What is can I do to pass Cyber Essentials Plus Certification first time?

Passing Cyber Essentials Plus at the first technical assessment is mainly about preparation, accuracy and consistency. The organisation should already meet the Cyber Essentials requirements across the whole agreed scope before the assessor begins testing. Trying to fix weaknesses only on the devices selected for testing is no longer a sensible strategy, and the 2026 scheme changes make that especially clear.

Cyber Essentials Plus uses the same five technical controls as Cyber Essentials. The difference is assurance. Cyber Essentials uses a verified self-assessment, while Cyber Essentials Plus adds independent technical testing to check whether the controls actually work in practice. The National Cyber Security Centre currently lists Requirements for IT Infrastructure v3.3 as the current requirements, effective from 27 April 2026, while the current published Cyber Essentials Plus Test Specification remains v3.2.

For a first-time pass, the most useful mindset is simple: prepare the entire in-scope environment as though any device could be selected. The assessor will verify the scope, examine internet-facing services, test a representative device sample, check security update management, test malware protection, verify multi-factor authentication on cloud services and check account separation. Any single failed test can cause the overall assessment to fail unless a specific exception applies.

UK Cyber Security Group provides Cyber Essentials and Cyber Essentials Plus certification services for UK organisations and can support businesses preparing for the technical audit. Its current Cyber Essentials page states that it is a certifying body and offers assessment and assisted certification support.

Treat Cyber Essentials Plus as verification, not a different standard

Many businesses assume that Cyber Essentials Plus introduces a second set of security requirements. It does not.

Both certification routes use the same five technical control areas: firewalls, secure configuration, security update management, user access control and malware protection. Cyber Essentials Plus gives greater assurance because an independent assessor tests whether those controls operate correctly. IASME confirms that the controls remain the same even though Plus applies a stronger level of assurance.

That means your verified Cyber Essentials answers need to describe the real environment.

If the self-assessment says every relevant cloud account has multi-factor authentication, the assessor should see that protection when testing.

If the answers say unsupported software does not exist within scope, your device and software records should support that claim.

If your organisation says ordinary users do not have administrator rights for routine work, the account separation test should confirm it.

The easiest route to a first-time pass is therefore to make the self-assessment accurate before moving to Plus.

Start with the scope because everything depends on it

A weak or inaccurate scope can undermine an otherwise well-managed environment.

The current test specification requires the assessor to agree the assessment boundary before testing begins. The assessor also verifies scope, segregation where relevant and sampling.

Scope should reflect the organisation that achieved the associated Cyber Essentials certificate.

Before assessment day, identify every relevant end-user device, internally hosted server, public internet connection, cloud service and other computing resource that sits within the agreed boundary.

Do not rely on memory.

Create an accurate inventory and compare it against the self-assessment answers.

Cloud services deserve particular attention. Businesses often remember Microsoft 365 but forget specialist accounting platforms, customer management systems, file-sharing platforms, remote support services or smaller SaaS applications used by individual teams.

An assessor can only test what sits within the declared scope, but an inaccurate declaration can create immediate questions.

Check any excluded environment carefully

If your Cyber Essentials certification does not cover the whole organisation, any excluded subset needs proper segregation.

The current Plus specification includes verification of segregation by subset.

Do not assume that a written statement saying one area sits outside scope will be enough.

The technical boundary needs to make sense.

Where systems freely interact across the boundary, the assessor may question whether the separation is credible.

A first-time pass becomes much easier when the scope is simple, accurate and discussed with the Certification Body before the audit.

Make the Cyber Essentials certificate recent enough

IASME states that if the organisation achieved its verified Cyber Essentials self-assessment less than three months before Cyber Essentials Plus, it does not need to repeat the self-assessment stage. The Plus audit itself also needs completion within three months of the relevant Cyber Essentials certification.

Plan the timing carefully.

Do not complete Cyber Essentials and then leave Plus preparation until the window is nearly finished.

Use the period immediately after the verified assessment to perform technical checks, correct weak configurations, confirm scope and prepare staff.

The longer the delay, the greater the chance that new devices, new users or new cloud services will change the environment.

What are the key requirements for achieving Cyber Essentials certification?

The five controls create the baseline for both Cyber Essentials and Cyber Essentials Plus.

