What is required to pass Cyber Essentials Plus Certification?
What is required to pass Cyber Essentials Plus Certification?
Cyber Essentials Plus is the independently tested level of the UK Government-backed Cyber Essentials scheme. It uses the same fundamental security requirements as Cyber Essentials, but an assessor carries out technical checks to confirm that the controls actually work within your organisation.
That distinction matters. Passing the Cyber Essentials self-assessment shows that your organisation has declared that it meets the requirements. Cyber Essentials Plus goes further by independently testing a representative sample of your IT environment.
The current Cyber Essentials requirements are set out in Requirements for IT Infrastructure v3.3, effective from 27 April 2026. The Cyber Essentials Plus technical assessment currently follows the NCSC Cyber Essentials Plus Test Specification v3.2.
To pass, businesses need more than good policies or security software licences. The assessor needs evidence that the relevant controls work correctly across the agreed scope.
UK Cyber Security Group provides Cyber Essentials and Cyber Essentials Plus certification services for organisations looking for an affordable route through the scheme.
UK Cyber Security Group Cyber Essentials certification
Cyber Essentials and Cyber Essentials Plus are closely connected
Cyber Essentials and Cyber Essentials Plus are not separate security standards with completely different requirements.
Both are based on the same five technical control areas:
- Firewalls
- Secure configuration
- Security update management
- User access control
- Malware protection
The major difference is verification.
Cyber Essentials uses a verified self-assessment. Cyber Essentials Plus adds independent technical testing conducted by an authorised assessor.
This means a business that wants Cyber Essentials Plus should first make sure its Cyber Essentials answers accurately represent its real IT environment.
An organisation should not view the self-assessment as paperwork that needs to be completed before the technical audit. The answers establish important information about the organisation, its scope, devices, cloud services and security controls.
The Plus assessor can then test whether those declarations reflect what actually happens.
What are the key requirements for achieving Cyber Essentials certification?
Cyber Essentials focuses on protecting organisations against common internet-based attacks.
The five technical controls provide the foundation.
Firewalls help prevent unauthorised connections to and from devices and networks.
Secure configuration aims to reduce unnecessary functionality and remove insecure default settings.
Security update management helps ensure vulnerabilities receive appropriate fixes within the required period.
User access control limits access according to business need and places stronger restrictions around administrative privileges.
Malware protection helps stop malicious software from running and causing harm.
For Cyber Essentials Plus, simply stating that these controls exist is not enough. The technical assessment verifies important elements of their operation.
Start by getting the scope right
One of the most important parts of Cyber Essentials Plus happens before technical testing starts.
Your organisation and assessor need to understand the certification scope.
The assessor will want an accurate picture of the IT environment covered by the assessment.
This may include:
- Desktop computers
- Laptops
- Servers
- Mobile phones
- Tablets
- Internet-facing services
- Cloud services
- Infrastructure as a Service resources
- User accounts
- Administrator accounts
- Network boundaries
The NCSC Plus specification requires the assessor to agree the boundary of scope with the applicant before testing starts.
Trying to hide a difficult device or poorly maintained system outside the assessment is not a sensible route to certification.
Where a part of the organisation sits outside the certification scope, the separation needs to meet the scheme requirements.
Accurate asset information therefore becomes one of the best preparations for Cyber Essentials Plus.
Know what you have before the assessor arrives.
Your existing Cyber Essentials assessment needs to be accurate
A common mistake is treating Cyber Essentials as something to complete quickly and worrying about the technical details later.
That approach can cause problems during Plus.
Your answers should match your actual environment.
For example, if the assessment says that all cloud services use multi-factor authentication, the assessor should be able to verify that.
If you declare that supported operating systems receive security updates, vulnerability scanning should not discover forgotten devices containing relevant vulnerabilities that should already have been fixed.
The same principle applies to administrator accounts, malware protection, internet-facing systems and cloud services.
Treat the Cyber Essentials assessment as an accurate security record rather than a questionnaire where the objective is simply to select the most favourable answer.
The assessor will test your internet-facing systems
The first major technical area involves remote vulnerability assessment.
