Cyber Essentials Plus Requirements

Updated October 2026 for the Danzell question set and NCSC requirements v3.3. Written by the assessors at Sovereign Secure, an IASME-licensed Cyber Essentials certification body.

Cyber Essentials Plus requirements are the same five controls as Cyber Essentials (firewalls, secure configuration, security update management, user access control and malware protection), but an assessor checks them technically instead of taking your answers on trust. This page summarises what the Cyber Essentials Plus certification audit tests, how many devices are sampled, and a checklist to work through before the day. Most audits can be run remotely, and the checklist covers what remote testing needs.

Save this checklist as a PDF

What are the Cyber Essentials Plus requirements?

You must meet five requirements to be certified. Each one has evidence you can get ready before the audit:

What does the Cyber Essentials Plus audit test?

Cyber Essentials Plus testing follows the NCSC’s Cyber Essentials Plus Test Specification v3.2, which sets out five test types. This is a plain-English summary; the specification itself is on the NCSC Cyber Essentials resources page.

If you use advanced endpoint protection such as CrowdStrike, we may not be able to verify it with our test files and will instead confirm installation in line with the vendor’s guidance.

The Cyber Essentials Plus test specification

The NCSC publishes the Cyber Essentials Plus Test Specification v3.2 (dated 28 April 2025, and still the current version on the NCSC Cyber Essentials resources page when we checked on 13 October 2026) alongside the Requirements for IT Infrastructure v3.3. It describes each test and what counts as a pass or a fail, and certification bodies run the audit against it. The test specification is the definitive source: if anything here differs, the NCSC document applies. Because the tests are set by the NCSC, preparing for them is the same whichever certification body you use.

Vulnerability testing for Cyber Essentials: is CE+ a penetration test?

No. Cyber Essentials Plus includes vulnerability testing, not a penetration test. The assessor runs an external vulnerability scan of your internet-facing systems and authenticated vulnerability scans of the sampled devices, then judges the results against the fixed pass and fail criteria in the test specification. Basic Cyber Essentials has no vulnerability testing at all.

People searching for Cyber Essentials penetration testing usually mean this audit. A penetration test is a different service: a tester is scoped to your systems and tries to find and exploit any way in, including flaws in custom-built web applications, which are outside the scope of Cyber Essentials.

Many organisations need both. A CE+ certificate is not a penetration test report, so it will not satisfy a buyer who asks for one, and a penetration test does not replace the CE+ audit. If you need both, our penetration testing team can scope the test alongside your audit.

How many devices are tested? (CE+ sample size)

We test a sample of devices based on how many of each operating system version you have:

• If operating system versions change after you submit the asset declaration form, tell us before the assessment, as the sample may change.
• Windows versions are counted by edition and feature release (for example Windows 11 Pro 24H2), so several versions mean several samples.
• Mobile phones and tablets that access company information, such as email, are in scope and sampled by operating system in the same way.
• All servers on the in-scope network are sampled by operating system, whether or not they have internet access.

Worked example: 25 laptops on one Windows 11 version (sample 4), 8 Macs on one macOS version (3), 3 servers on one Windows Server version (2) and 12 iPhones on one iOS version (3) give a sample of 12 devices. Standardising versions before the audit is the easiest way to reduce the sample. Our scoping questionnaire estimates your sample automatically.

What is in scope for Cyber Essentials Plus (CE+ scope)?

The scope is the one on your Cyber Essentials certificate: your whole organisation, or a clearly separated part of it. In practice that includes:

• Cloud services. Microsoft 365, Google Workspace and every other cloud service that holds or processes your data. They cannot be excluded.
• End-user devices. Laptops, desktops and virtual desktops, including home workers’ devices.
• Personal devices (BYOD). Staff-owned phones and computers that access company email or data.
• Servers. Physical and virtual, on premises or hosted.
• Network equipment and internet-facing services. Firewalls, routers and the public IP addresses on your asset declaration form.

Not sure where the lines are? Our Cyber Essentials scope questionnaire walks you through it.

