Cyber Essentials Plus: What the Audit Tests

Written by Ruben Selby, Founder and Lead Security Consultant, Wolfcore. Last reviewed 7 November 2026.

In one sentence: Cyber Essentials Plus is the version of the UK government-backed Cyber Essentials scheme where an independent assessor tests your systems to prove the five basic security controls really work.

Part of our Compliance, frameworks and governance library.

What Cyber Essentials Plus is

The NCSC says Cyber Essentials and Cyber Essentials Plus assess the same five technical controls. Plus goes a step further by independently testing your systems to verify the controls work in practice. The five controls are firewalls, secure configuration, security update management, user access control and malware protection. For the plain version of the scheme, see cyber-essentials.

IASME, the NCSC’s Cyber Essentials Delivery Partner, says the verified self-assessment is a prerequisite to Plus. The audit covers a representative set of user devices, all internet gateways, and all servers with services accessible to the internet.

How it works

You hold a valid Cyber Essentials certificate first. Then a Certification Body carries out the audit. IASME says that if you need Plus you contact a Certification Body directly, and that some Certification Bodies are qualified to conduct Plus audits. The NCSC says Plus is priced by the size and complexity of your network, so it is quoted, not fixed.

Before testing starts, the assessor must have your written permission, and must check that the scope matches your certificate and the real networks. If your certificate does not cover the whole organisation, the assessor must check that the excluded parts are properly separated.

The NCSC test specification (version 3.2, April 2025) then sets five test cases:

Remote vulnerability assessment. A scan of all your internet-facing addresses, including cloud servers. It checks whether an opportunist attacker on the internet could get in with typical low-skill methods.
Patching, by authenticated scan. Sampled devices are scanned from the inside.
Malware protection. Test files are sent by email and downloaded by browser, to see whether protection blocks them.
Multi-factor authentication. The assessor watches users log in to cloud services from an untrusted device or private browser window. They must be prompted for MFA.
Account separation. A standard user tries to run an administrative task. They must be asked for a separate login.

What makes you fail

The specification is strict. Any single failed sub-test means the whole assessment fails, with one exception. The NCSC note to the delivery partner says marginal deviation in less than 5% of tests, with no sign of a wider failure of your processes, may be allowed to pass at the delivery partner’s discretion.

Specific rules from the specification:

A service with a vulnerability scoring 7.0 or more fails the remote scan.
For patching, a vulnerability counts if the vendor calls it critical or high risk, or it scores 7 or more on CVSS v3, or the vendor gives no severity. If the fix has been available for more than 14 days, it is a fail.
Virtual patching does not count as a long-term fix for unsupported operating systems.
Cloud services are tested with at least one normal user and one administrative user each.

Do you need a penetration test for Cyber Essentials Plus?

No. Cyber Essentials Plus is not a penetration test. The test cases above are scans, test files and observed log-ins, run to a fixed specification by a Certification Body. A penetration test is a different thing: a person tries to chain weaknesses together the way an attacker would. Many organisations want both, because Plus checks a baseline and a penetration test goes beyond it. See penetration-testing-methodology.

Who it affects and how badly

Buyers increasingly ask for it. The NCSC says a growing number of organisations require suppliers to be certified to bid for work. Firms that sell to larger buyers feel this first, for example MSPs, SaaS start-ups, accountancy and legal practices, recruitment firms and construction firms in the UK. Buyers in the EU, US and Armenia may not know the scheme, so ask what they accept.

Sole trader to 10 staff: usually a short audit. Worst case: a failed MFA or admin test delays a contract.
10 to 250 staff: more devices and cloud services, so more samples. Worst case: a failed remote scan because an old service is open to the internet, and a re-test.
Regulated and 250 plus: the same tests across more systems. Worst case: a failed assessment holds up a major tender.

Plus is not insurance against attack. It checks a baseline.

The UK angle

The NCSC says Cyber Essentials is the minimum standard of cyber security recommended by the Government for organisations of all sizes, and the NCSC also notes free cyber liability insurance for UK organisations with turnover under £20m that certify their whole organisation. Check the exact insurance terms on IASME’s site. You can check any organisation’s certificate in IASME’s certificate search.

What we check on a test

Wolfcore’s role here is readiness. We are not the Certification Body for your audit. A readiness review in our method follows the five test cases:

Every public IP address and cloud service you own, found from outside, with each service reviewed against the pass and fail flow chart.
Whether any device is missing critical or high updates older than 14 days.
Whether malware protection is installed, running and updated, and whether email and web filtering block risky files.
Whether every cloud login, including administrators, requires MFA from an untrusted device.
Whether people use separate admin and standard accounts.
Whether the scope you declared matches what really exists.

How to prepare

Get Cyber Essentials first and keep it valid.
List every device, server, cloud service and public IP address, so scope is accurate.
Enforce MFA for every user and admin on every cloud service. See multi-factor-authentication.
Apply critical and high updates within 14 days. See patch-management.
Close every internet-facing port you do not need.
Give admins a separate account that is not used for email or browsing.
Confirm anti-malware is installed, updating and running on every device.
Ask a Certification Body for a quote and the test plan.

FAQ

Is Cyber Essentials Plus a penetration test? No. It is a set of five test cases run to an NCSC specification.

Do I need Cyber Essentials first? Yes. IASME says the verified self-assessment is a prerequisite.

What is the most common way to fail? We hold no figure for that. The specification shows any single failed sub-test fails the assessment, with a small-deviation exception.

Sources

How Wolfcore helps

Wolfcore’s secure-by-design consulting gets you ready for Cyber Essentials Plus, ISO 27001, SOC 2 or NIS2 without the paperwork taking over. See https://wolfcore.co.uk/services/secure-by-design-compliance/.