The purpose is to determine whether an internet-based opportunistic attacker could compromise systems using common low-skill methods.
The assessor identifies the public IP addresses within scope and performs vulnerability scanning against the relevant internet-facing services. Infrastructure as a Service resources must also be considered where applicable.
This makes externally exposed systems particularly important.
Before the assessment, review what your organisation exposes to the internet.
Ask whether every externally available service actually needs to be there.
Check firewalls.
Remove unnecessary services.
Review remote administration.
Check routers and security appliances.
Make sure supported devices have current security fixes.
Old systems that everyone has forgotten about can become significant problems.
An organisation may have excellent endpoint security across its laptops while an outdated internet-facing appliance remains exposed.
Cyber Essentials Plus looks for practical weaknesses rather than assuming that the presence of security products makes the organisation secure.
Security updates are one of the biggest areas to check
Security update management deserves particular attention before a Plus assessment.
The current technical test includes authenticated vulnerability scanning of sampled end-user devices, servers and relevant Infrastructure as a Service instances.
The assessor looks for vulnerabilities meeting the scheme’s criteria.
Under the current Plus specification, this includes vulnerabilities that the vendor describes as critical or high risk, vulnerabilities with a CVSS v3 base score of 7 or above, and situations where the vendor does not provide details of the vulnerability level addressed by an available fix.
Where a relevant vulnerability has a vendor-provided fix that has been available for more than 14 days, it can result in failure.
That makes patch management much more than a monthly administrative exercise.
Businesses need to know:
Which devices are active?
Which operating systems do they run?
Which applications are installed?
Are those products still supported?
Are security updates being applied promptly?
Have devices missed updates because they have been switched off?
Are remote workers receiving updates?
Are servers receiving the same attention as laptops?
Good asset management and effective patch management work together.
You cannot reliably update equipment that nobody knows exists.
Unsupported software can cause serious problems
Software needs to remain within vendor support.
A device may appear to work perfectly while running an operating system or application that no longer receives appropriate security fixes.
From a Cyber Essentials perspective, functionality does not equal security.
Businesses should identify unsupported operating systems and applications well before their assessment.
Do not wait for the assessor’s vulnerability scan to reveal them.
Create an inventory and review:
Operating system versions
Server platforms
Browsers
Office applications
Internet-facing software
Remote access products
Business applications
Network equipment firmware
Cloud-hosted systems
Where unsupported products remain because of a legitimate business dependency, discuss the situation with your Certification Body before the Plus assessment.
Malware protection must actually work
Having antivirus or endpoint protection installed does not automatically satisfy the technical assessment.
The assessor checks whether malware protection operates effectively.
The current Plus specification includes testing malware defences on sampled end-user devices, servers providing interactive desktops and relevant Infrastructure as a Service instances.
Where anti-malware software provides the protection, the assessor checks that it is installed and running.
Testing can also examine how the environment handles test files delivered through email and web browsing.
If a malware test file reaches the user and the user can access it without the required protection blocking it, the assessment can fail.
Executable test files also need appropriate controls.
This means businesses should check more than the management dashboard.
Confirm that endpoint protection is active.
Make sure security components are updating.
Investigate endpoints that have stopped reporting.
Check that employees cannot simply disable important protection.
Review exclusions.
Make sure new devices receive the required protection before staff start using them.
Endpoint security products such as Microsoft Defender, SentinelOne and other established platforms can help, but the configuration and operation of the product matter more than its name.
Email protection matters during the assessment
Email remains one of the most common routes attackers use to reach employees.
The Cyber Essentials Plus assessment reflects that risk.
For relevant environments, the assessor can test whether malicious test files sent through email reach the user and whether the user can access them.
This is particularly important for organisations using Microsoft 365 and other cloud email platforms.
Review the security controls around attachments and malicious content before the assessment.
Do not assume that using a major cloud email provider automatically means every Cyber Essentials requirement has been satisfied.
Your organisation still controls important security settings.
Web-based malware protection also receives attention
Employees download files from websites every day.
