and software businesses

WHICH LEVEL DOES YOUR BUSINESS NEED?

The right level depends on your clients and contracts:

  • Government contract (personal data) - standard CE satisfies the baseline
  • Enterprise client specifies independent audit - CE Plus required
  • Supply chain contract with higher-risk buyer - CE Plus required
  • SaaS platform / MSP with privileged client access - CE Plus preferred

Not sure which applies? Ask our team →

// IASME Register

PUBLICLY VERIFIABLE CERTIFICATION

CE Plus certificates are listed on the IASME public register. Enterprise procurement teams, supply chain managers, and client security teams can verify your certification status directly - giving you a verifiable, searchable record to include in tender responses, supplier questionnaires, and RFP submissions.

// Why CE Plus

WHY CE PLUS - NOT JUST STANDARD CE

// Enterprise Procurement

INDEPENDENTLY VERIFIED FOR ENTERPRISE CLIENTS

Enterprise clients increasingly distinguish between self-assessed CE and independently audited CE Plus in their supplier due diligence. CE Plus means an IASME-approved assessor has independently tested that your controls are in place - not just that you declared them. For clients with significant data or system dependencies on their suppliers, that distinction matters.

// SaaS & Cloud

YOUR PLATFORM IS IN SCOPE - AND THAT IS THE POINT

Under Danzell v3.3, your own SaaS platform, cloud-hosted services, and development environments cannot be excluded from the CE Plus assessment. For a technology company, that means the audit covers what your clients actually interact with - not just office laptops. (The underlying hyperscaler infrastructure is excluded; your configurations and services on top of it are not.) A CE Plus certificate that includes your platform is meaningfully more valuable than one that scoped it out.

// Competitive Edge

WIN ENTERPRISE CONTRACTS OTHERS CANNOT QUALIFY FOR

Where an enterprise buyer specifies CE Plus, a supplier with only standard CE is disqualified before their product or service is evaluated on merit. CE Plus puts you in the qualifying tier. For software companies competing for enterprise and public sector contracts, CE Plus is increasingly a minimum requirement, not a differentiator.

// Why Choose Us

WHY VINCENT CYBER DEFENCE FOR TECH CE PLUS?

// Pre-Audit

WE CHECK BEFORE WE AUDIT

Technology companies often have an enterprise contract deadline or client onboarding timeline driving certification. We include a Pre-Assessment Check before the formal audit begins - any gaps are identified and fixed before the assessor starts, not after a failed result that could delay a contract award or client go-live.

// Cloud Aware

SAAS, CLOUD AND DEV ENVIRONMENT EXPERIENCE

We regularly work with SaaS companies, MSPs, and software businesses and understand cloud-hosted environments, development toolchains, and the scoping questions that arise when your product is the thing being assessed. We can advise on scope before you start - so there are no surprises on assessment day.

// Direct Access

DIRECT ASSESSOR, NO HANDOFFS

You work directly with your Lead Assessor from first contact through to your CE Plus certificate. No helpdesk, no rotating contacts. When a client security team or enterprise procurement manager asks for a status update before a contract deadline, you can get a direct answer fast.

// How It Works

YOUR CE PLUS JOURNEY

Four clear steps from enquiry to certification. Pre-Assessment Check included as standard - we identify any gaps before the formal audit begins.

1

PRE-ASSESSMENT CHECK

Before the audit starts, we review your controls and environment against CE Plus requirements. Cloud services, SaaS platforms, and development environments are scoped correctly from the start. Any gaps are identified and resolved before the formal assessment begins.

2

SCOPE & DOCUMENTATION

We confirm your assessment scope and asset list - including cloud services and SaaS platforms that must be included under v3.3. You return an Audit Authorisation Form. Our assessor checks the scope aligns with your Cyber Essentials certificate boundary before proceeding. Any partial scope exclusions require written justification; all legal entities within scope must be listed with name, registered address, and company number.

3

TECHNICAL AUDIT

Remote vulnerability scanning, internal and cloud device checks via screen share, email and browser malicious content blocking tests, and MFA verification across cloud services. Entirely remote - no on-site visits required. Practical for distributed and remote-first technology teams.