Firewalls should prevent unnecessary and unauthorised connections between your devices or networks and the internet.

Secure configuration should remove unnecessary functionality, weak defaults and unused accounts.

Security update management should keep software supported and apply relevant vulnerability fixes within the scheme requirements.

User access control should give people only the access needed for their work and should limit privileged access.

Malware protection should reduce the risk of malicious software running on in-scope systems.

The current NCSC requirements are v3.3, effective from 27 April 2026. The NCSC also provides the Danzell question set for organisations certifying under the 2026 requirements.

A first-time Plus pass depends on all five controls working consistently, not only appearing correct in the questionnaire.

Patch the whole environment, not just the sample

Security update management deserves particular attention because missing vulnerability fixes frequently create avoidable audit problems.

The current Plus test specification uses authenticated vulnerability scanning on sampled end-user devices, servers and relevant IaaS instances. The assessor looks for vulnerabilities that meet scheme criteria, including vulnerabilities the vendor describes as critical or high risk, vulnerabilities with a CVSS v3 base score of 7 or above, and cases where the vendor has not provided severity details for the vulnerabilities addressed by an available fix.

If the vendor has provided an applicable fix for more than 14 days and the relevant vulnerability remains, the test can fail.

This means you should review operating systems and applications across the full scope before assessment day.

Do not focus only on Windows updates.

Browsers, productivity applications, server software, third-party tools and other supported software can also matter.

Check devices that spend long periods switched off.

Review equipment used by remote employees.

Look for systems that have fallen out of central management.

Pay attention to servers and IaaS resources that may not receive the same routine attention as employee laptops.

The 2026 retest change makes selective remediation risky

IASME changed the Plus process in 2026 to address organisations that updated only the devices originally selected for audit.

If the initial update-management sample fails and the organisation remediates, the retest now includes a new random sample as well as rechecking the original sample. IASME also states that a second failure results in revocation of the verified self-assessment certificate.

This change reinforces an important rule for preparation.

Fix the underlying management problem across the full scope.

Do not treat the audit sample as the environment.

If several devices miss required fixes, investigate why.

Perhaps a management platform is not reaching remote devices.

Maybe users can defer updates indefinitely.

Perhaps an old application prevents an operating system upgrade.

Address the cause before the assessor arrives.

Remove unsupported software before the audit

Unsupported software is one of the clearest preventable barriers to certification.

IASME states that an organisation cannot attain Cyber Essentials when unsupported software remains within the assessment scope.

Build a software inventory and identify products that no longer receive security support.

This includes operating systems and applications.

A device can work perfectly and still create a certification problem because the vendor no longer provides vulnerability fixes.

Do not rely entirely on staff saying that their machines are current.

Use endpoint management, asset discovery or another reliable source to confirm versions.

If legacy software remains necessary for operational reasons, speak to the Certification Body before the Plus audit rather than hoping the issue will not appear.

Check every internet-facing service

The first Plus test case focuses on remote vulnerability assessment.

Its purpose is to determine whether an internet-based opportunistic attacker can compromise the applicant’s systems using common low-skill methods. The assessor identifies public IP addresses, including relevant IaaS, and scans internet-accessible services.

Prepare by checking what your organisation exposes to the internet.

Review public IP addresses.

Check cloud infrastructure.

Confirm remote administration services.

Remove services that no longer have a business purpose.

Review router and firewall configuration.

Make sure external systems run supported software and current fixes.

Forgotten services create unnecessary exposure.

An old remote administration portal or test system can undermine a strong endpoint environment.

If you do not know what the internet can see, run appropriate pre-assessment checks before the formal audit.

Sample selection means consistency matters

Cyber Essentials Plus does not require the assessor to test every device in a larger environment.

IASME states that the audit uses a representative random sample, commonly around 10 per cent, with further testing where necessary. The audit also includes all internet gateways and all servers with services accessible to unauthenticated internet users.

The NCSC specification says the sample needs to represent the in-scope environment.

This creates a simple first-pass principle.

Standardise your systems.

If ten laptops use the same managed configuration, the organisation has a better chance of consistent results than when every laptop has a different build and different local permissions.

Central management helps.

Common security settings help.

A reliable asset inventory helps.

