Before the Cyber Essentials Plus audit: what the assessor must verify first

What must be in place before testing starts?

Before any Cyber Essentials Plus test runs, the assessor must have your written permission, a valid self-assessment certificate on the same scope, technical verification of that scope and of any sub-set segregation, and an agreed sample.

The test specification is written for the assessor, and it opens with a checklist that the assessor must complete before any test case runs. The wording is 'must', not 'should'. If any item is unresolved, testing does not commence.

• Written permission. The assessor is going to scan your public addresses and run test files on your devices. That needs signed authority from someone who can give it.
• Scope match. The CE Plus scope must be the same scope that appears on your self-assessment certificate. You cannot certify a wider or narrower scope at Plus than at the self-assessment stage.
• Technical verification of scope. The assessor checks, by technical means, that the networks and systems being tested are the ones described. Asset lists, network diagrams and the device inventory from A2.4 to A2.9 are compared with what the assessor can see.
• Sub-set segregation. If your scope is not 'Whole Organisation', the assessor must verify by technical means that the sub-set is segregated by a firewall or VLAN from the rest of the organisation.
• Sample selection. The devices and cloud accounts to be tested are agreed in advance, along with when the testing will happen.

Why does the self-assessment certificate matter?

Cyber Essentials Plus can only be carried out against a valid Cyber Essentials self-assessment certificate with the same scope, because the audit verifies those self-assessment answers.

Cyber Essentials Plus is not a standalone certification. It is an independent verification of the answers you gave in your Cyber Essentials self-assessment. The assessor's first job is to confirm that the certificate exists, is valid, and describes the same scope the Plus assessment will test.

IASME's guidance is that an organisation can complete its Cyber Essentials Plus audit within 3 months of its last Cyber Essentials certification. A certificate older than that cannot support a Plus audit, so the self-assessment has to be certified again first. Booking the Plus audit before you submit the self-assessment avoids the gap.

IASME's April 2026 scheme update also says the verified self-assessment must be completed, finalised and unchanged before Plus testing starts. If testing shows a device that contradicts an answer (for example an unsupported operating system where A6.1 said all were supported), the assessor records what is found, and you cannot amend the self-assessment to match.

How is scope verified by technical means?

The assessor checks by technical means that the networks and systems being tested match the declared scope, and that any sub-set is effectively segregated, instead of taking the scope description on trust.

Verification of scope and of sub-set segregation were added in v3.2 of the specification. The assessor is no longer allowed to take the scope description on trust.

In practice this means the assessor compares the device counts and operating systems declared in A2.6 to A2.8 with what the network and management tooling shows, confirms that the public IP addresses to be scanned belong to the applicant, and, where a sub-set is in scope, inspects the firewall or VLAN configuration that separates it. A sub-set that can still route to devices outside the boundary is not effectively segregated, and testing stops until it is.

All evidence from these checks is retained by the Certification Body for at least the lifetime of the certificate, so it can be reviewed if the certificate is ever challenged.

What should you have ready for the assessor?

A short pack sent before the day removes many common delays.

• The self-assessment certificate number and the scope statement as it appears on it.
• A device inventory: every laptop, desktop, server, virtual host, thin client, tablet and phone in scope, with operating system and version, matching A2.6 to A2.8.
• A list of every public IP address and DNS name, including IaaS instances, matching A2.5.
• A list of every cloud service in scope, matching A2.9, with one standard user and one administrator nominated for each.
• For a sub-set scope: a diagram and the firewall or VLAN rules that enforce the boundary.
• Named users who will be at the sampled devices on the day, with working email clients and browsers.
• Written authorisation for the external scan and the malware test files, signed by a director or equivalent.

How do assessors check this?