Cyber Essentials Plus can test how your environment responds when a user attempts to download approved test files through a browser.
The objective is straightforward: dangerous content should not have an easy route onto the device.
Your security controls might stop the download, block access to the file or prevent harmful content from running.
The exact behaviour can depend on the platform and security mechanism.
The important point is that effective protection needs to exist.
Multi-factor authentication is essential for cloud services
Cloud security has become increasingly important to Cyber Essentials.
Businesses now depend heavily on services such as Microsoft 365, Google Workspace, cloud accounting platforms, customer management systems and hosted business applications.
The Plus assessor tests multi-factor authentication on cloud services within scope.
The current test specification requires cloud services to be tested for both user and administrator access. Where several services use the same authentication service, the assessor does not necessarily need to repeat the same authentication test unnecessarily.
During testing, the assessor may observe a user signing into a cloud service from an untrusted device or an incognito browser session.
Access should require MFA.
If the user or administrator gains access without the required MFA challenge, the test can fail.
Do not check only your administrators.
Normal users matter too.
Before assessment day, review every cloud service within scope and confirm that the appropriate accounts have MFA enforced.
Do not confuse MFA registration with MFA enforcement
A user having an authenticator application registered does not necessarily prove that MFA will protect every relevant login.
Businesses should verify actual authentication behaviour.
Test it.
Open a private browser session.
Sign into the service.
Confirm that the authentication controls behave as expected.
Pay particular attention to exclusions and exceptions.
An organisation may create an MFA policy but accidentally exclude a group, contractor or older account.
Those exceptions can create exactly the weakness that an assessor discovers.
Separate everyday accounts from administrator privileges
Cyber Essentials places significant emphasis on controlling privileged access.
Users should not carry administrator privileges for ordinary daily activity unless those privileges genuinely form part of their role and the arrangement meets the scheme requirements.
Cyber Essentials Plus actively tests account separation.
The assessor can observe a standard user attempting to perform an administrative process on sampled devices.
If the standard account can simply carry out the administrative action using its existing privileges, that can result in failure.
A better arrangement separates ordinary work from privileged administration.
An IT administrator might therefore use one account for email, web browsing, Teams and routine office work, then use a separate privileged identity when an administrative task genuinely requires it.
This reduces the impact of phishing and compromised user sessions.
Remove unnecessary administrator accounts
Administrator access tends to accumulate.
Someone receives elevated access to solve a problem and keeps it indefinitely.
A contractor receives administrator privileges for a project and nobody removes them.
An employee changes role but retains old permissions.
Cyber Essentials encourages organisations to challenge this behaviour.
Ask a simple question:
Does this person need administrator privileges to perform their current job?
If the answer is no, remove them.
Privileged access should have a clear business reason.
How can I prepare my small business for Cyber Essentials assessment?
Start with a structured internal review rather than waiting for the assessor to identify every problem.
A practical preparation process can include:
- Confirm the certification scope.
- Create an accurate asset inventory.
- Identify every operating system and major application.
- Remove unsupported software.
- Apply outstanding security fixes.
- Check firewalls and internet-facing services.
- Review administrator privileges.
- Verify MFA across cloud services.
- Confirm malware protection is active.
- Review external and contractor access.
- Check that the Cyber Essentials answers match reality.
- Run vulnerability scans before the formal assessment where appropriate.
Small businesses often have simpler environments than larger organisations, which can make preparation easier.
However, simplicity should not turn into assumptions.
A ten-person business may still have Microsoft 365, several laptops, mobile devices, cloud accounting, remote workers, third-party IT support and multiple SaaS platforms.
All relevant elements need consideration.
Representative sampling matters
Cyber Essentials Plus does not necessarily require an assessor to manually test every device in a large organisation.
The assessment uses representative sampling where appropriate.
The sample needs to represent the environment accurately.
If an organisation uses several operating systems or has significantly different groups of devices, the assessor needs enough coverage to test the relevant security arrangements.
This is another reason standardisation helps.
An organisation with hundreds of laptops built to the same controlled configuration may be easier to assess than a much smaller organisation containing a mixture of unmanaged and inconsistently configured equipment.
