In short: A Cyber Essentials Plus audit starts once your Cyber Essentials self-assessment is certified and locked. The assessor gets written permission, verifies scope and segregation, agrees a representative sample, then runs an external scan and observed tests on sampled devices and cloud accounts. Any single failure fails the audit; pass and you receive a report and certificate.
Before the audit is booked
- Certify the verified self-assessment. Plus needs a current Cyber Essentials certificate covering the same scope. Under Danzell the self-assessment must be final and unchanged before testing starts.
- Book within three months. The Plus audit has to be completed within three months of the Cyber Essentials certificate, so schedule it before you submit the self-assessment.
- Choose a Certification Body. Plus is quoted individually by IASME-licensed Certification Bodies, priced on the size and complexity of what is in scope.
- Give written permission. The assessor needs your written authority before running any scan or test.
Allow time for remediation before step 1. Once the self-assessment is locked you cannot amend it to match what testing finds.
Scope checks and choosing the sample
The NCSC *Cyber Essentials Plus Test Specification* v3.2 makes the assessor verify three things before testing. First, that the Plus scope matches the scope on your self-assessment certificate. Second, by technical means, that this scope matches the networks and systems actually being assessed. Third, if you certified a sub-set rather than the whole organisation, that the sub-set is segregated effectively, for example by a firewall or VLAN. Our Cyber Essentials scope guide explains how to define it.
Testing every device is impractical for most organisations, so the assessor tests a representative sample:
- The sample must reflect every kind of device in scope: end-user devices that reach organisational data or services, internally hosted servers and cloud services (IaaS, PaaS and SaaS).
- Standardised builds help. If your laptops share one managed configuration, fewer samples can represent them.
- The sample size is calculated using the method set by IASME as Delivery Partner. The assessor must check the calculation, and the Certification Body keeps the evidence for at least the life of the certificate.
- How many devices you need to test depends on how much your builds vary and how well your provisioning keeps them consistent, so a tidy, managed estate needs fewer samples than an ad hoc one.
- Every cloud service must be tested with at least one normal user and one administrator account. The same people can cover several services.
If you have a mix of Windows, macOS, mobile and server builds, expect each to be represented.
Getting ready for test day
- A test mailbox. The assessor sends test emails from an unfiltered external system to an account you run, so make sure it receives external mail.
- Access to the test-file site. Test files are hosted on a website owned by the Certification Body. You may need to allow-list it so the test reflects your normal web filtering.
- Users at their devices. Sampled users need to be available with their credentials, a working email client and a browser. For remote testing, the assessor observes them over a remote session.
- An admin on hand. Someone who can answer questions about your firewall, cloud tenant and device management.
- No last-minute changes. Avoid big configuration changes in the days before; a half-finished change can easily turn a pass into a fail.
On test day: the tests in order
The assessor works through the five test cases described on our Cyber Essentials Plus requirements page:
| Stage | What happens | Who needs to be involved |
|---|---|---|
| External scan (test case 1) | Every IP address in use, including IaaS, is scanned from the internet; each exposed service is judged | IT contact to confirm IP addresses and DNS names |
| Authenticated scans (test case 2) | Sampled devices, servers and IaaS instances are scanned with credentials for missing critical or high fixes older than 14 days | IT contact to provide scan access |
| Malware tests (test case 3) | Test emails with attachments, browser downloads, or manual checks of anti-malware or allow listing | Sampled users at their devices |
| MFA checks (test case 4) | Users and admins sign in to each cloud authentication service from an untrusted device or private browser | A normal user and an admin per service |
| Account separation (test case 5) | A standard user tries an admin task and must be asked for separate credentials | Sampled users |
The scans are covered in more depth on Cyber Essentials Plus vulnerability scans. Even if a test fails, the assessor is expected to complete the full assessment so you get a complete picture.
Results, advisory notes and retests
Every test case and sub-test is marked pass or fail. One fail fails the assessment unless the specification allows an exception, and at the end IASME, as Delivery Partner, has discretion where failures are marginal deviations in under 5 per cent of the tests performed and do not suggest a wider weakness. Assessors can add advisory notes to any result to suggest easy improvements or explain a decision; they do not affect the outcome but are worth acting on before renewal.
If testing cannot be finished on the day for technical reasons, the Delivery Partner can allow tests to be deferred; the NCSC recommends no longer than a month.
Under the Danzell rules, if the sample fails the security update test, you fix the issues and the retest covers the original sample and a new random sample, so patching only the devices that were picked will not work. Fail again and the self-assessment certificate is revoked too. Pass, and you receive the assessor's report and your Cyber Essentials Plus certificate, valid for 12 months. Find out why organisations fail Cyber Essentials to avoid the usual traps.
How we rehearse the audit with you
Forever Systems prepares organisations for Plus and works alongside an IASME-licensed Certification Body; we are not the assessor. Before the real audit we run a rehearsal that mirrors it: an external scan of your IP ranges, authenticated scans on a realistic sample, harmless test files by email and browser, MFA sign-ins on each cloud service and admin-rights checks on each build. We fix what we find, then help you organise users, devices and the test mailbox for the day.
Contact us to schedule a rehearsal before you lock your self-assessment.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
How long does a Cyber Essentials Plus audit take?
It depends on the size and variety of the sample, the number of cloud services and whether testing is remote or on site. Standardised, well-managed devices need fewer samples. Your Certification Body will set out the expected testing time when it quotes.
How many devices are tested in Cyber Essentials Plus?
A representative sample, sized using IASME's method and checked by the assessor. It must cover each type of device and build in scope, so standardised builds need fewer samples, and each cloud service needs at least one normal and one admin user.
Can we change our self-assessment after Plus testing starts?
No. Under Danzell the verified self-assessment must be finalised and unchanged before Plus testing begins, and it cannot be adjusted to match what testing finds, so fix gaps before you submit it.
What happens if a device fails the patching test?
Under Danzell the retest covers the original sample plus a new random sample. A second failure revokes your Cyber Essentials self-assessment certificate as well as failing Plus.
Do users need to be present for the Plus audit?
Yes. Several tests are observed: the assessor watches sampled users open test files, sign in to cloud services and try an admin task, either in person or over a remote session.