Sampling
Sampling is how a Cyber Essentials Plus assessor tests a representative selection of devices and accounts rather than every one in scope. Tests 2 to 5 use it; the external scan in test 1 covers every address. Sample size follows the Delivery Partner's method, and each cloud service is tested with at least one normal and one administrative user.
- Term
- Sampling
- Also known as
- sample testing, sample size, representative sample
- Category
- Scheme and certification
- Requirement area
- Scheme vocabulary
- Questions
- None directly
- Reviewed against
- Requirements v3.3
What does the term sampling mean in Cyber Essentials?
Sampling is how a Cyber Essentials Plus assessor tests a representative selection of devices and accounts rather than every one in scope.
How does sampling apply to Cyber Essentials?
In plain terms. Think of quality control in a factory. If every item comes off the same production line, checking a few tells you about the rest. If every item is made differently, you need to check more of them.
What the test specification says. "On all but the smallest networks it will be impractical to test every device that is within the agreed boundary of scope. Instead, test a representative sample". The sample covers end-user devices that can connect to organisational data or services, all internally hosted servers and all types of cloud service. The specification notes that "Many organisations use standardised configurations", so a few samples can cover much of the estate, and that the number needed depends on how much variation your set-up processes create. The assessor "must verify that the sample size has been calculated correctly using the method described by the Delivery Partner" and keep the evidence for the lifetime of the certificate. Cloud services are tested with "at least one normal user and one administrative user for every cloud service used".
IASME's own FAQ gives a rule of thumb: the assessor "will test a suitable random sample of these systems (typically around 10 per cent) and then make a decision whether further testing is required." The Delivery Partner's method still decides the number for your estate.
How to keep the sample small. Use a standard build for each device type, manage updates centrally, and give the assessor an accurate device list at A2.6 to A2.8. The fewer variations you have, the fewer samples are needed to represent them.
Common mistakes. Preparing only the devices you expect to be picked. The sample is chosen to represent the whole estate, and under IASME's 2026 rule a failed update management test (Test 2) leads to a retest that adds a new random sample. Standard builds and central management keep the sample small and the risk low.
Sources: the CE Plus Test Specification v3.2, sample testing section, and the IASME Cyber Essentials FAQ.
See Cyber Essentials Plus sample size, test case and Cyber Essentials Plus.
Related terms
- RetestA retest is a repeat of failed Cyber Essentials Plus tests, carried out after the organisation has fixed the problems the assessor found.
- Test caseA test case is one of five practical checks an assessor runs in a Cyber Essentials Plus audit, each with set pass and fail criteria.
- Cyber Essentials PlusCyber Essentials Plus is the higher level of Cyber Essentials, where an assessor independently tests your systems instead of relying only on your written answers.
- ScopeScope is the networks, hardware and software assets, and cloud services that are included in a Cyber Essentials assessment.
- Self-assessment questionnaireThe self-assessment questionnaire is the set of written questions an organisation answers about its own IT to apply for Cyber Essentials.
- Sub-setA sub-set is part of an organisation whose network is segregated from the rest of the organisation by a firewall or VLAN.
Frequently asked questions
Sampling is how a Cyber Essentials Plus assessor tests a representative selection of devices and accounts rather than every one in scope.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.