Key takeaways
- Cyber Essentials Plus tests the same five technical controls as basic Cyber Essentials. Nothing extra is required technically; the difference is independent technical verification, where an assessor tests the controls on your systems rather than relying on your marked answers alone.
- The audit follows the NCSC’s Cyber Essentials Plus Test Specification v3.2: an external vulnerability scan, an authenticated patch scan, malware protection tests, an MFA check on every cloud service, and an account separation check.
- Testing runs on a representative sample of devices, drawn per operating system and including phones and tablets, plus every cloud service, using at least one standard user and one administrator account per service.
- One failed sub-test fails the assessment, with a narrow discretionary exception for marginal deviations in under 5% of tests.
- Certification must be completed within three months of basic Cyber Essentials. The Plus audit must be completed within 90 days of your basic certificate. Missing updates found by the internal scan must be fixed across the whole scope within 30 days, and a second sample check that they were.
The Cyber Essentials Plus requirements are the same five Cyber Essentials controls you answered for at the basic level: firewalls, secure configuration, security update management, user access control and malware protection. What Plus adds is independent technical verification. An IASME-licensed assessor tests those controls on a sample of your devices and on every cloud service you use, following the National Cyber Security Centre’s Cyber Essentials Plus Test Specification v3.2. This guide is written for IT managers, compliance leads and business owners who need to prepare for and pass the Cyber Essentials Plus audit.
It explains the audit process end to end: the five key test cases, how Cyber Essentials Plus differs from basic certification, how device and cloud service sampling works, what happens on audit day, how the Danzell timelines affect certification, how the tests are carried out, what commonly causes failures, and how Cyphere delivers the audit.
If you are still choosing between the two levels of the Cyber Essentials scheme, start with Cyber Essentials vs Cyber Essentials Plus. Plus matters when you need independent proof that your core security controls work in practice, especially for organisations bidding for government and NHS contracts, and because Cyber Essentials Plus Certification must be completed within three months of basic Cyber Essentials.
How does Cyber Essentials Plus differ from the basic level?
The technical requirements are identical at both levels. The current version is the NCSC’s Requirements for IT Infrastructure v3.3, assessed through IASME’s Danzell question set since 27 April 2026. Both levels assess the five technical controls in the Cyber Essentials requirements, the ones designed to stop the most common cyber threats.
What changes is the evidence. For basic certification, you complete the self-assessment questionnaire as a self-assessed certification, a director signs the declaration, the application is submitted, and a qualified assessor marks your written answers. At Plus level, the certification process moves to an independently verified route where an assessor tests your systems, because a control that exists in policy is not the same as a control that works on the laptop in front of them. This verification layer is why Cyber Essentials Plus adds a significant step to help organisations achieve certification by testing core security controls.
The NCSC describes the purpose of the test specification as being to “ensure this has indeed resulted in adequate defences against the threats in scope”: the common cyber attacks the scheme was built to stop.
You cannot take Plus on its own. A valid Cyber Essentials certificate (basic certification) with the same scope is a prerequisite. Plus is the level that NHS Supply Chain and some higher-risk central government contracts ask for; see is Cyber Essentials mandatory?
Which Cyber Essentials controls must be in place before the audit?
The audit checks the Cyber Essentials requirements guide answers against the five core technical controls before testing starts; the section on what fails, further down this page, lists the ones that decide most Plus outcomes. The one document to get right beforehand is your asset list, because the assessor draws the sample from it and a gap in it shows up quickly. Those controls also need to be effectively implemented on the systems that may be sampled.
What the assessor must verify before testing starts
Before any testing starts, your assessor from an accredited certification body has work to do that most applicants never see.
You already hold a valid Cyber Essentials certificate before pursuing Cyber Essentials Plus; therefore, CE Plus scope must match the standard Cyber Essentials.
Under the test specification, they must have written permission from you, and must verify that the Plus scope matches the scope on your Cyber Essentials certificate and the networks, systems, and in-scope devices actually being assessed, with all assessed assets matching the certified scope. Where your scope is not the whole organisation, any sub-sets (parts of the network segregated by a firewall or VLAN) must be segregated.