4

CERTIFIED ✓

Your CE Plus certificate is issued by IASME, published on the public register, and emailed directly to you. Valid for 12 months - annual renewal required to maintain a current certificate. Enterprise clients, procurement teams, and supply chain managers can verify it instantly on the IASME registry.

// Transparent Pricing

HOW MUCH DOES CE PLUS COST FOR TECH COMPANIES?

All prices are fixed and include the IASME certification fee. No hidden charges. See our full CE Plus pricing guide →

Organisation SizeEmployeesPrice + VAT
Micro0-9 employees£1,195
Small10-49 employees£1,495
Medium50-249 employees£2,195
Large250+ employees£3,495

NEED CYBER ESSENTIALS FIRST? BUNDLE AND SAVE

Cyber Essentials is a mandatory prerequisite for CE Plus. If you need both, buy them together and receive a bundle saving off the combined price. See bundle pricing →

// FAQ

COMMON QUESTIONS FROM TECH AND SOFTWARE COMPANIES

// Requirements
It depends on your clients and contracts. Standard CE satisfies the NCSC baseline requirement, is required for UK government contracts involving personal data, and meets the threshold for many enterprise supplier onboarding processes. CE Plus - which adds an independent technical audit - is required when enterprise clients or supply chain contracts specify independent verification rather than self-assessed CE. This is increasingly common for SaaS platforms handling client data, MSPs with privileged access to client environments, and software companies going through enterprise procurement. Under Danzell v3.3, cloud scoping has been tightened - cloud services that store or process your data cannot be excluded from CE Plus scope.
Standard CE is a self-assessed questionnaire: the supplier declares their controls are in place, but no independent party verifies them. CE Plus adds an independent technical audit - an assessor from an IASME-approved body tests that the controls are actually implemented. For enterprise clients giving a supplier privileged access to their data, systems, or customer records, self-assessed CE provides limited assurance. The NCSC's Cyber Essentials Supply Chain Playbook supports a tiered approach where higher-risk suppliers are required to hold CE Plus. St. James's Place has mandated CE Plus across its network of over 2,800 partner organisations, verified through IASME.
Yes - and under Danzell v3.3 (April 2026) they must be included. Your SaaS platform and any cloud services used by your business cannot be excluded from the CE Plus scope. Any service that stores or processes your data, or is accessible from in-scope devices, is in scope. For a software company, this typically includes your cloud hosting environment, development platforms, source code repositories, collaboration tools, and CI/CD pipelines. We advise on correct scoping during the Pre-Assessment Check.
CE Plus satisfies the independent verification requirement where enterprise clients and supply chain contracts specify it. Standard CE satisfies requirements where CE alone is specified. Many enterprise procurement portals now distinguish between self-assessed CE and independently audited CE Plus in their supplier qualification stages. Holding CE Plus puts you in the qualifying tier for those requirements without needing to go through a separate security questionnaire process for each client.
No - CE Plus certifies your own organisation's controls, not your clients' environments. As an MSP, your CE Plus assessment covers your internal systems, admin accounts, and the tools and platforms your staff use to manage client environments. The admin credentials, remote access tools, and privileged accounts you use to access client systems are in scope. Your clients' own networks and devices are not - each client would need their own CE or CE Plus assessment. CE Plus is particularly relevant for MSPs because enterprise and public sector clients increasingly require their managed service providers to hold independent verification of their own security controls before granting privileged access.
Danzell v3.3 is the current CE Plus assessment standard, effective for new assessment accounts created after 26 April 2026. Key changes for technology and software companies: cloud services that store or process your data, or are accessible from in-scope devices, cannot be excluded from scope - cloud has been in scope since earlier CE versions; v3.3 removed the ability to exclude it. Missing MFA on any cloud service that offers it is now an automatic fail, even if the provider charges extra for MFA. Critical and high patches not applied within 14 days are automatic fails across OS, firmware, and applications. Devices with unsupported or end-of-life operating systems also fail automatically. The shared responsibility model now needs to be explicitly understood and evidenced for each cloud service - IaaS VMs are in scope as managed servers because you control the OS and patching; the hyperscaler's physical infrastructure is not. Once testing starts, assessment answers cannot be changed; a second sampling failure after remediation revokes your CE self-assessment certificate.
// The Audit
The CE Plus audit independently tests the five technical controls CE covers: firewalls and network boundary devices, secure configuration of systems, user access controls and MFA, malware protection, and patch management. For a technology company this typically includes: external vulnerability scanning of your internet-facing infrastructure; internal device checks (laptops, developer workstations) via screen share; email and browser malicious content blocking tests; MFA verification across cloud services (Microsoft 365, Google Workspace, GitHub, cloud hosting admin accounts) - where a cloud service offers MFA and it is not enabled, this is an automatic fail under v3.3 even if the provider charges extra for MFA; and patching - OS, firmware, and application patches not applied within 14 days are an automatic fail. Under Danzell v3.3, your own cloud services and configurations cannot be excluded - the hyperscaler infrastructure itself is excluded under the shared responsibility model - your IaaS VMs (EC2 instances, Azure VMs, GCP Compute) are in scope as managed servers because you control the OS, patching, and configuration.
The underlying hyperscaler infrastructure - the physical servers and network managed by AWS, Microsoft, or Google - is excluded from your CE Plus scope under the shared responsibility model - v3.3 requires organisations to understand and evidence that model for each cloud service. Your IaaS VMs (EC2 instances, Azure VMs, GCP Compute) are in scope as managed servers: you control the OS, patching, and configuration. What cannot be excluded is your organisation's own use of those platforms: your admin accounts, cloud-hosted services and VMs, configurations, and any services running on top that store or process your data or are accessible from in-scope devices. For most technology companies, this means cloud-hosted application environments, admin consoles, CI/CD pipelines, and collaboration tools are in scope even if the underlying AWS or Azure infrastructure is not. We include a scoping discussion in the Pre-Assessment Check to map your environment correctly before the formal audit begins.
The technical audit typically takes a few hours to a full day depending on the number of in-scope systems and the complexity of your cloud environment. Results are normally confirmed within 3-5 business days of the audit starting. Combined with the Cyber Essentials self-assessment that precedes it, the full process typically takes one to three weeks. Once CE basic is certified, you have 90 days to complete and pass CE Plus - we include a Pre-Assessment Check to flag any gaps before the formal audit begins.
If the audit identifies controls that are not correctly implemented, you receive specific, actionable feedback on what needs to be fixed. You have 30 days from the date the CE Plus assessment started to remediate those issues - within the broader 90-day window from your CE basic certification date. Both windows run simultaneously. Our Pre-Assessment Check is included as standard and is specifically designed to surface and resolve gaps before the formal audit begins, so issues are dealt with before the assessor starts rather than after a failed result that could delay a contract award. Note: once testing has started, assessment answers cannot be changed. If an unpatched device is found during sampling, a new random sample is tested after you remediate - a second failure revokes your CE self-assessment certificate.

