Cyber Essentials Plus: The Technical Audit Explained

Cyber Essentials Plus is the version of the scheme where someone other than you checks your work. Instead of ticking boxes on a questionnaire, you hand an assessor access to real devices and your internet-facing systems, and they test whether your security controls hold up.

Plenty of UK organisations that already hold basic Cyber Essentials are asked for Plus by a customer, a tender or an insurer, and most have no idea what the day involves. This guide explains the Cyber Essentials Plus audit step by step, how it differs from the self-assessment, what to prepare, and where organisations most often fail.

If you are still deciding which level you need, our sibling guides on the Cyber Essentials certification process and Cyber Essentials for tenders and insurance cover that side. Here we stay with the technical audit.

What Is Cyber Essentials Plus?

Cyber Essentials Plus assesses the same five technical controls as basic Cyber Essentials: firewalls, secure configuration, security update management, user access control and malware protection. The difference is the method. The NCSC describes Plus as independent testing of your systems to verify the controls work in practice, rather than relying on your own answers (source: NCSC Cyber Essentials overview).

The scheme is run by IASME, the NCSC's delivery partner. Basic Cyber Essentials is a verified self-assessment, signed off by a board member or equivalent and marked by an assessor. Plus is delivered by a licensed Certification Body, and you contact one directly rather than buying it through the standard online route.

Think of basic certification as your declaration and Plus as the evidence. That is why procurement teams and insurers increasingly ask for it on higher-risk contracts. Our service page on Cyber Essentials support explains how we help organisations get ready for either level.

Cyber Essentials vs Cyber Essentials Plus

The quickest way to see the gap is side by side. If you want the longer version, we have a dedicated post on the difference between Cyber Essentials and Cyber Essentials Plus.

The main practical shift is that mistakes in your questionnaire answers can no longer hide. If a device is unpatched, the scan finds it.

What the Cyber Essentials Plus Audit Involves

A Cyber Essentials Plus audit is a technical verification of the scope you declared in your basic assessment. Certification Bodies run it slightly differently, but the shape is consistent.

External vulnerability scan

The assessor scans every public IP address in scope. They are looking for known vulnerabilities, services that should not be exposed, and firewall rules that do not match what you declared. This is the part most organisations underestimate, because forgotten internet-facing systems are easy to overlook.

Internal testing

Where the internal network is in scope, the assessor checks it as well, including how it is separated. The IASME guidance refers to a representative set of user devices, all internet gateways and all servers with internet-accessible services (source: IASME).

Device sampling and checks

The assessor selects a sample of devices rather than testing every one. Typical checks cover:

• Patch status of the operating system and applications
• Anti-malware installation and settings
• Host firewall configuration
• User accounts, password settings and screen lock
• Browser and auto-run settings

Sampling usually covers each type of device and operating system version you run, with selection at the assessor's discretion. Expect a test on a standard user account, often with an admin account reviewed too.

Evidence review

Finally, the assessor confirms that what you saw on the day matches what you declared in the basic assessment. Policies and processes should back up the technology.

What audit day looks like

For a small or mid-sized organisation, much of the work is done remotely, with the assessor running scans from their own systems and asking a user to share a screen or run a short test on a sampled device. Larger or multi-site networks may need an on-site visit. Either way, expect the assessor to ask you to demonstrate settings live, so a nominated IT contact who can answer questions quickly makes the day far smoother.

The assessor records a pass or fail for each check. Where something fails, you will usually be told exactly which device or service caused it, which makes remediation straightforward.

Timing: The Window Between Basic and Plus

You cannot go straight to Plus. Basic certification comes first, and the Plus scope must match the scope of your basic assessment.

Basic certification has to be completed first, and the Plus audit must then follow within a limited window. The length of that window is set by the Certification Body you use, so agree dates with them before you submit the basic assessment. IASME confirms that the verified self-assessment is a prerequisite for Plus, and your Certification Body will confirm the deadline in writing.