The samples must be identified and agreed to. Any issue arising from those checks has to be resolved before testing can begin, and the certification body keeps the evidence for the lifetime of the certificate. That step arrived in version 3.2, and it means a scope that looked convenient on the self-assessment gets checked by independent technical testing at Cyber Essentials Plus level.
What does the Cyber Essentials Plus audit test?
The testing itself is five test cases covering the certification scheme’s core technical controls, with each one mapped in brackets to the Cyber Essentials control it verifies. Each has sub-tests, and each sub-test is marked pass or fail.
Test case | What it checks | What fails |
|---|---|---|
1. Remote vulnerability assessment, the external vulnerability scan (firewalls; secure configuration systems) | Every internet-facing IP address you use, including IaaS, is scanned for exposed services. Firewall config should follow good security practices by blocking unauthenticated inbound connections, restricting administrative access, and monitoring traffic | Any service with a vulnerability scoring CVSS v3 7.0 or above (high risk and critical vulnerabilities) |
2. Patch check via an authenticated vulnerability scan on the internal infrastructure (security update management; secure configuration systems) | Sampled devices, servers and any cloud/IaaS instances aren’t running with unnecessary software, or impacted by critical or high-risk vulnerabilities | A fix left unapplied for more than 14 days where the vulnerability is rated critical or high by the vendor, scores CVSS v3 7 or above, or has no vendor severity details |
3. Malware protection (malware protection) | Sampled devices: test files by email and browser download, anti-malware software configuration (signature updates, scanning logs via manual checks); allow-listing devices get code signing checks instead | Malware test files reaching the user unblocked; executable test files running without a prompt |
4. Multi-factor authentication (user access control) | Every cloud service in scope, tested for a standard user and an administrator sign-in | Any cloud service that grants access without prompting for MFA |
5. Account separation (user access control) | Sampled devices and cloud environments where administrative processes can run, including review of user accounts and whether access is granted on a least-privilege basis. | A standard user account being able to run an administrative process without a separate login prompt |
A single failed sub-test fails the parent test case and doesn’t count as a pass. There is one exception here: where failures amount only to marginal deviation in under 5% of the tests performed, and the evidence does not point to a wider failure of your cyber security processes, IASME as delivery partner may exercise discretion.
Your assessor may also record advisory notes alongside any result: easy improvements that do not affect the outcome, and usually the most useful part of the report.
Malware protection testing in detail
Test case 3 depends on which form of malware protection each sampled device uses.
Where anti-malware software is installed, the assessor checks:
- Its effectiveness against malicious software delivered through email and through the browser, using test files
- Where the test files do not prove the software is configured correctly, manual checks confirm from its logs that it is installed and operational, and that it is updated in line with the vendor configuration instructions
Where certificate-based application allow listing is used instead, the assessor checks that:
- The list of trusted root certificates is the standard set supplied by the operating system manufacturer, or a subset of it
- Additional certificates are added to the trusted root only with the organisation’s explicit agreement
- Any unsigned binaries (executables) and certificate-signed executables that do not chain to a trusted certificate will not be executed on the device
- Operating system policies for code signing are applied to all executable file formats
Two kinds of test files are used during this audit. Malware software test files must be detected and blocked outright. Executable test files must at least produce a warning that asks the user whether to continue. A file that gets downloaded and executed silently is a fail.
How many devices are sampled?
Firstly, sampling is actually the minimum required number for each build class. It is not the go-to rule, and an assessor can check more devices. Standardised builds work in your favour: consistent provisioning means a small number of samples can stand for a lot of equipment, and variation pushes the sample size up. Larger or more complex IT environments may need broader sampling or more preparation, because consistency is harder to demonstrate. The assessor must verify that the sample size was calculated using the method IASME sets, and keep evidence of that calculation.
A useful note here: Quite often people misjudge that the sample is drawn per operating system category, not from the estate as a whole: one set from your Windows Server 2022 machines, another from your Windows 11 builds, another from macOS laptops.
