Key takeaways
- Plus uses the same five controls as Cyber Essentials, but an IASME-licensed Certification Body tests them on a sample of your devices and on every cloud service.
- One failed test can fail the audit. Since April 2026, a failed update sample means a retest on the same devices plus a fresh random sample, and a second failure costs your Cyber Essentials certificate too.
- Book the audit within three months of your Cyber Essentials certificate, and settle your self-assessment answers first: they lock once testing starts.
- A pre-audit runs the same kind of tests in advance so you can fix problems on your own timetable. It does not replace the audit.
Cyber Essentials and Cyber Essentials Plus: the difference
Cyber Essentials is the UK scheme for five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. It is backed by the NCSC and certified through IASME and the Certification Bodies it licenses. The current rules are the NCSC's Requirements for IT Infrastructure v3.3, in force since April 2026.
At the basic level you answer a self-assessment, a director signs it, and a Certification Body marks it. Our Cyber Essentials readiness guide covers that step.
Plus uses the same requirements. The difference is proof. As the NCSC puts it, Plus independently tests your systems to check the controls work in practice. You need a Cyber Essentials certificate first, and your answers become the yardstick: the assessor checks that what you said is true.
Who asks for Plus, and why it matters
The NCSC notes that a growing number of organisations require suppliers to be certified before they bid for work. Plus is the level a buyer names when a signed self-assessment is not enough. The request usually comes in a contract, a tender, a supplier questionnaire or from an insurer.
Read the wording. If it names Plus, the basic certificate will not meet it.
Plus is worth doing anyway. The audit tests what an opportunist attacker tries first: an exposed service, a missing update, a malicious attachment, a password with no second factor, an everyday account with admin rights.
How the CE+ audit works
Only an IASME-licensed Certification Body can carry out the audit and issue the certificate. The assessor follows the NCSC's Cyber Essentials Plus Test Specification. The version on the NCSC resources page in November 2026 is v3.2, from April 2025.
Before testing
The assessor needs your written permission. They check, by technical means, that the audit scope matches your Cyber Essentials certificate, and that any part you excluded really is separated. Mismatches must be resolved before testing starts.
The sample
The assessor tests a representative sample of user devices and servers, sized with the Delivery Partner's method. Standard builds keep it small. Every cloud service is tested with at least one normal user and one admin. Services that share one sign-in system are tested once.
Pass or fail
Any single failed sub-test fails the audit. The one exception: a small number of minor issues, which the Certification Body may accept after consulting the Delivery Partner. The NCSC expects this to cover marginal deviations in under 5% of tests, with no sign of wider failure. Do not plan around it.
What changed in April 2026
IASME added three rules for assessment accounts created from late April 2026:
- Fresh-sample retest. If the sample fails the update management check, you fix it and are retested on the original devices plus a new random sample. A second failure revokes your Cyber Essentials certificate too.
- Answers locked. Your self-assessment answers must be final before CE+ testing starts.
- Point in time. This is the date the certificate is issued. Your systems must be supported on that date.
IASME is plain about the reason: some organisations updated only the sampled devices.
The CE+ tests at a glance
Five test cases, with the malware test in three parts and a scope check before any of them: eight things to get right.
| Test | What the auditor checks | What fails | You are ready when |
|---|---|---|---|
| Scope and sample | What they find matches your certificate's scope | Unknown devices or services, or a sub-set that isn't separate. Testing can't start | Your registers match reality |
| 1. Remote vulnerability scan | Every IP address you use, including cloud servers | A service a low-skilled attacker could exploit | Every open service is needed, approved and up to date |
| 2. Patch scan | An authenticated scan of sampled computers and servers | A critical or high-risk vulnerability (vendor rating, CVSS v3 7 or above, or unrated) with a fix out for over 14 days | Updates install on time and nothing is unsupported |
| 3. Malware by email | Test files from an unfiltered outside mailbox, opened while the assessor watches | A malware test file opens, or a test program runs without a prompt | Malware files are blocked and programs need the user's decision |
| 3. Malware by browser | Test files downloaded from the Certification Body's website | As for email | The same in every browser you use |
| 3. Anti-malware checks | Logs and update status, where test files didn't prove it | Protection not running or not updated | Protection is on and current everywhere |
| 4. Multi-factor authentication | A user and an admin sign in to each cloud service from an incognito window | Access with a password alone | A second factor is asked for every time |
| 5. Account separation | On every sampled device, the user tries an admin task | The task runs under the user's own account | It asks for a separate admin sign-in |
Where audits go wrong
We won't guess at failure rates. What we can show is where the rules are strict enough that a small gap becomes a fail.