What has changed with the current question set

The Danzell question set applies to certifications from 27 April 2026, alongside version 3.3 of the NCSC Requirements for IT Infrastructure. Two changes matter for the audit:

• Your self-assessment answers must be finalised before Plus testing starts. You can no longer amend them based on what the audit finds.
• If Plus fails because of missing patches, the assessor retests the failing devices and a fresh sample.

The practical advice is to fix problems before you submit the basic assessment, not after. Treat the basic submission as the starting gun for a short, tight project.

A sensible timeline

Book your Certification Body for the Plus audit before you submit the basic assessment, so the dates line up. Use the weeks between submission and testing to hold your configuration steady: avoid rolling out new devices, changing firewall rules or migrating services unless you update your scope with the assessor. Changes made mid-window are a frequent source of surprises on the day.

If your certificate renewal is approaching, plan the Plus audit around it so you are not repeating work twice in a year.

Cyber Essentials Plus Requirements

The Cyber Essentials Plus requirements are the same five controls from the basic scheme, now tested rather than declared. For the full control-by-control list, see our guide to the Cyber Essentials requirements checklist. For the audit, these are the points assessors lean on hardest.

• Patching: supported operating systems and applications, with high and critical updates applied within the required timeframe.
• Multi-factor authentication: required for cloud services where it is available, and for privileged access. Partial rollout is likely to fail.
• Malware protection: installed, enabled and updating on in-scope devices.
• Firewalls: a boundary firewall or equivalent, with no unnecessary inbound services and a host firewall on devices.
• Secure configuration: no default credentials, unnecessary software removed, auto-run disabled.
• Access control: separate admin accounts, and accounts removed when people leave.

Microsoft 365 tenants deserve particular attention because cloud services are now explicitly in scope. Check that multi-factor authentication covers every user and every administrator, not only senior staff, and that older sign-in methods which bypass it are switched off. Our team can review that for you through Microsoft 365 support.

How to Pass Cyber Essentials Plus: Preparation Checklist

Most failures are preventable. Work through these steps in the weeks before the audit.

Sector matters too. Firms such as law firms and accountants are often asked for Plus by clients handling sensitive data, so the audit tends to arrive with a deadline attached. Starting early gives you room to fix problems without pressure.

Organisations with a managed provider can often build this into routine maintenance. Our managed IT support service covers patching and endpoint policy as standard working practice.

Common Fail Points in the Technical Audit

Assessors see the same issues repeatedly. Knowing them is half the battle.

It also helps to keep a simple record of what you fixed and when. If an assessor questions a finding, dated evidence of your patch cycle or MFA policy settles the point quickly.

If a failure is minor, such as one missing update, it can sometimes be fixed and rescanned during the audit. Larger problems may mean rescheduling and extra cost, so check your Certification Body's retest terms up front.

Cyber Essentials Plus Cost

Cyber Essentials Plus cost is not a fixed fee. The NCSC notes that basic pricing is tiered by organisation size, whilst Plus is quoted according to the size and complexity of your network. Fees vary between Certification Bodies, so ask for quotes against the same scope.

The factors that move a quote are:

• Number of devices and device types in scope
• Number of sites and internet gateways
• Number of servers exposed to the internet
• Whether internal testing is needed alongside the external scan
• Retest terms if something fails

Preparation is the biggest lever. A failed audit that needs a rescan costs more than an hour of internal checks. For the wider budget picture, including the basic assessment, read our Cyber Essentials cost guide.

If you are weighing up a broader review before certification, our cyber security audit services give you a view of gaps beyond the five controls.

Conclusion: Cyber Essentials Plus Rewards Preparation

Cyber Essentials Plus is a practical test of whether your controls work, not a paperwork exercise. The audit rewards organisations that know their devices, patch consistently and enforce MFA everywhere it is available.

Keep to the Plus window after your basic certificate, finalise your answers before testing, and scan yourself first. Do that and passing Cyber Essentials Plus is a matter of routine rather than luck. If you want help getting there, speak to the NetMonkeys team.

Frequently asked questions