End user devices mean desktop computers, laptops, thin clients, tablets and smartphones, whether physical or virtual; servers and IaaS instances are sampled alongside them.
We sample across the variety in your estate, not just the tidiest laptops, because when one device fails, the question is whether the same gap exists everywhere it was built the same way.
For mobile devices, a mobile device is in scope for CE Plus if it connects to your organisation’s email, cloud storage, business applications, or any other organisational data. Devices used only for voice calls, SMS messages, and authenticator app MFA codes are excluded. The same sampling approach is undertaken here based on the individual operating systems, not the entire device count.
Double sampling under Danzell
On top of the NCSC specification, IASME’s assessment process now adds a second sample to the internal vulnerability test (test case 2). Under IASME’s Danzell update on the CE+ internal vulnerability and remediation process, the vulnerabilities identified in Sample 1 “must be fixed across the entire scope of the CE Verified Self-Assessment certificate, not just the sampled devices”, and “This must be completed within 30 days”.
The assessor then tests Sample 2, which “must use the same calculation used for Sample 1”. The devices in it are declared to you “not more than 72 hours or 3 working days prior”, and Sample 2 “must be tested within the 30-day remediation window”; there is no separate window for it.
Second sample outcome | Result |
All required updates installed | Cyber Essentials Plus pass |
Updates missing in Sample 1 are also missing in Sample 2 | Cyber Essentials Plus fails, and the Cyber Essentials certificate is revoked |
Missing updates unrelated to those found in Sample 1 | Cyber Essentials Plus pass, with an advisory to address them |
Updates still missing after the 30-day window | Cyber Essentials Plus fails, and the Cyber Essentials certificate is revoked |
You refuse testing of Sample 2 | No Cyber Essentials Plus; the Cyber Essentials certificate remains valid |
If findings need fixing, you have 30 days to apply the fixes and have the affected checks retested, and all of it must fit inside the 90-day window. That is why we plan the Plus audit within about 60 days of the basic certificate.
Two further Danzell rules to bear in mind. Your verified self-assessment cannot be changed once Plus testing has started. And if the 90-day window expires before first-sample findings are remediated, the whole process, including the self-assessment, starts again. Our guide to the April 2026 Danzell changes covers these in full.
What do the vulnerability scans check?
A vulnerability scan is an automated check: a tool identifies the services and software running on a system and compares them with published lists of known vulnerabilities. Neither is a penetration test.
The external vulnerability scan (test case 1)
The external scan looks at your estate the way an opportunistic Internet attacker would. The assessor identifies every IP address you use, including infrastructure-as-a-service, and scans a recommended range of TCP and UDP ports with a vulnerability scan tool approved by IASME. That usually means your firewall’s public interface, Internet gateways such as VPN and remote access gateways, mail servers, a self-hosted website, and any server or cloud instance with a public address.
All the internet-facing services identified during the scan are assessed against the test case 1 criteria in the table above. Exposure on its own is not a fail, despite what you may read elsewhere; exposure without authentication or brute-force protection is.
The external scan rarely finds anything dramatic. Sometimes, we see a remote access portal from an old supplier, exposed administrative interfaces, a service nobody remembers configuring. Each one of these counts a gap, which means a risk not yet assessed or measured.
Harman Singh, IASME-licensed Cyber Essentials assessor, Cyphere
The authenticated scan, or internal scan (test case 2)
The authenticated scan is often called the internal scan or internal assessment. It logs in with credentials on internal systems, i.e. sampled devices, servers and IaaS instances, so it can see installed software versions that an external scan cannot, and it exists to find missing vulnerability fixes.
The 14-day limit in the table above runs from the day a vendor fix became available, and vulnerability fixes mean more than patches: updates, registry fixes, configuration changes, scripts, or any other mechanism the vendor prescribes.
A useful note here is that virtual patching “will not be recognised as a mechanism for compliance” for legacy unsupported operating systems. Unsupported software is an automatic fail, whatever sits in front of it. To achieve Cyber Essentials, our supported operating systems list covers what currently passes.
Basic Cyber Essentials involves neither scan; it relies on verified self-assessment only, whereas Plus adds a technical audit with independent testing of real systems. Organisations that run their own scans before the Plus audit tend to pass first time.