Consistent update management helps.

Random sampling should confirm good practice rather than create anxiety about which device the assessor might choose.

Test malware protection before assessment day

The Plus audit checks malware protection on sampled end-user devices, relevant servers with interactive desktops and IaaS instances.

Where the organisation uses anti-malware software, the assessor checks that it is installed and running. Depending on the arrangement, the assessor can also use approved test files to check protection against malicious content delivered through email or a browser.

Do not assume the presence of an endpoint security product guarantees a pass.

Review whether every relevant device reports into the management console.

Investigate stale or inactive agents.

Check policy assignment.

Review exclusions.

Confirm protection remains enabled.

Make sure new devices receive security controls before employees start normal work.

Email and browser protection also matter.

A test file should not pass freely through the environment in a way that leaves the user able to access harmful content without the required protection.

MFA should work when the assessor actually logs in

Cloud authentication is another area where assumptions cause failures.

The current Plus specification requires MFA testing on all cloud services within scope for user and administrator access. Where several services share the same authentication service, the assessor only needs to test that authentication service once.

The assessor can observe access from an untrusted device or an incognito browser session.

A pass requires the user or administrator to receive an MFA challenge before access.

Do not confuse having MFA registered with having MFA enforced.

A user can have an authentication app on their phone while an exception, trusted location or old policy allows access without the expected challenge.

Test this yourself.

Use a private browser session.

Use a device that does not already have an established trusted session.

Check normal users.

Check administrators.

Review service accounts and exclusions.

If a cloud service uses its own authentication rather than your central identity provider, include it in the review.

Separate ordinary user accounts from administrator access

Cyber Essentials aims to reduce unnecessary privileged access.

The Plus assessment includes an account-separation test on sampled end-user devices, relevant servers and cloud environments where administrative processes can run.

The assessor observes a standard user attempting an administrative process.

The test passes when the process requires separate administrator credentials rather than running with the ordinary user’s existing account.

Before audit day, review local administrator memberships.

Check cloud administrator roles.

Remove privileges that no longer serve a business purpose.

Separate routine email, browsing and office work from administrative activity.

Also review contractors and former IT suppliers.

Privileged access has a habit of accumulating over time.

A clean access review before Plus can remove many avoidable problems.

How can I prepare my small business for Cyber Essentials assessment?

Small businesses can prepare effectively without building an enterprise security department.

Start by understanding the environment.

Know which devices employees use, which cloud services hold business information, which accounts have elevated privileges and which internet-facing services remain active.

Then compare the real environment against the current Cyber Essentials questions.

The NCSC provides a free question booklet and a readiness tool so organisations can identify gaps before submitting the formal assessment.

IASME also makes the current question set available in advance.

For a small business aiming for Plus, complete an additional technical readiness review after the verified self-assessment.

Check vulnerability results.

Test MFA behaviour.

Review endpoint security.

Confirm administrator separation.

Look for unsupported software.

Verify that remote workers receive updates.

This preparation can prevent simple issues from becoming formal audit failures.

Make remote workers part of the same standard

A laptop does not leave your security responsibility when an employee works from home.

Remote devices still need supported software, security fixes, malware protection and appropriate account controls.

Employees who rarely visit the office can create gaps if devices do not connect regularly to management systems.

Check whether endpoint management works over the internet.

Review devices that have not checked in recently.

Confirm that users cannot indefinitely postpone important fixes.

If staff use personal equipment to access organisational data or services, determine how the current Cyber Essentials requirements apply to that arrangement.

Do this before completing your scope answers.

Mobile devices should not become the forgotten part of scope

Phones and tablets can access email, cloud files and business applications.

Review whether mobile devices sit within scope under the current scheme requirements.

Check support status.

Review operating system versions.

Confirm that old devices no longer used by the organisation have lost business access.

Where the organisation manages corporate mobile equipment centrally, use that platform to confirm the current position.

The common failure pattern is not sophisticated.

It is simply an old or unmanaged device that everyone forgot.

What software solutions support compliance with Cyber Essentials standards?

No single product guarantees Cyber Essentials compliance.

Different platforms can support different control areas.

Endpoint management can help maintain device configuration and security fixes.

Identity services can support MFA and privileged access management.

