You’ve got your standard Cyber Essentials certificate, and an assessor is about to test a sample of your Macs and iPhones. This is the list of what needs to be in place on those devices and how to prove it from your DMS (formerly MDM). What changed in v3.3 lives in our Danzell update, and what certification looks like day to day is in Cyber Essentials for an all-Mac office. This piece is the preparation list.
Before the assessor connects, every in-scope Mac, iPhone and iPad should:
- be enrolled in your DMS through Apple Business
- be running a macOS or iOS version Apple still ships security updates for
- have every critical or high-risk update installed within 14 days of release, apps included
- have malware protection active and doing everything the requirements ask of it
- use a standard account for day-to-day work, with admin rights kept on a separate account
- need a password, passcode or biometric to unlock
Every Mac also needs its firewall on, and every cloud service your team uses needs MFA.
What does the Plus audit test that the standard certificate does not?
Hands-on testing of the same five controls
The assessor checks the five controls you self-assessed against on real devices. They scan your internet-facing systems, then work through a random sample: a scan for missing updates, tests to see whether malware protection catches files arriving by email and web download, a look at account privileges, and a check that MFA is on for your cloud services.
The paperwork has to be in order first
Your standard certificate needs to have been issued within the last three months, and since April 2026 your self-assessment answers are locked before testing begins. If the audit finds something your answers said was fine, you can’t quietly edit them afterwards.
What happens if the sample fails
You fix the problems and the assessor retests. They’ll recheck the original devices and pick a fresh random sample, which stops anyone patching just the machines that were tested. A second failure revokes your standard certificate too. Your certification body sets the deadline for remediation, so ask for it in writing when you book.
What does a Mac-first estate need in place before the assessor connects?
Firewall
The macOS firewall is off by default, and it’s the one control your office network can’t cover for you. Home routers are out of scope, so for anyone working, the device firewall remotely is doing the job. Turn it on with a DMS configuration profile and check your compliance report to see it across the fleet. The v3.3 firewall requirement lists desktops, laptops, servers and routers, so iPhones and iPads don’t need one.
Secure configuration
Every device needs an unlock credential and protection against repeated guessing. On iPhone and iPad, Apple’s built-in attempt limits count where you can’t configure your own. A six-character minimum is enough for a passcode that only unlocks the device. If the Mac password is also how people sign in to work services, as it is with Platform SSO, the full password rules apply instead. Remove unused accounts and software. Your DMS should show passcode compliance and local accounts per device.
User access control and MFA
This is where we most often find problems on Macs. Plenty of teams have every user set up as a local admin because it was quicker at setup. The requirements want admin work done from a separate account, so move people to standard accounts and give IT, or a managed elevation tool, the admin rights.
MFA has to be on for every cloud service, including the AI tools your team uses, and missing it on even one is an automatic fail. Passkeys count as MFA under v3.3. For anything still on passwords, the requirements ask you to give people somewhere secure to store them, which for our clients means 1Password.
Malware protection
For Macs, the anti-malware option has to do four things: stay updated, stop malware running, stop malicious code executing and block connections to malicious websites. That last one catches people out, since the protection built into macOS doesn’t filter web traffic on its own. Check with your assessor what they’ll accept, or run an endpoint security tool managed through your DMS. For iPhones and iPads, the allow-listing option fits naturally: apps only install from the App Store and have to be code-signed, so you mainly need to confirm nothing’s been set up to get round that.
Security update management
Critical and high-risk updates for operating systems and apps have to be installed within 14 days of release. The requirements also count any update where the vendor doesn’t say how serious the fixes are. Apple’s security notes list what each update fixes without giving a severity rating, so we treat every Apple security update as a 14-day update. Set update deadlines in your DMS so devices install automatically, and cover the apps people live in, such as Chrome, Zoom, Microsoft 365 and Adobe. For details on tracking vulnerabilities, see closing the Cyber Essentials Plus window.
What fails Mac fleets most often, and how do you fix it before the audit?
On the last few pre-audit checks we’ve run for clients, the devices missing from the DMS were nearly always iPhones that people had added work email to themselves. If your own report turns up more than a handful of these, our pre-certification audit and gap analysis finds and fixes them before the assessor does.
Pre-audit self-check for this week
- Export the device list from your DMS.
- Mark each Mac, iPhone or iPad that has a critical update pending for more than 14 days.
- Compare the DMS list with your asset register.
- Mark each device that is not enrolled in the DMS.
- Make a list of all the cloud services that your team uses.
- Make sure that MFA is on for each service on the list.
Each marked line goes on your to-do list for the next seven days.
Related articles
- The difference between Cyber Essentials and Cyber Essentials Plus, and how to pick one
- Vulnerability and CVE detection: closing the Cyber Essentials Plus window
- Why most UK businesses are failing Cyber Essentials Control 3
- What Cyber Essentials certification looks like for an all-Mac office
FAQs
Does FileVault need to be on for Cyber Essentials Plus?
Disk encryption isn’t one of the five controls, so the assessor won’t fail you without it. We’d still switch FileVault on across every Mac through your DMS and keep the recovery keys there, because a lost laptop is far more likely to happen to you than a failed audit.
Are personal iPhones in scope for Cyber Essentials Plus?
Yes, if they access work data or services such as email, Slack or shared files. Phones used only for calls, texts and an authenticator app are out of scope. In practice, enrolling every phone that touches work data in your MDM is the simplest way to keep evidence clean.
Is the built-in Mac malware protection enough?
It covers most of the requirement, but the anti-malware option also asks you to block connections to malicious websites, which macOS doesn’t do on its own. Ask your assessor what they’ll accept before the audit. Many of our clients add an endpoint security tool managed through their DMS.
What happens if we fail the Cyber Essentials Plus audit?
You fix what the assessor found, and they retest, checking the original devices and a new random sample. A second failure revokes your standard certificate as well. Your certification body sets the remediation deadline, so ask for it in writing when you book the audit.
