Check your readiness
CE Plus · Sample testing

Cyber Essentials Plus sample size: how devices and users are chosen

How a Cyber Essentials Plus assessor selects a representative sample of end user devices, servers and cloud accounts, why standard builds shrink the sample, and the rule of one normal user plus one administrator per cloud service.

By Precursor Security, an IASME Certification BodyUpdated 22 September 2026
Short answer

Cyber Essentials Plus tests a representative sample of the devices in scope rather than every device. The assessor must verify the sample size was calculated using the Delivery Partner's method and keep the evidence. Standardised builds allow a small number of devices to represent many. Every cloud service is tested with at least one normal user and one administrator.

Key facts
Source
CE Plus Test Specification v3.2, 'Sample testing'
Applies to
End user devices that can reach organisational data or services, all internally hosted servers, and all cloud services (IaaS, PaaS, SaaS)
Cloud accounts
At least one normal user and one administrative user per cloud service; the same users can be reused across services
Who sets the method
The Delivery Partner (IASME); the assessor verifies the calculation and retains the evidence
Test 1 exception
The external scan is not sampled: every public IP address is scanned

What is sampled and what is not?

Test case 1, the external vulnerability scan, is not sampled. Every IP address the applicant uses, including IaaS, is scanned. Sampling applies to the remaining test cases, which run on devices and cloud accounts.

Cyber Essentials Plus Test Specification v3.2

The remaining tests apply to all computing devices within the boundary of scope. This includes: end user devices (EUDs) that can connect to organisational data or services; all internally hosted servers; all types of cloud service (IaaS, PaaS, or SaaS). On all but the smallest networks it will be impractical to test every device that is within the agreed boundary of scope. Instead, test a representative sample.

  • End user devices: laptops, desktops, thin clients, tablets and phones that can reach organisational data or services, including BYOD in scope.
  • Servers: every internally hosted server and virtual host, plus IaaS instances.
  • Cloud services: every SaaS, PaaS and IaaS service declared in A2.9, tested through user accounts rather than devices.

How does the assessor decide how many devices to test?

There is no fixed number: the assessor picks a sample large enough to be representative of your devices, so more variation in builds and operating systems means a larger sample. IASME's FAQ says the random sample is typically around 10 per cent.

The specification does not publish a fixed number. IASME's Cyber Essentials FAQ gives a rule of thumb: the assessor tests a random sample of the in-scope systems, "typically around 10 per cent", then decides whether further testing is needed. It requires the sample to be representative, and it places the burden on the assessor to be confident that it is. The number depends on how much variation exists between devices, which in turn depends on how well provisioning is standardised.

Cyber Essentials Plus Test Specification v3.2

Many organisations use standardised configurations for their servers and EUDs. In such cases, much of the organisation's equipment can be covered by a small number of representative samples. The actual number of representative devices you will need to test to achieve this level of confidence will depend on the amount of variation that exists as a result of the Applicant's particular provisioning processes, and their effectiveness. The Assessor must verify that the sample size has been calculated correctly using the method described by the Delivery Partner.

EstateTypical effect on the sample
One managed Windows 11 build deployed by Intune or AutopilotA few devices from that build can represent the whole group
Windows 11 laptops plus a separate macOS groupEach build is sampled separately
Hand-built machines with no central managementMore devices per group, because each may differ
Servers on different operating systems or rolesEach operating system and role is sampled
Every cloud serviceOne normal user and one administrator each, reusable across services

How are cloud services sampled?

Cloud services are tested through accounts, not devices. The rule is explicit.

Cyber Essentials Plus Test Specification v3.2

All cloud services must be tested using a representative sample of user accounts. This must consist of at least one normal user and one administrative user for every cloud service used. The same users can be used across multiple cloud services.

  • For Test 4 (MFA), the assessor watches each nominated user and administrator sign in from an untrusted device or incognito session.
  • Where several services share one authentication service (for example Microsoft 365, SharePoint and Teams behind Entra ID), the MFA test is performed once per authentication service.
  • For Test 5 (account separation) on cloud environments where administrative processes can run, the standard user attempts an administrative action and must be refused or prompted for separate credentials.

How can you reduce your sample?

You cannot negotiate the sample down, but you can make your estate easier to represent. A single managed build with automatic updates, a standard anti-malware agent and no local administrator rights produces both a smaller sample and fewer surprises inside it.

Keep the device inventory accurate. The assessor compares your A2.6 to A2.8 counts with what management tooling shows. Devices that appear on the day but not in the inventory are still in scope and can be sampled.

Nominate real users for the sampled devices, with working email clients and browsers. Test 3 needs someone at the keyboard who can receive email and browse the web.

How do assessors check this?

How assessors check this
Assessors must retain 'evidence of how the sample size was calculated' for at least the lifetime of the certificate. Expect to be asked for the full inventory before the sample is drawn, and expect the sample to be chosen by the assessor, not by you. Offering only your best machines is not how it works.
Common failure: The undeclared build
The inventory lists forty Windows 11 laptops on one Intune build. On the day the assessor finds six older laptops from an acquired company, joined to a different domain, with no anti-malware agent and a local administrator account in daily use. They are inside the boundary, they are sampled as their own group, and they fail Tests 2, 3 and 5. Fix: bring every device onto the managed build before the audit, or take it off the network and out of scope with an enforced sub-set.

Related pages

Frequently asked questions

Not in the NCSC specification. The specification says the method is described by the Delivery Partner (IASME) and that the assessor must verify the sample was calculated using it and keep the evidence.

All internally hosted servers are in the population. Servers are then sampled by operating system and role, so a group of identical servers can be represented by a small number of them.

No. The assessor selects the sample so that it is representative. You provide the inventory and the users.

At least one normal user and one administrative user for every cloud service. The same two people can be used across all services if they hold accounts on each.

Yes. Tablets and phones that can reach organisational data or services are end user devices in scope and are sampled by platform (for example iOS and Android).

Cyber Essentials Plus

Ready for the technical audit?

A 20-minute scoping call with an IASME-accredited assessor fixes your scope and device sample, then you get a written price from £3,000 + VAT within 48 hours and testing booked inside your three-month window.

Book a scoping callSee what the audit tests
  • IASME Certification Body
  • CREST accredited
  • UK offices in Leeds, Newcastle, London and Edinburgh
Sources