What evidence and access does the assessor need before testing?
Most audit delays come from access and accounts that could have been ready the week before, and the specification’s own prerequisites are set out under the audit day below. Our Cyber Essentials checklist turns them into a pre-audit list.
Does Cyber Essentials Plus include penetration testing?
No, and the distinction matters when you are comparing quotes. You will see the Plus audit sold as “Cyber Essentials penetration testing”, but the certification requirements do not include a penetration test.
The Cyber Essentials Plus audit runs automated vulnerability scans in an authenticated fashion (with privileges) and a defined set of functional tests against a sample. A network penetration test is a manual, exploratory engagement where a tester chains findings together and attempts to safely exploit them. Cyber Essentials Plus asks whether your baseline security controls work; a penetration test asks how far someone could get. Some contracts specify both, and running them together means one scoping exercise.
What happens during the Cyber Essentials Plus audit?
The assessor sends test files from an external email account that performs no filtering, hosts them on a website owned by the certification body, and needs working email clients and browsers on the sampled devices, with users at them. A typical remote audit runs in this order:
- Scope and sample confirmation: The assessor confirms the boundary, checks it matches your Cyber Essentials certificate, and agrees the sample.
- External vulnerability scan: Usually run ahead of the session, with results reviewed live.
- Authenticated scans on the sampled devices and servers.
- Email malware tests: A baseline email with no attachment is sent first to prove delivery works, then one email per test file type. The user opens each one while the assessor observes.
- Browser download tests: The user visits the certification body’s test site and attempts to download the test files. Your web filter should treat that site as it treats other allowed sites.
- MFA checks: The user and an administrator sign in to each cloud service from an untrusted device or an incognito session while the assessor watches for the multi-factor authentication prompt.
- Account separation check: A standard user attempts to run an administrative process and should be stopped by a login prompt.
- Report: The assessor compiles the report in the format set by IASME.
Who needs to be available on audit day?
- The users of the sampled devices, at their devices, for the email, browser, multi-factor authentication (MFA) on cloud services and account separation tests
- An IT contact on standby who can help users in case of any connectivity, permissions, access or other problems
For the remote audits conducted on external and internal infrastructure, they are scheduled after agreeing with the IT team.
Audits run late for ordinary reasons: a user not available, an admin account nobody can log into, filtering blocking the test files needing change from an MSP contact who is unaware. The well-prepared client has the sample agreed, the users booked, relevant stakeholders notified, and the test domain allow-listed the week before. The testing itself is rarely the slow element in this process.
Harman Singh, IASME-licensed Cyber Essentials assessor, Cyphere
Is the Cyber Essentials assessment Remote or on-site?
Cyphere delivers Cyber Essentials Plus audits remotely for the vast majority of organisations. The tests need a user at the keyboard with the assessor observing, and screen sharing does that as well as being in the room, without travel time or cost. Home workers’ devices are tested the same way.
On-site testing is available where it is genuinely needed, for example where an environment in scope cannot be reached remotely, but only with explicit agreement at scoping. It does not change what is tested or the standard applied and may attract extra costs as agreed during the scoping exercise.
How long does Cyber Essentials Plus take?
The audit itself is the short part: the assessor’s assessment and decision take one to two business days at most, driven by the sample size and the number of cloud services. See how long Cyber Essentials takes for the full timeline from readiness to certificate, and the cost guide for what Plus costs.
What counts as a Cyber Essentials Plus audit fail?
Under Danzell, three areas are automatic fails, with stricter validation especially relevant for organisations handling sensitive data: unsupported software, a cloud service without MFA, and high or critical security updates not applied within 14 days. In our experience those three, plus a few others, account for most Plus failures:
- end-of-life software past vendor support, found on a sampled device
- a cloud service in scope without MFA, often one signed up by a single department; Plus gives stronger assurance for organisations with particularly sensitive data
- security updates past the 14-day limit, firmware included (the security update management control)
- malware test files reaching the user without being blocked, usually because protection is installed but not configured to stop execution
- a standard user account able to run administrative processes (the user access control tests)
- any user devices; mobile devices with unsupported operating systems are an automatic fail
- an assessment scope on the day that does not match the scope on the Cyber Essentials questionnaire
It’s not just technical controls or secure configuration steps; incomplete asset discovery can lead to Cyber Essentials failures also. Our guide on why organisations fail Cyber Essentials covers what happens next and how the correction process works.