Cyber Essentials Plus checklist: before the audit

Two weeks before

• Return the asset declaration form, listing devices, operating system versions, public IP addresses, test email addresses and how public login pages are protected.
• Install every high and critical update released more than 14 days ago on every in-scope device, including router and firewall firmware. Turn on automatic updates wherever you can.
• Remove unsupported software and operating systems, or move them out of scope behind a firewall or VLAN. Windows 10 devices need Extended Security Updates after 14 October 2025.
• Enforce MFA for every user and administrator on every cloud service that offers it.
• Give administrators separate admin accounts, and make sure admin accounts are not used for email or browsing.
• Confirm anti-malware is installed, running and up to date on every device that supports it, and that browsers warn before running downloaded files.

One week before

• Submit your Cyber Essentials basic assessment in the portal, if you have not already passed it.
• Download and install the vulnerability scanning software on the designated machine. We send a download link and instructions.
• Install the remote access or screen-sharing tool on the scanning machine.
• Book the sample devices and their users, including home workers and phone owners, for the audit day.

The day before

• Your assessor will contact you one to three days before the test and will expect the scanner to be installed by then.
• Switch on and update every sample device, and check the test email addresses are live.

Want a second pair of eyes first? Try our free Cyber Essentials readiness check, or ask about a pre-audit review through our Cyber Essentials consultancy and support.

What to expect on audit day

We agree the start time and screen-sharing method on the preparation call. On the day you need:

• An administrator available throughout the assessment, with network knowledge and authority to access every device in the sample.
• That person must be able to start and stop services on devices, as our scanner needs certain services running.
• The assessor must be able to see the administrator’s screen. We prefer Microsoft Teams, Microsoft Quick Assist or TeamViewer; other options can be discussed.
• The administrator must be able to view or control the sample machines, whether on one site or several. Ideally one machine can reach all the others for scanning and screen sharing.
• Live, working email addresses listed on the asset declaration form, so we can send the test files used for email checks.

The audit then runs in this order:

1. Confirm the email addresses for test emails and the screen-share link.
2. Start screen sharing and send the test emails.
3. Verify your external IP address matches the asset declaration form.
4. Test that anti-malware software is installed and up to date, and run the download checks.
5. Scan the agreed sample of machines. This is usually the most involved part of the day.
6. Watch sample users sign in to your cloud services to confirm MFA is prompted, and check that standard accounts cannot run administrative tasks without a separate administrator login.

If you cannot meet any of these requirements, tell us in advance.

Remote or on-site Cyber Essentials Plus?

Most CE+ audits can be run remotely. The tests are the same either way; remote audits avoid travel and suit organisations with several sites or many home workers. On-site audits are available when a remote audit is not practical, for example when sample devices cannot be reached over screen sharing.

What happens if you fail a CE+ test?

You must fix the issue on every in-scope device, not just the sampled ones, provide evidence and be retested within 30 days. The assessor may test a fresh sample of devices, and if the same vulnerabilities turn up again the Plus audit fails and, under IASME rules, your basic certificate can be withdrawn. Remote retests of up to one hour are free; other retests start at £400 + VAT. If the retest is not completed in time, a full new assessment and quote are needed.

Common reasons Cyber Essentials Plus audits fail

• A browser, PDF reader or other application missing a high or critical update that is more than 14 days old.
• An unsupported operating system still in use, such as a Windows 10 device without Extended Security Updates or an old phone that no longer receives updates.
• A cloud service where MFA is available but not enforced for every user.
• Staff using an administrator account for everyday work.
• A test file that runs without a warning because anti-malware is off or out of date on one device.
• Devices in the sample that differ from the asset declaration form.

Why Sovereign Secure for your CE+ audit?

• We are the certification body. Sovereign Secure is IASME-licensed to carry out Cyber Essentials Plus audits and issue the certificate.
• One order for both levels. The basic Cyber Essentials assessment is included in every CE+ quote.
• Remote where possible, with free remote retests of up to one hour within the month.
• More than CE+. As a PCI SSC-approved QSA company with an in-house penetration testing team, we can take your security further when a customer asks.

Next step

See Cyber Essentials Plus cost for published UK prices and what drives them, then request a Cyber Essentials Plus quote or complete the scoping questionnaire for a fixed price. For basic certification prices, see Cyber Essentials cost. Questions about this checklist? Contact us, or browse our Cyber Essentials FAQs.