READY FOR CYBER ESSENTIALS PLUS?

Get independently verified for your enterprise clients, supply chain contracts, and procurement requirements. Talk to our UK-based team today. Direct contact, fixed price, IASME approved.

Start Your Certification →CE Plus Overview →Standard CE for Tech →
// Related Services

TECHNOLOGY SECTOR CYBER SECURITY SERVICES

// Bundle Saving

CYBER ESSENTIALS & CE PLUS BUNDLE

Cyber Essentials is a mandatory prerequisite for CE Plus. Buy both together and receive a bundle saving off the combined price. IASME fee included.

See Bundle Pricing →// Deeper Testing

PENETRATION TESTING

Enterprise procurement and security-conscious clients increasingly ask for an annual pen test alongside CE Plus. CVSS-scored reports, free 30-day retest included as standard. From £1,499 + VAT.

Pen Testing →// Ongoing Support

vCISO SUPPORT

Fractional CISO support for technology companies managing UK GDPR Article 32, enterprise client security requirements, and ongoing security governance without a full-time hire. Flexible and cost-effective.

vCISO Support →
// Client Reviews

WHAT OUR CLIENTS SAY

Client names are withheld in line with confidentiality requirements; character references are available upon request.

// Blog & Guides

LATEST INSIGHTS

View All Articles →