In short: Cyber Essentials Plus uses two vulnerability scans. Test case 1 scans every IP address you use, including IaaS, from the internet for exposed or vulnerable services. Test case 2 is an authenticated scan of sampled devices, servers and IaaS instances, and fails if a critical or high-risk fix has been available for more than 14 days without being installed.
Two scans, two questions
The NCSC *Cyber Essentials Plus Test Specification* v3.2 uses scanning to answer two different questions.
| Test case 1: remote vulnerability assessment | Test case 2: authenticated scan | |
|---|---|---|
| Question asked | Could a low-skilled attacker on the internet get in? | Are critical and high-risk fixes installed within 14 days? |
| Where it runs from | The internet, against your public addresses | Against each sampled device, with credentials |
| What is covered | Every IP address in use, including IaaS | Sampled end-user devices, servers and IaaS instances |
| Main control tested | Firewalls (and updates on exposed services) | Security Update Management |
| Tool | A scanner approved by the Delivery Partner | A scanner approved by the Delivery Partner |
Both feed straight into pass or fail. They are part of the wider Cyber Essentials Plus audit.
Test case 1: the external scan
The assessor identifies every IP address you currently use and scans them all on a recommended set of TCP and UDP ports chosen by the Delivery Partner. Points to plan for:
- All addresses, not just the office line. Include every internet connection, any static ranges, and IaaS such as virtual machines or public load balancers in Microsoft Azure, AWS or Google Cloud.
- Dynamic IP addresses. Where a connection uses a dynamic address, scope can be defined by DNS names. The specification warns assessors to take care with carrier-grade NAT so test traffic does not hit someone else's system.
- Every service found is judged. For each internet-accessible service the assessor decides pass or fail using the specification's decision flow. If any service fails, the test case fails.
What tends to fail is anything a casual attacker could exploit: an out-of-date VPN or remote access portal, a firewall or router admin page reachable from the internet, or remote desktop exposed directly. The v3.3 firewall requirements already say admin interfaces must not face the internet unless there is a documented need and they are protected by MFA, or by an IP allow list with managed passwords, and every inbound rule must be approved, documented and removed when no longer needed.
Test case 2: the authenticated patch scan
Each sampled end-user device, server and IaaS instance is scanned with credentials, so the scanner can see installed software and missing fixes rather than guessing from the outside. The assessor looks for vulnerabilities that:
- the vendor describes as critical or high risk, or
- have a CVSS v3 base score of 7 or more, or
- come with no severity information from the vendor.
If any of these has a vendor fix that has been available for more than 14 days and is not applied, the device fails. A "fix" is whatever the vendor prescribes: a patch, an update, a registry change, a configuration change or a script. Virtual patching is not accepted as a long-term substitute for an unsupported operating system.
The scan covers applications as well as the operating system, so browsers, PDF readers, runtimes, collaboration apps and device firmware all count. Under Danzell the same 14-day rule is now an automatic fail in the self-assessment too (questions A6.4 and A6.5), and if a sample fails at Plus the retest includes a new random sample. See Cyber Essentials security update management.
Unsupported software: the scan will find it
Software that no longer receives security updates cannot be patched, so it fails test case 2. It should not reach the audit at all: the v3.3 requirements say in-scope software must be licensed and supported, and under Danzell it must be supported on the date your certificate is issued. The usual culprits are:
- Windows 10 devices not enrolled in Microsoft's Extended Security Updates; see Windows 10 and Cyber Essentials
- old macOS versions, phones and tablets no longer receiving updates
- legacy server operating systems kept for one application
- end-of-life browsers, plug-ins, runtimes and line-of-business software
Remove it, upgrade it, or move it to a segregated sub-set with no internet traffic that sits outside your scope, before you lock the self-assessment.
How to prepare for both scans
- List every public IP address and DNS name you use, including cloud workloads, and confirm each is in scope.
- Run your own external scan. Close ports that do not need to be open, put remote access behind MFA, and update anything exposed.
- Turn on automatic updates for operating systems and applications, and use device management such as Microsoft Intune to report devices that fall behind.
- Run authenticated scans on a spread of devices in each build and clear every critical or high finding, not just Windows updates.
- Check firmware on firewalls, routers and other network devices; it counts as software.
- Retire unsupported software and confirm with a final scan a few days before the self-assessment is locked.
Network security products such as Cisco Secure Firewall and Sophos Firewall help with the boundary, but configuration and patching discipline matter more than the brand.
How we help you pass the scans
We run both kinds of scan before the assessor does, explain each finding in plain English, and fix them with you: patching, upgrading or removing unsupported software, tidying firewall rules and closing exposed admin interfaces. For organisations that struggle to stay inside 14 days, we can put managed update processes in place so the next audit is routine. Forever Systems is not a Certification Body; the formal scans are carried out by the assessor.
Contact us to book a pre-audit scan.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is scanned in Cyber Essentials Plus?
Every IP address you use, including IaaS, is scanned from the internet (test case 1), and a representative sample of end-user devices, servers and IaaS instances is scanned with credentials for missing security fixes (test case 2).
What fails the Cyber Essentials Plus vulnerability scan?
Externally, any exposed service the assessor judges exploitable fails test case 1. Internally, any critical or high-risk vulnerability, CVSS v3 score 7 or above, or unrated vendor fix that has been available for more than 14 days and is not installed fails test case 2.
Which ports are scanned for Cyber Essentials Plus?
The assessor scans a recommended set of TCP and UDP ports specified by the Delivery Partner rather than every possible port. The NCSC suggests well-known service ports as a starting point.
Does a home worker's router get scanned?
Home routers that the organisation does not supply are out of scope, so they are not part of the external scan; the device instead needs its own software firewall. A router you supply to a home worker is in scope.
Can we use virtual patching to pass?
Not for unsupported operating systems. The test specification says virtual patching is not an acceptable long-term mitigation for legacy unsupported systems, so they must be upgraded, replaced or removed from scope.