Cyber Essentials Plus: requirements, the audit, and how to pass
The independent technical audit that verifies your Cyber Essentials self-assessment. Every test case from the NCSC specification, how the sample is drawn, the pass and fail rules, and what it costs.
Cyber Essentials Plus is an independent audit of the five Cyber Essentials controls, completed within three months of a Cyber Essentials certificate on the same scope. An assessor runs an external vulnerability scan, a patch scan, malware tests, a cloud MFA check and an account separation test on sampled devices. A single fail normally fails the audit.
- Prerequisite
- Cyber Essentials certificate on the same scope, issued within the last 3 months (IASME)
- Validity
- 12 months from the date of issue; renewed each year with a new self-assessment and audit
- Test cases
- Five: external scan, authenticated patch scan, malware protection, MFA on cloud services, account separation
- Sampling
- Representative sample of devices; every public IP scanned; one normal user and one administrator per cloud service
- Pass rule
- Every sub-test must pass; marginal deviation in under 5% of tests may be excused by the Delivery Partner
- Price with Precursor
- £3,000 for up to 50 devices (2 to 3 weeks), £4,500 for 50 to 250 devices (2 to 4 weeks), £5,000 for 250+ devices (3 to 5 weeks), + VAT. Cyber Essentials and the IASME fee included
- If a test fails
- Remediation report, then targeted re-testing at no additional cost within 90 days
- Questions verified
- A4.9A6.4AUTO-FAILA6.5AUTO-FAILA7.6A7.16AUTO-FAILA7.17AUTO-FAILA8.1
What are the prerequisites?
Cyber Essentials Plus is not a standalone certification. It verifies the answers you gave in the Cyber Essentials self-assessment, so the self-assessment comes first and the Plus audit must match it. Before any test runs, the specification requires the assessor to have:
- written permission from your organisation for the external scan and the test files,
- confirmed that the Plus scope matches the scope on your valid Cyber Essentials self-assessment certificate,
- verified by technical means that the networks and systems being tested are the ones described,
- verified by technical means that any sub-set is segregated by a firewall or VLAN from the rest of the organisation, and
- identified the sample of devices and cloud accounts to be tested, and when.
IASME's guidance is that the Plus audit can be completed within 3 months of your last Cyber Essentials certification. Its April 2026 update adds that the self-assessment must be finalised and unchanged before Plus testing starts, so the answers cannot be amended to match what the audit finds. The before the audit page covers each verification and what to have ready.
What does the audit test?
The NCSC Cyber Essentials Plus Test Specification v3.2 defines five test cases. Test 1 covers every public address. Tests 2 to 5 run on a sample of end user devices, servers, IaaS instances and cloud accounts. Each test case has its own pass and fail wording, quoted on its page.
How are devices sampled?
On all but the smallest networks the assessor tests a representative sample rather than every device. The sample covers end user devices that can reach organisational data, all internally hosted servers and every cloud service. Where an organisation uses standardised builds, a small number of devices can represent many. The assessor must verify the sample was calculated using the Delivery Partner's method and keep the evidence for the lifetime of the certificate.
Cloud services are sampled by account: at least one normal user and one administrative user for every cloud service, and the same people can be used across services. The external scan in Test 1 is not sampled. See sample size for how to make your estate easier to represent.
How do you pass or fail?
Every sub-test in every test case must pass. The specification is explicit that any single fail means a fail for the assessment as a whole. The only exception is at the Delivery Partner's discretion, for marginal deviation in fewer than 5% of performed tests where the evidence does not indicate a wider failure of your processes. Tests that cannot be completed on the day may be deferred, and the NCSC recommends no more than one month. Where the audit finds non-compliance, IASME gives 30 days to remediate, and you cannot pass until it is fixed.
How much does it cost?
Precursor prices Cyber Essentials Plus by device count, because the specification samples by device. Every tier includes everything in Cyber Essentials, the technical audit, a remediation report, the IASME fee and targeted re-testing at no additional cost within 90 days, and the 50 to 250 device tier adds a pre-assessment gap analysis. The price is fixed after the scoping call.
From £3,000
- External vulnerability scan
- Configuration review
- Remediation report
- Free re-test
From £4,500
- External and internal scanning
- Multi-site audit
- Gap analysis included
- Free re-test
From £5,000
- Cloud services scoping
- Full estate audit
- Dedicated assessor
- Free re-test
Prices + VAT. The Plus price includes the Cyber Essentials self-assessment, so there is no second price to budget. If you already hold a current certificate on the same scope, the audit can begin straight away inside the three-month window. Annual recertification is typically 20 to 30% less than initial certification. Prices as published on precursorsecurity.com. See the Cyber Essentials Plus cost page for what changes the price, or the Cyber Essentials cost hub for scheme fees.
Is Cyber Essentials Plus right for you?
