Check your readiness
Checklist · CE Plus test specification v3.2

Cyber Essentials Plus checklist

What the Cyber Essentials Plus assessor tests under Test Specification v3.2: the pre-audit checks and the five test cases, with the evidence and the self-assessment question behind each.

Updated 22 September 2026
Short answer

Cyber Essentials Plus tests the controls declared in your self-assessment, on the same scope, within 3 months of your Cyber Essentials certification. The assessor runs five test cases: an external vulnerability scan, an authenticated patch scan of sampled devices, malware protection tests, an MFA check on every cloud service, and an account separation check. One fail fails the assessment.

Key facts
Rows
16 requirements in 6 sections
Sections
Before the audit, Test 1: external vulnerability scan, Test 2: authenticated patch scan, Test 3: malware protection, Test 4: MFA on cloud services, Test 5: account separation
Questions mapped
32 Danzell questions
Scheme version
CE Plus Test Specification v3.2, Requirements v3.3

How do you use this checklist?

Use this in the weeks between your Cyber Essentials certification and the audit date. Each row is a check the assessor performs, quoted from the test specification, and the evidence column is what you should be able to show before the day.

The question column links to the Danzell question that covers the row. Questions marked auto-fail end the assessment on their own if answered no (A7.15 only if a service listed there does offer MFA), so clear those first. Tick the done column as you go, or print the page to work through it on paper.

What is on the Cyber Essentials Plus checklist?

16 rows across 6 sections: each row gives the requirement, the evidence to gather and the Danzell question that asks about it, with a column to tick when it is done.

DoneRequirementEvidence to gatherQuestion

1Before the audit4 rows

Evidence to gatherSigned authorisation form or email from an authorised person.
n/a
Evidence to gatherThe self-assessment certificate and scope statement. The audit is booked within 3 months of the certificate date.
A2.1A2.2
Evidence to gatherNetwork diagram and firewall or VLAN configuration showing the sub-set boundary.
A2.2.2A2.5.1
Evidence to gatherDevice inventory by build and operating system. At least one standard user and one administrator for every cloud service.
A2.6A2.7A2.9

2Test 1: external vulnerability scan3 rows

Evidence to gatherList of public IP addresses and DNS names for every site and cloud instance.
A2.4A2.5
Evidence to gatherFirewall rule export and your own external scan from the last 30 days showing no findings that score 7.0 or more.
A4.7A4.8
Evidence to gatherRemote management settings for every boundary device.
A4.9A4.10A4.11

3Test 2: authenticated patch scan3 rows

Evidence to gatherLocal or domain credentials for the scanner and a network path from the assessor's device.
n/a
Evidence to gatherPatch compliance report for every sampled device, including third-party applications, dated within the last 14 days.
A6.4AUTO-FAILA6.5AUTO-FAIL
Evidence to gatherSoftware inventory showing supported versions only, or the sub-set design for isolated legacy devices.
A6.1A6.2A6.3A6.6

4Test 3: malware protection4 rows

Evidence to gatherAnti-malware console showing each sampled device with real-time protection on and current definitions.
A8.1A8.2
Evidence to gatherEmail security policy and attachment handling rules. A working mailbox on each sampled device.
A8.2A8.3
Evidence to gatherWeb filter configured to treat the test site like any other allowed site. Browser download protection enabled.
A8.3
Evidence to gatherAllow-listing policy export, approved application list and the trusted root certificate list.
A8.4A8.5

5Test 4: MFA on cloud services1 row

Evidence to gatherMFA enforcement report for every cloud service and authentication service. Test users ready with their second factor.
A7.14A7.15AUTO-FAILA7.16AUTO-FAILA7.17AUTO-FAIL

6Test 5: account separation1 row

Evidence to gatherLocal administrators group membership for each sampled device and the admin account register.
A7.6A7.7A7.8

What evidence does the assessor expect?

For the self-assessment, the assessor reads the notes field under each question and decides whether the wording describes a control that meets the requirement. Vague answers get a query, and unanswered queries become a fail. The evidence column above tells you what to have to hand so that every notes field can be specific: the policy name, the setting, the number of devices it applies to and the date it was checked.

For Cyber Essentials Plus, the assessor does not rely on the notes. They scan the sampled devices, send test files, watch a user log in to each cloud service and try to run an administrative task as a standard user. The same evidence still matters, because it is how you confirm the controls are in place before the audit rather than during it.

How assessors check this
The assessor works from the test specification, not from your self-assessment answers. If your self-assessment said updates are automatic but the authenticated scan finds a browser update that has been available for 20 days, Test 2 fails regardless of the policy. Run your own scan of the sample a week before the audit and again the day before.
Common failure
Test 4 fails because one cloud service uses a separate login that was never enrolled in MFA, often a finance, HR or ticketing system that sits outside the main identity provider. The rule is every cloud service, every user, every administrator. List each service from A2.9 and sign in to each one from an incognito window before the audit.

Related pages

Frequently asked questions

Yes. The assessor must verify that the Plus scope matches a valid Cyber Essentials self-assessment certificate before testing starts, and IASME says the Plus audit can be completed within 3 months of your last Cyber Essentials certification, on the same scope.

The test specification requires a representative sample rather than every device; IASME's FAQ says the random sample is typically around 10 per cent. Organisations with a standard build can be covered by a small number of samples. The assessor must verify the sample size was calculated using the Delivery Partner's method, and every cloud service needs at least one normal user and one administrator tested.

Any single fail means a fail for the assessment as a whole unless the Delivery Partner agrees the exception for marginal deviation in fewer than 5% of tests with no sign of a wider process failure. The assessor still completes every test so you get a full report. For assessment accounts created after 26 April 2026, a failed update management test is retested on the original sample plus a new random sample, and a second failure revokes the self-assessment certificate.

Much of it can. The external scan is remote by nature, and the authenticated scan, malware tests, MFA checks and account separation checks are usually observed over a screen share with the assessor connected to the sampled devices. Your Certification Body will confirm the arrangement.

No. The test specification states that virtual patching is not an acceptable long-term mitigation for unsupported operating systems and will not be recognised for compliance. Unsupported systems must be removed or isolated in a sub-set with no internet access.

Free readiness check

Would you pass the 2026 question set?

Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.

Check your readinessBook a gap analysis, from £500
  • IASME Certification Body
  • CREST accredited
  • IASME fee included
  • UK offices in Leeds, Newcastle, London and Edinburgh
Sources