Standard builds, central management and good asset records make technical assurance much easier.
A single weakness can affect the overall result
Businesses sometimes assume that passing most of the tests should be enough.
The current Plus specification takes a stricter approach.
As a general rule, every test case needs to pass for the overall assessment to pass. A failure in a sub-test normally causes the parent test case and overall assessment to fail.
The specification does provide limited discretion for a small number of minor issues. The exception is intended for marginal deviations affecting less than 5 per cent of performed tests where the evidence does not indicate a broader failure in the organisation’s cyber security processes.
Businesses should not plan around that exception.
Prepare on the assumption that every tested control needs to work correctly.
What software solutions support compliance with Cyber Essentials standards?
Cyber Essentials does not require every organisation to buy one particular security product.
The right technology depends on the environment.
Useful solutions can include:
Endpoint protection
Mobile device management
Patch management
Vulnerability management
Asset discovery
Firewall management
Identity and access management
Multi-factor authentication
Endpoint management
Cloud security management
Centralised monitoring
Products such as Microsoft Intune can help organisations manage endpoints, while Microsoft Entra can support identity controls and MFA.
Microsoft Defender, SentinelOne and comparable endpoint security products can contribute to malware protection when configured correctly.
Vulnerability management platforms can help identify missing security fixes before the formal assessment.
The important principle is not how many products you own.
Technology should help your organisation satisfy the Cyber Essentials requirements consistently.
Buying another security product does not fix weak processes automatically.
Check remote and home workers
Hybrid working can complicate Cyber Essentials Plus preparation.
Employees may work from home, customer sites, shared offices or other remote locations.
Their company devices still need appropriate protection.
Check:
Security updates
Endpoint protection
Firewall configuration
User privileges
Cloud authentication
Device management
Supported operating systems
Remote access
A laptop does not stop being part of your security responsibility because an employee takes it home.
Remote devices should receive the same level of management as equipment sitting inside the office.
Do not forget mobile devices
Mobile phones and tablets can form part of the certification scope.
Businesses sometimes concentrate almost entirely on Windows laptops and servers while overlooking smartphones that access company email and cloud information.
Review mobile operating system versions.
Check that devices remain supported.
Remove old equipment that cannot meet the required standard.
Consider whether personal devices access organisational services and how that access fits within your scope.
Mobile device management can make this significantly easier for organisations with larger fleets.
Cloud services deserve their own inventory
Create a list of cloud services used by the business.
Do not limit the exercise to Microsoft 365.
Departments sometimes adopt their own platforms without central IT being fully aware of them.
Consider:
Document storage
File sharing
Accounting
CRM
HR platforms
Project management
Remote support
Customer portals
Development platforms
Marketing systems
Backup services
Security platforms
The list helps you identify where MFA and access controls require attention.
It can also uncover old accounts and services that the organisation no longer needs.
Cyber Essentials Plus is not a penetration test
Cyber Essentials Plus includes vulnerability assessment and technical security testing, but businesses should not confuse it with a full penetration test.
The Plus assessment has a defined purpose and follows a defined test specification.
It verifies the Cyber Essentials controls against common attack routes within the scheme’s threat model.
A penetration test can go much deeper into specific applications, networks or attack paths.
Organisations with higher security requirements may choose to use both.
Cyber Essentials Plus provides a strong independently verified baseline, while other security assessments can address risks outside its scope.
Why businesses are increasingly pursuing certification
Cyber Essentials has grown significantly across the UK.
Government management information published in September 2026 shows that 61,430 Cyber Essentials certificates were awarded during the year from July 2025 to June 2026. Of those, 15,185 were Cyber Essentials Plus certificates.
The government’s Cyber Security Breaches Survey 2025 to 2026 also found that 5 per cent of businesses reported adhering to Cyber Essentials and 2 per cent reported Cyber Essentials Plus. Among large businesses, 35 per cent reported Cyber Essentials and 12 per cent Cyber Essentials Plus.
Certification can also matter commercially.