- One overdue update on one device. A single high or critical fix older than 14 days fails the patch test, and a retest now covers a fresh sample.
- Software past end of support. It can't be patched, and the specification doesn't accept virtual patching as a long-term answer for unsupported operating systems.
- A cloud service without MFA. Cloud services can't be left out of scope, and MFA is required wherever it is available. Missing it is already an automatic fail in the self-assessment.
- Everyday accounts with admin rights. Installing software without a separate admin sign-in fails account separation.
- Test files that get through. An unscanned archive, or a script that runs without a warning.
- Fixes made for the day. Updating only the laptops you expect to be sampled is what the fresh-sample rule catches.
Your CE+ readiness checklist, test by test
Start with scope, because every other test depends on it.
Scope and sample
What to check
- Your device register against the network, including home workers' devices and personal devices that reach work data.
- Your cloud services list, and any excluded area and how it is separated.
You are ready when everything the assessor could find is on your lists, and your builds are standard enough that a small sample represents them.
Remote vulnerability scan
What to check
- Every public IP address and domain, including cloud servers.
- Open services against your firewall record, and router or firewall admin pages.
You are ready when a scan finds no high or critical issue, and no admin interface faces the internet without a documented need and MFA or an IP allow list.
Patch scan
What to check
- Operating systems and their end-of-support dates.
- Applications too: browsers, PDF readers, office software, runtimes and plug-ins.
- That automatic updates are on and devices actually restart.
You are ready when a scan of each operating system and build shows nothing critical or high with a fix older than 14 days, and nothing unsupported.
Malware by email
What to check
- Filtering of dangerous attachment types, and scanning inside archives such as .zip files.
- Warnings before downloaded programs and macros run.
You are ready when malware test files are blocked or removed when opened, and test programs need the user's decision.
Malware by browser
What to check
- Every browser in use, with download protection on.
- What the Certification Body needs to reach its test site, which should be filtered like most other allowed sites.
You are ready when malware test files are blocked when downloaded or opened, and test programs need confirmation. Blocking the download also passes.
Anti-malware checks
What to check
- Anti-malware running and scanning on access on every computer, and on servers with a desktop.
- Definitions updating as the maker recommends. Where you use application allow listing instead, unsigned programs are blocked.
You are ready when every device shows active, current protection and its logs prove it.
Multi-factor authentication
What to check
- Each cloud service and the sign-in system behind it.
- Exclusions in sign-in policies, and accounts used by your IT provider.
You are ready when a normal user and an admin, signing in from a private browser window, are asked for a second factor on every service.
Account separation
What to check
- Who has local admin rights on each device.
- Whether admin accounts are used for email or browsing.
You are ready when an admin task asks the everyday user for a separate admin sign-in on every device.
Run the tests before the auditor does
Our CE+ pre-audit runs the same kind of tests on your systems and gives you a pass or fail for each, with the fixes.
See the CE+ pre-auditWhen to book the audit
IASME says the Plus audit must be completed within three months of your Cyber Essentials certificate. Certification Bodies may count the window slightly differently, so ask yours when you book.
Three months goes quickly once you fit in an audit slot, fixes and possibly a retest. A plan that works:
- Run a pre-audit before you submit the self-assessment, or soon after. Fix scope problems before you submit, because the answers lock once testing starts.
