Test case
A test case is one of five practical checks an assessor runs in a Cyber Essentials Plus audit, each with set pass and fail criteria. The NCSC test specification v3.2 defines them: external vulnerability scan, authenticated patch scan, malware protection, cloud MFA and account separation. Any single fail fails the assessment unless the Delivery Partner allows marginal deviation.
- Term
- Test case
- Also known as
- Cyber Essentials Plus test, sub-test
- Category
- Scheme and certification
- Requirement area
- Scheme vocabulary
- Questions
- None directly
- Reviewed against
- Requirements v3.3
What does the term test case mean in Cyber Essentials?
A test case is one of five practical checks an assessor runs in a Cyber Essentials Plus audit, each with set pass and fail criteria.
How does test case apply to Cyber Essentials?
In plain terms. If the self-assessment is the written paper, the test cases are the practical. Each one checks a single thing in a set way, and the specification says exactly what counts as a pass.
The five test cases.
| Test case | What it checks | Control |
|---|---|---|
| 1. Remote vulnerability assessment | Whether "an Internet-based opportunist attacker can hack into the Applicant's system with typical low-skill methods" | Firewalls |
| 2. Authenticated vulnerability scan | No critical or high-risk vulnerability with a fix available for more than 14 days | Security update management |
| 3. Malware protection | Test files sent by email and browser are blocked, or anti-malware is checked by hand | Malware protection |
| 4. Multi-factor authentication | Users and administrators are prompted for MFA on each cloud service | User access control |
| 5. Account separation | A standard user cannot run an admin process without a separate login | User access control |
Pass and fail. A test case passes only if every sub-test in it passes, and the overall assessment passes only if every test case does. The specification allows one exception at the Delivery Partner's discretion: marginal deviation in less than 5% of performed tests, where the evidence does not indicate a wider failure. Tests that cannot be completed on the day may be deferred, and the recommended limit is one month.
Common mistakes. Forgetting that tests 3, 4 and 5 are observed live. The staff taking part need working email, a web browser and their MFA device on the day.
See the Cyber Essentials Plus overview, sampling and Cyber Essentials Plus.
Related terms
- SamplingSampling is how a Cyber Essentials Plus assessor tests a representative selection of devices and accounts rather than every one in scope.
- Cyber Essentials PlusCyber Essentials Plus is the higher level of Cyber Essentials, where an assessor independently tests your systems instead of relying only on your written answers.
- Whole-organisation scopeA whole-organisation scope means the Cyber Essentials assessment covers all the networks, user accounts and devices that access the organisation's data and services.
- ApplicantAn applicant is the organisation seeking Cyber Essentials certification, or sometimes the individual acting as its main point of contact.
- AssessorAn assessor is the qualified person at a Certification Body who marks a Cyber Essentials self-assessment or carries out the Cyber Essentials Plus tests.
- Board declarationThe board declaration is the confirmation, given by a director or board-level person, that every answer in a Cyber Essentials self-assessment is accurate.
Frequently asked questions
A test case is one of five practical checks an assessor runs in a Cyber Essentials Plus audit, each with set pass and fail criteria.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.