Endpoint security products can help with malware protection.

Vulnerability management tools can identify missing fixes before the audit.

Asset discovery can help find forgotten devices and applications.

Firewall management can help organisations maintain appropriate internet access rules.

The correct solution depends on the organisation’s environment.

What matters is the security outcome.

A well-known product configured badly can still create failure.

A smaller tool managed carefully can provide stronger assurance.

The assessor tests the actual environment, not the marketing claims of the software vendor.

Run your own pre-assessment before the assessor does

One of the strongest ways to improve first-time success is to simulate the audit internally.

Do not simply read the questionnaire again.

Test the controls.

Review public exposure.

Run authenticated vulnerability scans where appropriate.

Check a representative group of devices.

Test MFA from a clean session.

Confirm standard users cannot perform administrative actions with their ordinary credentials.

Check malware protection.

Review endpoint reporting.

Compare asset records against what management systems actually show.

The exercise should answer one question:

If the assessor selected any device today, would it meet the same standard as the device beside it?

If the answer is uncertain, delay the audit until you understand why.

Do not make assessment day the first time IT and management compare records

Administrative preparation matters too.

Have the correct people available.

Know which devices the assessor may need.

Have access to cloud services ready.

Make sure relevant staff can demonstrate sign-in behaviour.

Confirm that administrators can support testing without disrupting the assessor.

Keep your asset information current.

Ensure the public IP information is accurate.

An assessment can become unnecessarily difficult when technical controls work but nobody can locate devices, explain the scope or access the systems needed for testing.

A short pre-audit meeting can prevent this.

Understand the pass standard

Cyber Essentials Plus sets a high bar because it independently verifies the controls.

The current test specification says every test case must pass for the overall assessment to pass, unless a specific exception applies. A single failed sub-test normally produces a failed parent test and overall failure.

IASME explains that Plus therefore applies a stronger pass bar than the verified self-assessment. Where a Plus issue appears, the applicant must remediate it before certification. IASME describes a 30-day remediation period for Plus failures.

Do not plan to use that remediation period.

Treat it as a safety net.

A first-time pass means entering the assessment with the environment already compliant.

The strongest first-time strategy is consistency across every device

The assessor samples systems because it would be impractical to test every device in a large environment.

That means the organisation should manage the whole scope consistently.

Do not prepare a handful of showcase laptops.

Do not update only the devices you think will be selected.

Do not create temporary administrator changes that will disappear after the audit.

Do not switch security controls on only for assessment day.

Build a normal operating environment that meets the requirements every day.

The 2026 update-management retest rule reinforces this principle because a failed sample can lead to a fresh random sample during retesting.

Can I renew my Cyber Essentials certification through an online service?

Yes. Cyber Essentials uses an online verified self-assessment process through authorised Certification Bodies.

Certificates remain valid for 12 months. Current government management information confirms the annual validity period.

Renewal should involve a fresh review of the environment rather than blindly copying the previous answers.

Over a year, organisations add employees, replace laptops, adopt new cloud services and change suppliers.

Those changes can affect scope and compliance.

For Cyber Essentials Plus, coordinate the verified assessment and technical audit so that the Plus assessment falls within the required three-month period.

Which companies provide Cyber Essentials certification services in the UK?

Cyber Essentials certification comes through Certification Bodies licensed and assured by IASME.

IASME maintains the official Certification Body directory and explains that assessors must work through a licensed Certification Body.

UK Cyber Security Group provides Cyber Essentials certification and support for organisations seeking Cyber Essentials Plus.

Its current Cyber Essentials page describes assessment-only and supported routes and states that the company helps organisations through certification.

For Plus, contact the Certification Body directly because the technical audit requires qualified assessors and planning around the organisation’s scope.

Which UK-based firms offer Cyber Essentials consultancy services?

Many UK cyber security businesses provide Cyber Essentials preparation and consultancy.

The important distinction is between advice and certification.

A consultant can help identify gaps, review systems and prepare the organisation.

An IASME-licensed Certification Body can provide official assessment and certification within the scheme.

For a first-time Plus attempt, experience with technical audit preparation is particularly useful.

Ask whether the provider can help with scope validation, vulnerability review, update management, MFA, administrator separation, malware protection and representative device readiness.