The NCSC reported that 79 per cent of surveyed Cyber Essentials customers believed the scheme had a positive effect on the confidence of their clients and customers, while 69 per cent believed it increased their market competitiveness.
Businesses increasingly encounter Cyber Essentials through customer requirements, tenders and supply-chain security programmes.
That makes maintaining the controls valuable beyond the day of assessment.
Certification should represent normal business practice
One of the best ways to prepare for Cyber Essentials Plus is to avoid treating security as an annual exercise.
If your organisation rushes to update hundreds of devices a week before the assessment, something has already gone wrong.
Security updates should happen throughout the year.
MFA should remain enforced.
Old accounts should be removed.
Administrator access should receive regular review.
Unsupported software should have a replacement plan.
Endpoint security should remain active.
New equipment should enter the same management process as existing devices.
Cyber Essentials Plus becomes much easier when these controls form part of everyday IT management.
Can I renew my Cyber Essentials certification through an online service?
Yes. Cyber Essentials certification operates through an online assessment process, and organisations can complete the required self-assessment electronically through an authorised Certification Body.
Cyber Essentials certificates remain valid for 12 months.
Organisations therefore need to recertify annually if they want to maintain continuous certification.
Renewal should not simply involve copying last year’s answers.
Your environment may have changed significantly.
You may have:
New employees
Different laptops
New servers
Additional cloud services
New offices
Different internet connections
New suppliers
Changed security products
New administrator accounts
Updated operating systems
Review the scope and answers properly each year.
Continuous management makes renewal considerably easier.
Which companies provide Cyber Essentials certification services in the UK?
Cyber Essentials certification is available through Certification Bodies licensed within the official Cyber Essentials scheme.
Businesses should distinguish between a company that provides general cyber security consultancy and a company authorised to provide certification.
A consultant may help an organisation improve its security posture, but certification needs to follow the official scheme arrangements.
UK Cyber Security Group provides Cyber Essentials certification and support for UK organisations.
UK Cyber Security Group Cyber Essentials services
For organisations looking for an affordable route, UK Cyber Security Group can support the initial Cyber Essentials process and progression towards Cyber Essentials Plus.
Which UK-based firms offer Cyber Essentials consultancy services?
A wide range of UK cyber security businesses provide Cyber Essentials consultancy, preparation and certification support.
When choosing a provider, look beyond the certificate itself.
Ask whether the provider can help you understand:
Your certification scope
Failed assessment questions
Security update requirements
MFA
Cloud services
Administrator access
Unsupported software
Firewall controls
Endpoint protection
Preparation for Cyber Essentials Plus
A knowledgeable provider should explain what needs changing and why.
For Cyber Essentials Plus, experience with technical assessment preparation becomes particularly useful because the organisation needs its declared controls to survive independent verification.
UK Cyber Security Group provides support for businesses working towards both Cyber Essentials and Cyber Essentials Plus.
What happens on Cyber Essentials Plus assessment day?
The exact arrangements depend on your environment and Certification Body, but the assessor works through the required technical tests against the agreed scope and representative sample.
The current NCSC specification contains five principal test cases:
- Remote vulnerability assessment.
- Authenticated vulnerability scanning to check security updates.
- Malware protection testing.
- Multi-factor authentication testing.
- Account separation testing.
The assessor also verifies scope, segregation where relevant and sampling.
Staff may need to assist by accessing devices or cloud services while the assessor observes particular actions.
IT personnel should therefore be available.
Make sure credentials, devices and relevant technical contacts are ready.
Trying to locate a missing laptop or administrator halfway through the assessment wastes time and can complicate testing unnecessarily.
Common reasons organisations struggle with Cyber Essentials Plus
Most problems come from everyday security weaknesses rather than exotic technical attacks.
Common areas worth checking before assessment include:
Missing security updates
Unsupported operating systems
Unsupported applications
Forgotten internet-facing services
MFA exceptions
Excessive administrator privileges
Inactive endpoint protection
Old user accounts
Unmanaged devices
Inaccurate asset inventories
Unexpected cloud services
Weak separation between included and excluded systems
Many of these problems can be identified before the formal audit.
