What Cyber Essentials Plus tests

Cyber Essentials Plus is an independent technical audit of the same controls you declared in your Cyber Essentials self-assessment. The NCSC's Cyber Essentials Plus Test Specification sets out five test cases: an external vulnerability scan of your internet-facing systems, an authenticated scan of sampled devices for missing updates, malware protection tests using email and browser test files, a check that cloud services prompt for MFA, and a check that standard users cannot run admin tasks. Any failed test fails the audit, with only narrow exceptions.

The NCSC's current test specification is version 3.2, dated April 2025. It used to be called the "Illustrative test specification". IASME, as Delivery Partner, adds its own rules on top, including the Danzell remediation process.

Before testing starts

The assessor must have your written permission to test, and must confirm that the Plus scope matches your Cyber Essentials certificate. They check this by technical means, not just by asking, and if your scope is a sub-set they also check that it is properly segregated. Any issues have to be resolved before testing begins.

Test case 1: external vulnerability scan

The assessor identifies all the IP addresses you use, including cloud servers (IaaS), and scans them from the internet with an approved scanning tool. The question is whether an opportunist attacker with low-skill methods could get in. Each internet-facing service found is judged pass or fail. Expect every exposed service to be examined, so close anything you do not need and make sure what remains is patched and protected.

Sampling

The remaining tests are run on a representative sample. It covers end-user devices that can reach your data or services, including mobiles, internally hosted servers and cloud services. IASME's rules say each operating system edition and version is sampled separately, and you do not get to pick which devices are tested. The assessor checks that the sample size has been calculated the way the Delivery Partner requires.

For every cloud service, the sample must include at least one normal user and one admin user. The same people can be used across several services.

Test case 2: patching, by authenticated scan

The assessor runs an authenticated vulnerability scan on each sampled device, server and cloud server. It fails if a vulnerability that is rated critical or high by the vendor, scores 7 or more on CVSS v3, or has no published severity has had a vendor fix available for more than 14 days. Virtual patching is not accepted as a long-term answer for unsupported operating systems.

Under Danzell, if the first sample fails this test, you must fix the issues across the whole scope within the remediation window, and a second sample is tested. If the same vulnerabilities appear again, you fail Plus and lose the Cyber Essentials certificate. See The three-month window for Plus.

Test case 3: malware protection

This runs on sampled user devices, servers with a desktop and cloud servers. The assessor first checks which protection each device uses.

• Email test: where a user can receive email, the assessor sends a plain test email, then emails with test files attached. Inert malware samples must be blocked. Executable test files must not run without a warning that needs the user to decide.
• Browser test: where a user can browse the web, the user tries to download test files from a website the Certification Body controls. The same rules apply. Being blocked from the site or the download is a pass.
• Manual checks: where the test files do not prove the protection works, the assessor checks logs to confirm the anti-malware is running and updating as the vendor intends.
• Application allow listing: for devices using allow listing, the assessor checks the trusted certificates are standard, and that unsigned or untrusted executables will not run.

Test case 4: MFA on cloud services

The assessor watches a user and an admin sign in to each cloud service with their organisation accounts, from an untrusted device or a private browser window. The test passes only if MFA is requested before access is given. Where several services share one sign-in service, it is tested once per sign-in service.

Test case 5: account separation

On sampled devices and cloud environments where admin tasks can be run, a user logged in with a standard account tries to run an admin process. It passes if the user is asked for separate admin credentials and the process does not run under their own account.

How results are decided

Each sub-test is pass or fail. One fail fails its test case, and one failed test case fails the audit. The specification allows a narrow exception for a small number of minor issues, at the Delivery Partner's discretion, where there is no sign of a wider failure. Do not plan on it. The assessor gives you a report of what failed and how to fix it.

To prepare, read Preparing for Cyber Essentials Plus.