Skip to main content

Wolfcore Cyber Security

Try our phishing simulations free for 14 days. Start free trial →
Get Started

Do I need a penetration test for Cyber Essentials Plus?

Written by Ruben Selby, founder and penetration tester at Wolfcore. Last reviewed 14 November 2026.

In one sentence: No, Cyber Essentials Plus does not require a penetration test, because its technical audit uses scans and sampled device checks instead, but the two answer different questions and many businesses end up wanting both.

What it is

Cyber Essentials Plus (CE+) is the higher level of the UK government backed Cyber Essentials scheme. The audit itself is covered in Cyber Essentials Plus: what the audit tests. IASME describes it as “based on the same technical requirements as Cyber Essentials”, with an added technical audit of your IT systems.

A penetration test is a different thing. A tester tries to break in, as an attacker would, and reports what worked. CE+ does not do that. It checks that a fixed set of controls is in place and working.

How it works

IASME says you can “complete your Cyber Essentials Plus audit within 3 months of your last Cyber Essentials certification”. The audit can be on site or remote. The tests IASME currently lists are:

  1. An external scan against each of your public IP addresses, to check for “vulnerabilities or open services that could be publicly discovered”.
  2. A sample of devices, covering each operating system type you use.
  3. On each sampled device, a vulnerability scan or manual check that installed software is supported and that high and critical patches went on within 14 days (see the 14-day patch rule).
  4. A malware protection check using safe test files sent by email and browser.
  5. An account separation check, to confirm standard users cannot do administrator tasks.
  6. A check that every cloud service shows a multi-factor authentication challenge, using at least one standard and one administrator account.

None of these is a manual penetration test. They confirm controls, not how far an attacker could get.

What we check on a test

This is the part CE+ does not cover. A Wolfcore penetration test is scoped separately. Method, not findings:

  • Your own web applications and portals. The NCSC requirements say “bespoke and custom components of web applications are out of scope” for Cyber Essentials, so a custom booking system or client portal is not examined by the scheme.
  • Whether a login, upload or API can be abused by an authenticated user.
  • Whether one stolen account lets an attacker reach data it should not.
  • Whether exposed services are configured safely, beyond simply being patched.

For web applications start with the free web vulnerability scan or read about penetration testing.

The UK angle

The pass bar is higher at CE+. IASME says a basic assessment can pass “with one or two non-compliances”, but on CE+ the applicant “has 30 days to remediate, but will not be able to pass until it is remediated”. The requirements document is Cyber Essentials: Requirements for IT Infrastructure v3.3, dated April 2026. CE+ has no fixed fee: “the cost will depend on the size and complexity of the network”.

Who it affects and how badly

  • Sole trader to 10 staff: Often the basic level is enough unless a client contract names Plus. Worst case: a lost tender.
  • 10 to 50 staff: Common among accountancy, legal, recruitment and care providers selling to public bodies. A failed sample means rework and a delay, not a fine.
  • 50 to 250 plus: Councils, schools and manufacturers supplying regulated buyers. CE+ proves controls exist. It does not prove your bespoke software is safe.

Worked example (illustration only)

A 30-person recruitment firm holds CE+ and runs a candidate portal built by a contractor. A client asks for a penetration test report. CE+ cannot supply one, because the portal is bespoke code outside the scheme. The firm books a test of the portal. Cost: the test fee and a few days of developer time to fix whatever is found. Without it, the client contract could stall.

Cyber Essentials PlusPenetration testFixed set of checksExternal scan of public IPsSample of devicesPass or fail per controlTries to get in, by handCovers your own custom appsShows how far an attacker getsReport with fixesDifferent questions. Many firms need both.
Cyber Essentials Plus checks controls on a sample, a penetration test tries to break in

How to detect a gap

  1. Compare your scope with what your buyer asked for. Ask whether they want Plus or a test report.
  2. Run the sample checks yourself first: patch levels, standard user rights, MFA prompts on Microsoft 365 or Google Workspace.
  3. List any custom software, then ask who has tested it.

How to fix or prevent it

  1. Decide what the buyer needs in writing: certificate, test report, or both.
  2. Certify basic Cyber Essentials first, then book Plus within three months.
  3. Fix patching, admin rights and MFA before the audit, using the NCSC v3.3 requirements.
  4. Test bespoke applications separately.

Related terms

Cyber Essentials Plus, Cyber Essentials, Cyber Essentials 14-day patch rule, Penetration testing methodology, Vulnerability scanning, Patch management

Back to the Compliance, frameworks and governance hub.

For how penetration testing fits ISO 27001, SOC 2 and Cyber Essentials audits, read Penetration Testing for ISO 27001, SOC 2 and Cyber Essentials.

Frequently asked questions

Is a penetration test part of Cyber Essentials Plus? No. The audit tests IASME lists are scans and sampled checks.

Can I take CE+ straight after basic Cyber Essentials? Yes. The audit can follow within three months of your last certification.

Does CE+ cover my custom web application? No. Bespoke web application components are out of scope in the NCSC v3.3 requirements.

How Wolfcore helps

Wolfcore’s secure-by-design consulting gets you ready for Cyber Essentials Plus, ISO 27001, SOC 2 or NIS2 without the paperwork taking over. See https://wolfcore.co.uk/services/secure-by-design-compliance/