UK Cyber Security Group combines Cyber Essentials certification with support for businesses that need assistance preparing their environment.

Cyber Essentials adoption continues to grow

Current UK Government management information shows 61,430 Cyber Essentials certificates awarded during the 12 months from July 2025 to June 2026.

Of those, 46,245 were Cyber Essentials certificates and 15,185 were Cyber Essentials Plus.

The same government page states that organisations with Cyber Essentials are 92 per cent less likely to make a cyber insurance claim.

That figure does not mean the scheme eliminates 92 per cent of attacks.

It shows a strong association with fewer insurance claims and reinforces the value of implementing the controls properly rather than treating certification as paperwork.

Use the current requirements, not last year’s notes

Cyber Essentials receives regular updates.

The NCSC states that v3.3 became effective on 27 April 2026.

IASME also publishes the current Danzell question set for 2026 assessments.

Do not prepare from an old questionnaire saved on a shared drive.

Do not rely on guidance written for an earlier scheme version without checking whether the requirement still applies.

Use the current NCSC and IASME material.

A business can have good security and still create unnecessary assessment problems by preparing against outdated wording.

A practical first-time Cyber Essentials Plus checklist

Before the technical assessment begins, confirm the following:

1. The Cyber Essentials certificate is current and the Plus audit sits within the required three-month window.
2. The scope is accurate and matches the environment the assessor will test.
3. Any excluded subset has appropriate segregation.
4. All in-scope operating systems and applications remain supported.
5. Required vulnerability fixes have been applied across the whole scope, not only likely sample devices.
6. Public IP addresses and internet-facing services have been reviewed.
7. Endpoint security operates and reports correctly across relevant systems.
8. Malware protection behaves as expected for email and browser-delivered test content where applicable.
9. MFA works for user and administrator access to every relevant cloud authentication service.
10. Ordinary user accounts do not carry unnecessary administrator privileges.
11. Remote workers and rarely connected devices meet the same security baseline.
12. Mobile equipment and cloud services have been included correctly in scope.
13. Asset records match what technical management systems show.
14. Representative devices are available for assessment.
15. IT staff and relevant users are available to support testing.
16. A pre-assessment vulnerability and configuration review has identified and resolved obvious gaps.
17. The organisation has reviewed the current NCSC v3.3 requirements and current IASME question set.
18. The controls operate as normal business practice rather than temporary audit-day changes.

If you can answer yes to each point and support the answer with evidence, you have removed many of the most common reasons for needing remediation.

Passing first time is mainly about removing surprises

There is no trick that guarantees Cyber Essentials Plus certification on the first attempt.

There is, however, a very reliable preparation method.

Know the scope.

Make the verified self-assessment accurate.

Keep software supported.

Apply required vulnerability fixes throughout the environment.

Check internet-facing services.

Manage every endpoint consistently.

Test malware protection.

Verify MFA in a clean session.

Separate user and administrator access.

Prepare remote devices.

Run your own technical readiness checks.

Have the right people and information available on assessment day.

Most Plus failures come from a gap between what the organisation believes is happening and what the assessor can demonstrate technically.

Closing that gap before the formal audit gives you the strongest chance of passing first time.

Cyber Essentials Plus should confirm controls that already work rather than force your organisation to repair them during the assessment window.

UK Cyber Security Group provides Cyber Essentials and Cyber Essentials Plus certification support for organisations that want a clear route through the scheme. Its service includes both assessment and supported options for businesses that need additional guidance.

For a business aiming to pass Cyber Essentials Plus at the first attempt, preparation should focus on the entire environment rather than the audit sample.

When every device, cloud service, account and security process receives the same level of attention, the random sample becomes much less important.

The assessor is simply confirming a security baseline that the organisation already maintains.

UK Cyber Security Group Ltd is here to help

Please check out our Free Cyber Insurance

Other blog posts, Your ISO 27001 Questions Answered, Get ISO 27001 Certified ,

If you would like to know more, do get in touch as we are happy to answer any questions. Looking to improve your cybersecurity but not sure where to start? Begin by getting certified in Cyber Essentials, the UK government’s scheme that covers all the technical controls that will provide the protection that you need to help guard against criminal attacks. Or just get in touch by clicking contact us