Who Cyber Essentials Plus suits, and who should choose something else.
A good fit if
- Suppliers whose contract names Cyber Essentials Plus, including some central government and defence work
- Organisations that want independent evidence the controls work, not only a declaration
- Organisations holding, or about to pass, a Cyber Essentials self-assessment on the same scope
Not the right fit if
- Contracts that only ask for Cyber Essentials: the self-assessment satisfies them
- Anyone wanting a penetration test of bespoke applications: Plus runs five defined test cases and does not attempt exploitation
- Organisations that cannot complete the audit within 3 months of your Cyber Essentials certification
What do you get for the price?
Cyber Essentials Plus, from £3,000. Prices are + VAT.
| Item | Status | Detail |
|---|---|---|
| Scoping call with an assessor | Included | Within 48 hours of engagement |
| Everything in Cyber Essentials | Included | The verified self-assessment that Plus builds on |
| IASME certification fee | Included | |
| Pre-assessment gap analysis | Included | Included in the 50 to 250 devices tier; otherwise from £500 + VAT |
| Technical audit against the NCSC test specification | Included | External scan, authenticated patch scan, malware protection, MFA on cloud services, account separation |
| Remediation report | Included | Specific configuration changes, missing patches and policy updates |
| Free re-test | Included | Targeted re-testing at no additional cost within 90 days to validate fixes before the certificate is issued |
| Certificate | Included | |
| Remediation work on your systems | Not included | |
| Penetration testing | Not included | A separate CREST-accredited service |
| VAT | Not included | Prices are + VAT |
What happens if you fail, and other policies
Scheme rules are set by IASME and the NCSC and apply whichever Certification Body you use. Precursor terms are ours.
| Policy | What happens | Basis |
|---|---|---|
| Pass rule | Every sub-test must pass; marginal deviation in under 5% of tests may be excused by the Delivery Partner | Scheme rule |
| If a test fails | Remediate and retest. For update management, the original sample plus a new random sample are retested (IASME, April 2026) | Scheme rule |
| If an update management retest fails | The verified Cyber Essentials self-assessment certificate is revoked and the process starts again | Scheme rule |
| Self-assessment answers | Finalised before Plus testing starts and cannot be adjusted afterwards | Scheme rule |
| Re-test with Precursor | Targeted re-testing at no additional cost within 90 days to validate fixes before the certificate is issued | Precursor |
| Deferred tests | NCSC recommends deferral of no more than one month | Scheme rule |
| Self-assessment | Included in the Plus price: Cyber Essentials Plus includes everything in Cyber Essentials | Precursor |
| If you already hold Cyber Essentials | The technical audit can begin immediately, inside the three-month window | Precursor |
| Quote | Scoping call within 48 hours, then a fixed-price quote within 48 hours of it. No day-rate surprises | Precursor |
| Annual recertification | Typically 20 to 30% less than initial certification | Precursor |
| Other terms | Fixed in writing with your quote after the scoping call | Precursor |
Service specification
| Attribute | Value |
|---|---|
| Service | Cyber Essentials Plus |
| Provider | Precursor Security Ltd, founded 2018 |
| Price from | From £3,000 (3000 GBP) |
| Price tiers | Up to 50 devices (single site): from £3,000, 2 to 3 weeks; 50 to 250 devices (2 to 3 sites): from £4,500, 2 to 4 weeks; 250+ devices (multi-site and cloud): from £5,000, 3 to 5 weeks |
| VAT | Prices are + VAT |
| IASME scheme fee | Included |
| Turnaround | 2 to 3 weeks (up to 50 devices), 2 to 4 weeks (50 to 250 devices), 3 to 5 weeks (250+ devices) |
| Delivery | Remote or on site, depending on scope and where devices are. Managed devices can be tested over a supervised screen share. |
| Areas served | United Kingdom. Offices: Leeds HQ, Newcastle SOC, London office, Edinburgh office |
| Credentials | IASME Cyber Essentials Certification Body; CREST Security Testing (penetration testing); CREST SOC |
| Outcome | Cyber Essentials Plus certificate and a listing on the IASME certificate register |
| Validity | 12 months from issue |
| Prerequisites | A Cyber Essentials self-assessment certificate on the same scope (included in the Plus price; not repeated if you certified less than 3 months before); Audit completed within 3 months of your Cyber Essentials certification; Written permission for the external scan and test files; Technical verification of scope and any sub-set segregation before testing |
| Eligible customers | Businesses and other organisations |
| How to buy | Book a scoping call |
| Price source | precursorsecurity.com/services/compliance/cyber-essentials-plus |
| Machine-readable | /offers.json |
Book a scoping call
Twenty minutes with an assessor, within 48 hours of your request, to confirm your scope, device count, sites and cloud services. You get a fixed-price quote within 48 hours of the call and a date inside your three-month window.
