Cyber Essentials Plus
The same five controls as Cyber Essentials, but an assessor tests your systems to prove your answers hold up.
Basic Cyber Essentials is a self-assessment, where you tell the assessor how your systems are set up. Cyber Essentials Plus adds a technical audit, where the assessor checks a sample of your devices and accounts. It gives your customers stronger proof and is often required for higher value or higher risk contracts.
| Feature | Cyber Essentials | Cyber Essentials Plus |
|---|---|---|
| How it works | Online self-assessment reviewed by an assessor | Self-assessment plus a hands-on technical audit |
| Controls covered | The five technical controls | The same five controls, tested on your systems |
| Evidence | Your answers | Vulnerability scans and tests on sample devices and accounts |
| Timing | Renew every 12 months | Audit within three months of your Cyber Essentials certificate, renewed every 12 months |
| Cost | Fixed IASME fee by business size | Quoted by each certification body based on devices, users and sites |
What the audit tests
- External scan. The assessor scans each of your public IP addresses for weaknesses and misconfigurations.
- Device checks. A sample of servers, desktops, laptops, tablets and phones is checked for unsupported software and for critical and high risk updates missed beyond 14 days.
- Malware tests. Safe test files are sent by email and web browser to confirm your protection stops them.
- Admin rights. The assessor confirms standard user accounts cannot carry out administrator tasks.
- MFA. Every cloud service used by the sampled users must ask for MFA at login, for standard and admin accounts.
New since April 2026. if a device fails the update test, the assessor retests on a fresh sample of devices. Fail a second time and your basic Cyber Essentials certificate is revoked. Preparation matters more than ever.
How to prepare
- Run updates across every device a week before the audit and check nothing is stuck.
- Remove or replace anything running an unsupported operating system.
- Confirm MFA on every cloud account, including shared and admin accounts.
- Check staff cannot install software or change settings from their day to day accounts.
- Get a pre-audit check so you find problems before the assessor does. See my CE Plus preparation service.
The question most people ask next
Will the assessor test every device we have?
No. The assessor tests a sample of your devices and cloud accounts, and the size of the sample depends on how many you have. That is why every device needs to be up to date on the day, not just the ones you expect to be checked. Want to know what your sample might look like? Ask me.
Guides to help you prepare. How do I make sure security updates install? · What do I do about devices that no longer get updates? · How do I turn on multi-factor authentication? · Why should staff use separate admin accounts?
Frequently asked questions
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Cyber Essentials is a self-assessment. Plus covers the same five controls but adds a technical audit where an assessor tests a sample of your devices and accounts.
When do I need to do the Plus audit?
Within three months of your Cyber Essentials certificate. If it has been longer, you need a new Cyber Essentials certificate first.
How much does Cyber Essentials Plus cost?
There is no fixed price. Each certification body quotes based on the number of devices, users and sites to test.
What happens if a device fails the update test?
Since April 2026, the assessor retests on a fresh sample. A second failure revokes your basic Cyber Essentials certificate.
Got a question about your setup?
Send me one quick question and I'll give you a straight answer in plain English, usually within one working day. Prefer to talk it through? Book a free 30 minute call.