A Cyber Essentials Plus assessment applies the five test cases in the NCSC test specification v3.2: an external vulnerability scan, an authenticated patch scan of sampled devices, malware protection tests by email and browser, an MFA check on every cloud service, and an account separation check. Any sub-test fail fails the whole assessment unless the marginal-deviation exception applies.
Key takeaways
- Cyber Essentials Plus runs the five test cases in the NCSC Cyber Essentials Plus Test Specification v3.2 against a sample of your devices and every cloud service.
- Under the v3.2 specification, any single sub-test fail fails the whole assessment unless only marginal deviation is found in under 5% of tests and the Delivery Partner allows a pass.
- Test case 2, the authenticated patch scan, fails any sampled device with a critical or high-risk fix available for more than 14 days, and the specification does not recognise virtual patching of unsupported operating systems as a way to comply.
- Every cloud service listed at A2.9 is tested with at least one standard user and one administrator, per the specification's sampling rules.
- Standard
- NCSC Cyber Essentials Plus Test Specification v3.2 (April 2025)
- Test cases
- 1 external scan, 2 authenticated patch scan, 3 malware protection, 4 MFA on cloud services, 5 account separation
- Pass rule
- Every sub-test must pass; the Delivery Partner may allow a pass for marginal deviation in under 5% of tests
- Before testing
- Written permission, scope matches the self-assessment, sub-sets verified, sample calculated, self-assessment finalised
- Timing
- Self-assessment certificate under three months old, or the self-assessment stage is repeated (IASME FAQ)
- Patch scan failure
- Retest of the original sample plus a new random sample; a second failure revokes the self-assessment certificate
Cyber Essentials Plus tests what you told the self-assessment. The NCSC test specification v3.2 gives the assessor five test cases and a strict pass rule: every sub-test must pass, and any single fail is a fail for the assessment as a whole unless the specification states an exception. Below is the order we run the day in. Timings are ours, from experience; the tests are the specification's.
Before the day: what has to be true?
The specification lists prerequisites the assessor must resolve before testing starts. Written permission. Confirmation that the Plus scope matches the valid self-assessment certificate. Technical verification that the networks being tested are the ones in scope, and that any sub-set is actually segregated. The sample identified. If any of these is open, the day does not start.
Two IASME rules from April 2026 sit on top of the specification. The verified self-assessment must be completed, finalised and unchanged before Plus testing begins, so you cannot correct an answer after the assessor finds something. And IASME's FAQ says the self-assessment stage only carries over if that certificate is less than three months old when you certify to Plus.
We send the sample list a week ahead. It covers every operating system and build in A2.6, A2.7 and A2.8, at least one server if you have one, and for cloud services at least one standard user and one administrator per service. The same person can be the user for several services.
09:00, test case 1: external vulnerability scan
We scan every IP address you use, including IaaS, on the specification's recommended TCP and UDP ports. Each internet-facing service found is assessed with the specification's flow chart. This test does not need anyone from your side beyond confirming the address list, so it runs while we set up the rest.
10:00, test case 2: authenticated patch scan
An approved vulnerability scanner runs on each sampled laptop, server and IaaS instance with credentials. The rule is the same as A6.4AUTO-FAIL: any vulnerability the vendor calls critical or high risk, with a CVSS v3 base score of 7 or above, or with no severity given, where the fix has been available for more than 14 days, is a fail for that device.
This is the test that ends most days early. The scanner does not accept a compensating control; the specification says virtual patching is not an acceptable long-term mitigation for legacy unsupported operating systems.
A fail here now has a second stage. Since April 2026, IASME requires you to remediate and then have the assessor retest the original sample plus a new random sample of devices. A second failure revokes the verified self-assessment certificate, so patch the whole estate, not only the devices on the sample list. The pass and fail rules and test 2 page cover the retest in detail.
| Test case | Applies to | Pass condition |
|---|---|---|
| 1. External vulnerability scan | All internet-facing IPs including IaaS | No service fails the flow chart |
| 2. Authenticated patch scan | Sampled EUDs, servers, IaaS | No qualifying fix older than 14 days |
| 3. Malware protection | Sampled EUDs, interactive servers, IaaS | Test files blocked by email and browser, or allow-listing verified |
| 4. MFA configuration | All cloud services, user and admin | MFA prompt observed on a fresh session |
| 5. Account separation | Sampled EUDs and admin-capable environments | Admin process prompts for separate credentials |
11:30, test case 3: malware protection
For devices using anti-malware, we check it is installed and running, then send the specification's test files to a user's mailbox and have them try to download the same files in a browser. A file that arrives and can be opened is a fail. Where the software's behaviour cannot be proven with the files, the specification allows manual checks that it is installed, operational and updating per the vendor's guidance.