- Book early in the window, so a retest still fits.
- In the 14 days before the audit, install every update and restart every device.
- Check anything close to end of support. It must be supported on the day the certificate is issued.
- Have the sampled devices and their users available, with working email and a browser.
If the audit finds a problem, IASME's guide gives you 30 days to fix it. Ask your Certification Body how that works with the 2026 retest rule.
What a pre-audit is, and how we run it
A pre-audit runs the same kind of tests as the auditor, on your systems, before you pay for the audit. You see what would fail while there is time to fix it.
It is not the audit. Only an IASME-licensed Certification Body carries out Cyber Essentials Plus and certifies you, and the assessor picks their own sample. A pre-audit reduces the risk of surprises. It cannot promise a result.
Our pre-audit, CORE+, runs eight tests that mirror the auditor's:
- Scope and sample. Our SentriqPro device agent builds an inventory, which we compare with your registers, then we pick a sample covering each build.
- External scan. The SentriqPro vulnerability scanner checks every in-scope IP address and domain.
- Patch scan. The agent, or a credentialed scan, checks the sample against the 14-day rule.
- Email and browser tests. Harmless test files, sent by email and hosted on our own test site: an inert anti-malware test file, archives containing it, and harmless test programs and scripts.
- Anti-malware check. The agent reads protection status and definition age, and we check the logs.
- MFA and admin rights. We watch a user and an admin sign in to each cloud service, and an everyday user try an admin task.
You get a pass or fail for each test, with the fix for each failure. With Pre-audit and fix, we close the failures with you and re-run them on the same devices and a fresh sample, as the 2026 retest does. We change nothing without your agreement.
Pre-audit starts from £795 and Pre-audit and fix from £1,495, plus VAT, for up to 25 staff. Both add to a Cyber Essentials level. The audit fee is paid to the Certification Body. See the CE+ pre-audit.
Staying ready between audits
A certificate shows one date. The next audit tests another, and the 2026 rules make one-off fixes pointless. Staying ready means making the controls routine.
- Keep automatic updates on, check devices restart, and review missing updates at least every two weeks.
- Track end-of-support dates and plan replacements ahead.
- Add new devices and cloud services to your registers with MFA and a standard build from day one.
- Check admin rights after every new starter or role change.
- Re-scan after any change to your router, firewall or hosted services.
- Check the NCSC and IASME pages before each renewal. The rules changed in April 2026 and will change again.
Our Stay ready option keeps SentriqPro running between audits: continuous checks for missing updates and unsupported software, device evidence kept current, and alerts when something slips. Ask us for a price, or compare the options.
Start with Cyber Essentials
Plus starts from Cyber Essentials. Find out whether you would pass the self-assessment, then add the pre-audit.
Choose where to startFAQ
Is a pre-audit the same as the CE+ audit?
No. Only an IASME-licensed Certification Body can carry out Cyber Essentials Plus and issue the certificate. A pre-audit runs the same kind of tests beforehand, so you know what to fix before you pay for the audit.
How long after Cyber Essentials do we have?
IASME says the Plus audit must be completed within three months of your Cyber Essentials certificate. Check with your Certification Body how it counts the window.
What happens if we fail the audit?
Any single failed test can fail the audit. If the update sample fails, you fix it and are retested on the original devices plus a new random sample. A second failure revokes your Cyber Essentials certificate as well.
Can we change our self-assessment answers after the pre-audit?
Yes, as long as CE+ testing has not started. Since April 2026, the answers lock once it does. That is why we suggest running the pre-audit before you submit, or soon after.
Do the malware tests use real malware?
No. Both the auditor and we use harmless test files: inert files that most anti-malware products recognise, and test programs that do something obvious and safe, such as opening a dialog.
How much does the pre-audit cost?
For up to 25 staff, Pre-audit starts from £795 and Pre-audit and fix from £1,495, plus VAT. Both add to a Cyber Essentials level. The audit fee is paid to the Certification Body.