That is why readiness checks are valuable.
A practical Cyber Essentials Plus readiness checklist
Before booking the technical assessment, confirm that you can answer yes to the following questions.
Is the scope clearly defined?
Is the asset inventory accurate?
Are all relevant operating systems supported?
Are relevant applications supported?
Have required security fixes been applied within the scheme’s required timeframe?
Have unnecessary internet-facing services been removed?
Are firewall rules appropriate?
Is malware protection active and current?
Can security tools demonstrate that endpoints are reporting correctly?
Is MFA enforced on cloud services?
Does MFA protect ordinary users as well as administrators where required?
Have unnecessary administrator privileges been removed?
Are everyday user accounts separated from privileged administration?
Are contractor accounts still required?
Have former employee accounts been disabled?
Are mobile devices appropriately managed?
Are remote workers receiving security updates?
Do your Cyber Essentials answers match the actual environment?
Can the assessor access the representative devices needed for testing?
If several answers are uncertain, carry out a readiness review before the formal Plus assessment.
Passing Cyber Essentials Plus is about evidence
Cyber Essentials Plus is valuable because it moves beyond statements of intent.
The assessor wants to see evidence that your controls work.
A security policy saying that every laptop receives updates is useful, but the vulnerability scan provides stronger evidence.
An MFA policy may look excellent, but an actual login demonstrates whether MFA really protects the service.
A document may say that employees do not have administrator privileges, but the account separation test verifies the claim.
This practical verification gives Cyber Essentials Plus its additional assurance.
It also explains why organisations should prepare their real environment rather than concentrating only on paperwork.
Make Cyber Essentials Plus part of wider cyber security
Cyber Essentials Plus provides a valuable baseline, but cyber security should continue beyond certification.
Businesses still need to consider areas such as:
Backups
Incident response
Security monitoring
Employee awareness
Phishing
Business continuity
Data protection
Supplier risk
Access reviews
Vulnerability management
Cyber Essentials Plus gives organisations a strong foundation.
From there, businesses can build additional controls according to their risks, customer requirements and regulatory responsibilities.
For organisations seeking higher assurance, Cyber Essentials Plus can also sit alongside frameworks and standards such as ISO 27001.
The simplest route to a successful assessment
The most reliable way to pass Cyber Essentials Plus is to prepare before the assessor starts testing.
Define your scope accurately.
Know every relevant asset.
Keep operating systems and applications supported.
Apply security fixes promptly.
Use MFA across cloud services.
Restrict administrator privileges.
Keep malware protection active.
Remove unnecessary services.
Manage remote devices.
Review contractor access.
Test the environment yourself before the formal assessment.
Most importantly, make these controls normal business practice rather than temporary changes made for certification.
Cyber Essentials Plus should confirm that your organisation operates the controls it claims to have.
When those controls already form part of everyday IT management, the technical assessment becomes far more straightforward.
For businesses looking to achieve Cyber Essentials or progress to Cyber Essentials Plus, UK Cyber Security Group provides certification services and support throughout the process.
Start Cyber Essentials certification with UK Cyber Security Group
Cyber Essentials Plus gives customers, suppliers and other stakeholders independently tested evidence that an organisation has implemented the core Cyber Essentials security controls. With more than 15,000 Plus certificates awarded in the latest reported 12-month period, it is becoming an increasingly established security benchmark for UK organisations.
For businesses that depend on cloud services, remote working, customer data and digital supply chains, achieving Cyber Essentials Plus provides something particularly useful: practical evidence that essential cyber security controls are not merely documented, but working.
UK Cyber Security Group Ltd is here to help
Please check out our Free Cyber Insurance
Other blog posts, Your ISO 27001 Questions Answered, Get ISO 27001 Certified ,
If you would like to know more, do get in touch as we are happy to answer any questions. Looking to improve your cybersecurity but not sure where to start? Begin by getting certified in Cyber Essentials, the UK government’s scheme that covers all the technical controls that will provide the protection that you need to help guard against criminal attacks. Or just get in touch by clicking contact us