For devices using application allow-listing, sub-test 3.2 checks the trusted root certificates are the vendor's standard set, that unsigned executables will not run, and that policy applies code signing to every executable format.
Ask your email provider to allow the assessor's sending domain before the day. The specification requires the test emails to reach you unfiltered by a deny list; if they are dropped at the gateway we cannot record a result, and a deferred test still has to be run.
13:30, test case 4: MFA on every cloud service
We watch a user and an administrator sign in to each cloud service from an untrusted device or an incognito session. An MFA prompt before access is a pass. No prompt is a fail. Where several services share one identity provider, the sign-in is tested once per authentication service. The list is A2.9, so if it has a service on it that nobody has logged in to since the self-assessment, expect to log in to it today.
14:30, test case 5: account separation
On each sampled device, the user attempts an administrative action from their standard account. If the device prompts for separate credentials and the process does not run under the user's account, it passes. Local admin rights granted "temporarily" in March are the usual fail.
The patch scan finds a laptop with a browser update available for 20 days because the user never relaunched it, and a firewall two firmware versions behind. Two devices, two fails, and the 5% marginal-deviation exception is a Delivery Partner decision, not the assessor's. Run your own authenticated scan the week before.
15:30, report and result
The specification has the assessor complete every test even after a fail, so you get a full appraisal. A pass on every test case leads to the certificate. Fails go to the Delivery Partner where minor, or to a retest where not.
Each test case has its own page: external scan, patch scan, malware protection, MFA and account separation. The sample size page explains how the device list is built. The Cyber Essentials Plus hub explains each test case with the pass criteria, and the how to prepare page gives the remediation order that gets through test 2. If you have a self-assessment pass and a three-month window running, book a scoping call and we will send the sample list and prerequisites the same week.
- NCSCNCSC, Cyber Essentials Plus Test Specification v3.2Read on ncsc.gov.uk (opens in a new tab)
- NCSCNCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 · April 2026Read on ncsc.gov.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials Danzell Question Set 2026 (v16.3)Read on iasme.co.uk (opens in a new tab)
- IASMEIASME, Important update: changes to Cyber Essentials for April 2026Read on iasme.co.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials frequently asked questionsRead on iasme.co.uk (opens in a new tab)
Frequently asked questions
A representative sample, calculated with the method the Delivery Partner sets. IASME's FAQ puts it at typically around 10 per cent of in-scope systems. The specification requires the assessor to verify the calculation and retain the evidence for the lifetime of the certificate. Standardised builds reduce the sample; every distinct operating system and build type has to be represented.
The specification is written around the assessor observing users, which can be done in person or over a screen-sharing session. Remote assessment is common for organisations with no office. Either way, the users of the sampled devices need to be available during the day.
Any single fail is a fail for the assessment as a whole, with one exception: where only marginal deviation is found in under 5% of tests and the evidence does not indicate a wider process failure, the Delivery Partner can allow a pass. Tests can also be deferred at the Delivery Partner's discretion, and the guidance is not to defer for more than one month.
Soon after the self-assessment. IASME's FAQ says that if your verified self-assessment certificate is less than three months old when you certify to Cyber Essentials Plus, you do not repeat the self-assessment stage. Since April 2026 the self-assessment must also be completed, finalised and unchanged before Plus testing starts, and the assessor checks that the Plus scope matches it.
Under the IASME rule in force since April 2026, you remediate and the assessor retests the original sample plus a new random sample of devices. A second failure revokes the verified self-assessment certificate. IASME introduced the rule because some organisations updated only the sampled devices.
Ready for the technical audit?
A 20-minute scoping call with an IASME-accredited assessor fixes your scope and device sample, then you get a written price from £3,000 + VAT within 48 hours and testing booked inside your three-month window.
- IASME Certification Body
- CREST accredited
- UK offices in Leeds, Newcastle, London and Edinburgh