- IASME-accredited Certification Body
- Free re-test after remediation
- Gap analysis included in the 50 to 250 device tier, from £500 + VAT standalone
Cyber Essentials Plus pages
- Before you beginThe five things a Cyber Essentials Plus assessor must have in place before any test starts
- Sample testingHow a Cyber Essentials Plus assessor selects a representative sample of end user devices, servers and cloud accounts, why standard builds shrink the sample, and the rule of one normal user plus one administrator per cloud service.
- Test case 1What the Cyber Essentials Plus remote vulnerability assessment covers
- Test case 2How the Cyber Essentials Plus authenticated vulnerability scan works on sampled devices, the three criteria that define a critical or high-risk vulnerability, the 14-day rule, and why virtual patching does not count.
- Test case 3How the Cyber Essentials Plus assessor tests malware protection
- Test case 4How the Cyber Essentials Plus assessor verifies multi-factor authentication on every cloud service
- Test case 5How the Cyber Essentials Plus assessor tests that standard user accounts do not hold administrator privileges
- Success criteriaThe Cyber Essentials Plus success criteria in full
- PreparationThe remediation order that gets organisations through Cyber Essentials Plus first time
- CostWhat Cyber Essentials Plus costs in 2026
- Cyber Essentials Plus checklistWhat the assessor tests on the day
- CE Plus test specification v3.2The NCSC document the audit follows
Frequently asked questions
Cyber Essentials is a self-assessment questionnaire marked by an assessor. Cyber Essentials Plus is an independent technical audit of the same scope: an external scan, an authenticated patch scan and observed tests of malware protection, MFA and account separation on a sample of your devices and cloud accounts.
Yes. Plus requires a valid Cyber Essentials self-assessment certificate on the same scope, and IASME says the Plus audit can be completed within 3 months of your last Cyber Essentials certification. If the certificate is older than that, it has to be renewed before the audit.
Twelve months. IASME's terms make certificates valid for 12 months from the date of issue, and renewal is a fresh assessment rather than an extension. To keep Plus you renew the self-assessment and then complete a new Plus audit within three months of it, so most organisations schedule both together each year.
With Precursor, 2 to 3 weeks for up to 50 devices, 2 to 4 weeks for 50 to 250 devices, 3 to 5 weeks for 250+ devices. The scoping call happens within 48 hours of engagement. The technical audit itself typically takes 1 to 2 days, depending on scope, and can run remotely where devices are managed centrally.
A representative sample chosen by the assessor from your full inventory, sized using the Delivery Partner's method; IASME's FAQ says it is typically around 10 per cent of in-scope systems. Standardised builds reduce the sample. Every public IP address is scanned in Test 1, and every cloud service is tested with at least one normal user and one administrator.
Any single fail fails the assessment, unless the Delivery Partner judges it marginal deviation in fewer than 5% of tests with no wider process failure. Failed tests are remediated and retested, and IASME gives 30 days to remediate non-compliance found in the audit. Since April 2026, a fail on update management (Test 2) is retested on the original sample plus a new random sample, and a second failure revokes the self-assessment certificate.
With Precursor, from £3,000 for up to 50 devices (2 to 3 weeks), £4,500 for 50 to 250 devices (2 to 4 weeks), £5,000 for 250+ devices (3 to 5 weeks), all + VAT. The price includes everything in Cyber Essentials (the verified self-assessment Plus builds on), the audit, a remediation report, a free re-test within 90 days and the IASME fee. The 50 to 250 device tier also includes a pre-assessment gap analysis.
Largely, yes. The external scan is remote by nature, and the device tests can be observed over a supervised screen-share on managed devices. The assessor must still verify scope and sampling by technical means, and some estates need a site visit.
No. It is a defined set of five test cases from the NCSC specification aimed at the low-skill opportunist attacker. A penetration test goes further, attempts exploitation and covers bespoke applications.
Ready for the technical audit?
A 20-minute scoping call with an IASME-accredited assessor fixes your scope and device sample, then you get a written price from £3,000 + VAT within 48 hours and testing booked inside your three-month window.
- IASME Certification Body
- CREST accredited
- UK offices in Leeds, Newcastle, London and Edinburgh
- NCSCNCSC, Cyber Essentials Plus Test Specification v3.2Read on ncsc.gov.uk (opens in a new tab)
- NCSCNCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 · April 2026Read on ncsc.gov.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials and Cyber Essentials Plus: what is the difference? · 3-month window, 30 days to remediateRead on iasme.co.uk (opens in a new tab)
- IASMEIASME, Important update: changes to Cyber Essentials for April 2026 · Update management retest and revocationRead on iasme.co.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials terms and conditions · Clauses 2.4 and 2.6: 12-month validity, free resubmission within 48 hours of the fail noticeRead on iasme.co.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials frequently asked questionsRead on iasme.co.uk (opens in a new tab)