By Dave Sample, Advantex Network Solutions.
In the previous article, we explored how Cyber Essentials can help automotive sector manufacturers build trust, strengthen supply-chain confidence and support diversification into higher-value sectors. Cyber Essentials is an important first step because it demonstrates intent. It shows that a business understands the core controls required to protect itself against common cyber threats and has committed to improving its security posture.
However, as manufacturers move into more demanding markets, intent alone may not be enough.
Sectors such as aerospace, rail, defence and energy are increasingly focused on assurance. Buyers want confidence that their suppliers are not only saying the right things about cyber security, but can prove that the controls are in place and operating effectively.
That is where adopting Cyber Essentials Plus and increasing visibility through vulnerability scanning become important. Together, they can help manufacturers move from a basic statement of intent to verified evidence of control. Organisations looking towards Ministry of Defence opportunities, achieving Cyber Essentials or Cyber Essentials Plus can also create a pathway towards Defence Cyber Certification, which is recognised across many MOD supply-chain requirements.
Cyber Essentials Shows Intent, Cyber Essentials Plus Provides Proof
Cyber Essentials is based on a verified self-assessment against five core technical controls: firewalls, secure configuration, security update management, user access control and malware protection. It is a recognised and valuable baseline, but it remains largely a declaration of how the organisation believes it is configured at the time of assessment.
Cyber Essentials Plus builds on the same requirements but adds independent technical verification. This includes external testing, vulnerability scanning and checks across a sample of devices to confirm that the controls are actually working in practice.
A customer assessing your suitability for a higher-value contract may not simply want to know that you have a policy for patching, access control or secure configuration. They may want assurance that your systems have been tested, that critical vulnerabilities are being managed, and that your environment is not carrying avoidable risk.
In simple terms, Cyber Essentials is the statement of intent. Cyber Essentials Plus is the evidence that the intent has been tested.
Vulnerability Scanning Is the Missing Link
Many manufacturers looking to move from Cyber Essentials to Cyber Essentials Plus can expose a gap between policy and reality.
On paper, patching may be in place. In practice, an old engineering workstation, unsupported application, exposed remote access service or a forgotten server may still be present. In a manufacturing environment, this is common because IT and OT estates often evolve over time. Systems are added to support production, suppliers connect remotely to support machinery, and older platforms may remain in service because they are tied to specific equipment or processes.
This is why vulnerability scanning is such a key enabler.
Regular vulnerability scanning helps identify what is present, what is exposed, what is unsupported and what needs attention. It supports better decision-making by helping the business prioritise remediation based on real risk rather than assumption.
This is particularly important as Cyber Essentials requirements continue to tighten. High-risk and critical updates need to be managed promptly, and cloud services must be protected with multi-factor authentication where available. A business that only checks these controls once a year may find itself exposed at the point of assessment. A business that scans, reviews and remediates regularly is much more likely to maintain compliance as part of normal operations.
Vulnerability scanning should not be seen as an optional technical extra. It is a practical way to maintain evidence, reduce uncertainty and prepare for the scrutiny that comes with Cyber Essentials Plus and more demanding customer requirements.
One Route Into Advanced Markets
Cyber Essentials Plus can help automotive businesses pivot into new markets by demonstrating a verified commitment to cyber security across aerospace, rail, energy and other high-value supply chains.
These sectors depend on supplier resilience. They need confidence that designs, production data, commercial information and delivery schedules are protected from avoidable cyber weaknesses. Cyber Essentials Plus does not guarantee contract success, but it can help remove friction from procurement conversations and strengthen a supplier’s position.
It also supports the wider trust message. A manufacturer that can demonstrate independent verification of its cyber controls is better placed to reassure customers that security is embedded into day-to-day operations, not treated as a once-a-year compliance exercise.
This becomes particularly powerful when combined with vulnerability management, IT and OT separation, secure remote access, asset visibility and clear ownership across the business.
A Separate Route Into MOD Opportunities
Automotive manufacturers looking specifically at Ministry of Defence opportunities, Defence Cyber Certification provides a separate and increasingly important route.
DCC is a cyber security certification framework for UK defence suppliers, developed by the MOD and IASME. It is designed to provide organisation-level assurance that can support UK Defence procurement and strengthen resilience across the defence supply chain.
The scheme is structured across Levels 0 to 3, with the required level linked to the cyber risk associated with the supplier’s role. All levels start with Cyber Essentials, while Levels 2 and 3 require Cyber Essentials Plus.
This creates a natural progression path for manufacturers. Cyber Essentials establishes the baseline. Cyber Essentials Plus verifies the technical controls. DCC then builds on that foundation with broader organisational resilience, governance, risk and evidence requirements appropriate to the defence contract risk.
Importantly, organisations can apply for DCC even if they are not currently delivering an MOD contract. That means manufacturers with defence ambitions can start preparing early, rather than waiting until a tender opportunity exposes a gap.
Moving From Certification To Competitive Advantage
As the automotive sector continues to diversify into aerospace, rail, energy and defence, trusted cyber security credentials are becoming an important enabler of growth.
Cyber Essentials Plus and ongoing vulnerability management help manufacturers move beyond compliance, providing the evidence customers increasingly expect from their suppliers.
North East automotive manufacturers that invest in cyber resilience today will be better placed to unlock tomorrow’s supply-chain opportunities.