How Cyphere runs the Cyber Essentials Plus audit
We run Cyber Essentials certification and the Cyber Essentials Plus audit as one engagement during the readiness phase, so the scope is agreed once and the 90-day window never becomes a surprise. The readiness review goes first, because it finds the gaps/items that would otherwise fail the Plus audit: an unsupported laptop, a cloud tool without MFA, an admin account used for email. This is the real pain point that leads to unwanted surprises; therefore, we are removing this friction with readiness support and gap analysis/consultations.
All audits are remote; the user-interactive audit sessions are conducted over video conference calls by our assessor. The second element of the audit is an authenticated vulnerability assessment for the internal network and an external vulnerability assessment for Internet-facing services; these are run separately to conference calls as no user interaction is required. These are agreed with your IT team to allow us access, authorisation forms to be e-signed and relevant contacts notified.
When a sampled device fails on the day, we explain exactly what failed and why, agree the fix, and plan the retest inside the window. Our job is not to catch you out. It is to make sure the certificate means something for the organisation and not a tick in the box exercise.
Harman Singh, IASME-licensed Cyber Essentials assessor, Cyphere
Get a fixed Cyber Essentials Plus quote
Cyber Essentials Plus requirements FAQs
What is involved in a Cyber Essentials Plus assessment?
An independent assessor verifies the Cyber Essentials requirements on your systems as part of the wider certification process that organisations complete to achieve certification at Plus level, through five tests: an external vulnerability scan, an authenticated patch scan on sampled devices, malware tests by email and browser download, an MFA check on every cloud service, and an account separation check.
Is a vulnerability scan required for basic Cyber Essentials?
No. Basic Cyber Essentials is a verified self-assessment with no technical testing. Vulnerability scanning belongs to Cyber Essentials Plus, where an external scan and an authenticated internal scan are two of the five tests.
How many devices will the assessor test?
A representative sample drawn per operating system category, phones and tablets included, with the size depending on how much your builds vary. Every cloud service is tested with at least one standard user and one administrator account.
Does Cyber Essentials Plus cover cloud services?
Yes. Under v3.3, cloud services cannot be excluded from scope, and every one you use, from Microsoft 365 and Google Workspace to your CRM, is tested for MFA at Plus for a standard user and an administrator.
Can Cyber Essentials Plus be done remotely?
Yes, for the vast majority of organisations: the assessor watches each user over screen share, and on-site testing is arranged only where it is needed and agreed at scoping.
Are home workers’ devices tested?
Yes. Corporate and personal devices used for home or remote working are in scope, and a home worker’s laptop can be in the sample like any other device, tested over screen share with the user at the keyboard. Home routers are out of scope unless your organisation supplied them.
Does Cyber Essentials Plus include a penetration test?
No. The audit is vulnerability scanning plus functional tests on a sample; a penetration test is a separate, manual engagement that tries to exploit weaknesses.
What happens if one device fails on the day?
A failed sub-test fails the assessment, but it is rarely the end of the engagement: you have 30 days to fix the finding across the whole scope, and a second sample then checks that you did (see double sampling above).
How long is Cyber Essentials Plus valid?
12 months from the day the application is assessed and marked as a pass, the same as basic Cyber Essentials. Renewal means a fresh basic assessment and a fresh audit against the requirements current at the time; see our renewal guide.
Is it Cyber Essentials Plus accreditation or certification?
Strictly, certification: under the Cyber Essentials scheme your organisation is certified by an IASME-licensed certification body, and this route can be required for some UK government contracts. “Cyber Essentials Plus accreditation” is the phrase many buyers use for the same thing, so a Cyber Essentials Plus certificate is what a tender asking for accreditation means.
