The Cyber Essentials Plus Test Specification v3.2 defines the five test cases an assessor runs: remote vulnerability assessment, authenticated patch scan, malware protection checks, MFA configuration on cloud services, and account separation. It sets the pass rule that any single sub-test fail fails the assessment, and the exception for marginal deviation in under 5% of tests.
Key takeaways
- The NCSC Cyber Essentials Plus Test Specification v3.2 defines five test cases: remote vulnerability assessment, authenticated patch scan, malware protection, MFA configuration and account separation.
- Under v3.2, any single sub-test fail fails the assessment, unless only marginal deviation is found in under 5% of tests and the Delivery Partner allows a pass.
- Every cloud service is tested with at least one normal user and one administrative user, and the assessor keeps the sample-size evidence for the lifetime of the certificate.
First sections
- 01Purpose and before you begin: permissions, scope match, sub-set verification, sampling
- 02General prerequisites: test emails, test files, users and browsers
- 03Success criteria: pass, fail and advisory notes
- 04Test case 1: remote vulnerability assessment
- 05Sample testing: devices, servers, cloud services, one user and one admin per service
- 06Test case 2: check patching by authenticated vulnerability scan
And 5 more, listed under what is inside.
- Format
- Access
- Free, links to the official PDF
- Who it is for
- Anyone booking or preparing for a Cyber Essentials Plus audit, and MSPs supporting a client through one.
- Sections
- 11
- Written against
- Requirements v3.3 (April 2026), Danzell question set
- Last updated
- 2026-11-03
NCSC Cyber Essentials Plus Test Specification v3.2
Published by the NCSC or IASME. We link to the original rather than re-host it. Opens in a new tab.
Open the originalWhat is this document?
The NCSC's instructions to Cyber Essentials Plus assessors, published as a PDF by the NCSC. It exists so that "Applicants should be able to expect the same certification outcome, no matter which Certification Body they ultimately use". Every Plus audit runs the five test cases in it.
What does each test case check?
| Test case | Perform on | Fail condition |
|---|---|---|
| 1. Remote vulnerability assessment | All IP addresses in use, including IaaS | An internet-accessible service fails the flow chart |
| 2. Authenticated patch scan | Sampled EUDs, servers, IaaS | A critical, high-risk or unrated fix available for more than 14 days |
| 3. Malware protection | Sampled EUDs, interactive servers, IaaS | Test file arrives by email or downloads by browser and can be opened; or allow-listing checks fail |
| 4. MFA configuration | All cloud services, user and admin | No MFA prompt on an untrusted device or incognito session |
| 5. Account separation | Sampled EUDs and admin-capable environments | An admin process runs under the standard user account |
The Cyber Essentials Plus hub explains each in full, with what the assessor runs and how to prepare for each test.
What does it say about sampling?
All cloud services are tested with at least one normal user and one administrative user per service; the same users can cover several services. Devices are sampled to be representative, and the assessor must verify the sample size was calculated with the Delivery Partner's method and retain the evidence for the lifetime of the certificate.
Virtual patching is named in test case 2 as not an acceptable long-term mitigation for legacy unsupported operating systems. An IPS signature does not substitute for the fix.
What changed in how the specification is applied from April 2026?
IASME's April 2026 update added two rules on top of the v3.2 specification.
| Rule | What it means for you |
|---|---|
| Verification of update management compliance | If the sampled devices fail test case 2, you remediate and the assessor retests the original sample plus a new random sample. A second failure revokes your verified self-assessment certificate. |
| No changes to the self-assessment after Plus testing | The verified self-assessment must be completed, finalised and unchanged before Plus testing starts. You cannot amend an answer to match what the assessor finds. |
IASME gives the reason for the first rule: some organisations updated only the devices in the sample. Patch the whole scope before the day.
How do you prepare for each test case?
| Test case | Do this the week before |
|---|---|
| 1. Remote vulnerability assessment | Confirm every public IP address you use, including cloud hosts, and close any port you cannot name a reason for |
| 2. Authenticated patch scan | Run your own authenticated scan or patch report, and install anything critical or high risk released more than 14 days ago |
| 3. Malware protection | Agree with the assessor how their test emails and test-file website will reach sampled users (the specification says you may need to add the site to your allow list), and check anti-malware is running and updating on every sampled device |
| 4. MFA configuration | Sign in to every A2.9 service from a private browser window as a user and as an admin, and confirm an MFA prompt appears |
| 5. Account separation | Check daily accounts have no local admin rights and that admin tasks prompt for separate credentials |
The Cyber Essentials Plus day post walks through the audit in the order it runs, and how to prepare gives the remediation order.
What is inside
| # | Section |
|---|---|
| 01 | Purpose and before you begin: permissions, scope match, sub-set verification, sampling |
| 02 | General prerequisites: test emails, test files, users and browsers |
| 03 | Success criteria: pass, fail and advisory notes |
| 04 | Test case 1: remote vulnerability assessment |
| 05 | Sample testing: devices, servers, cloud services, one user and one admin per service |
| 06 | Test case 2: check patching by authenticated vulnerability scan |
| 07 | Test case 3: check malware protection (sub-tests 3.1 and 3.2) |
| 08 | Test case 4: check multi-factor authentication configuration |
| 09 | Test case 5: check account separation |
| 10 | Conclude the assessment, deferral and the marginal-deviation exception |
| 11 | Appendix A: vulnerability scanning; Appendix B: types of test file |
Frequently asked questions
Assessors. It addresses the assessor directly and includes notes for the Delivery Partner. Applicants can read it to see what will be tested; the preparation workbook on this site turns it into a set of self-checks.
Where a fail results from a small number of minor issues, the Delivery Partner may at their discretion allow a pass. The specification expects this to cover marginal deviation in less than 5% of performed tests where the evidence does not indicate a wider failure of the applicant's processes.
The specification is still v3.2, but IASME changed how it is operated from April 2026. A failed update management sample is remediated and retested on the original sample plus a new random sample, and a second failure revokes the verified self-assessment certificate. The self-assessment must also be finalised and unchanged before Plus testing starts.
IASME's FAQ says that if your verified self-assessment certificate is less than three months old when you certify to Cyber Essentials Plus, you do not need to repeat the self-assessment stage. Book the audit when you book the self-assessment so the dates line up.
Yes, with the Delivery Partner's agreement, where the day cannot be concluded because of technical difficulties. The specification recommends not allowing deferral for more than one month.
More from the library
Ready for the technical audit?
A 20-minute scoping call with an IASME-accredited assessor fixes your scope and device sample, then you get a written price from £3,000 + VAT within 48 hours and testing booked inside your three-month window.
- IASME Certification Body
- CREST accredited
- UK offices in Leeds, Newcastle, London and Edinburgh
- NCSCNCSC, Cyber Essentials Plus Test Specification v3.2Read on ncsc.gov.uk (opens in a new tab)
- NCSCNCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 · April 2026Read on ncsc.gov.uk (opens in a new tab)
- IASMEIASME, Important update: changes to Cyber Essentials for April 2026Read on iasme.co.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials frequently asked questionsRead on iasme.co.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials Danzell Question Set 2026 (v16.3)Read on iasme.co.uk (opens in a new tab)