What actually happens in a Cyber Essentials Plus audit

Standard Cyber Essentials asks you questions. Plus turns up and tries things.

That is the entire difference, and it is larger than it sounds. Same five controls, same scheme, same certificate wall. What changes is that somebody outside your business emails a test file to one of your staff, watches them try to open it, and writes down what happened. Five per cent of UK businesses hold Cyber Essentials. Two per cent hold Plus.

Why the gap between the two is so wide

The Cyber Security Breaches Survey for 2025/2026 found something worth sitting with. Twenty-four per cent of businesses reported having the technical controls in all five Cyber Essentials areas. Five per cent hold the certificate. The report draws the obvious conclusion, that plenty of organisations are already meeting the standard and simply not certifying to it.

The same survey found that 18 per cent of businesses did not know whether they adhered to Cyber Essentials, Plus or ISO 27001 at all. Those answers came from the person each organisation named as having most responsibility for cyber security.

So the honest starting position for most small firms is that they think they are probably fine. Plus exists to find out. If you want the scheme's shape and what the questionnaire covers, we wrote that up in the Cyber Essentials guide, and the contract angle in why councils ask for it. This piece is about the audit.

The order of things, and the three-month clock

You cannot go straight to Plus. Standard certification comes first, and IASME's own guidance sets the window: the Plus audit has to be completed within three months of your last Cyber Essentials certification. Inside that window you skip the self-assessment questions second time round. Outside it you do not.

Three months sounds generous. It is not, once you have booked an assessor, discovered two laptops nobody had patched since spring, and found that the person who administers your Microsoft 365 tenant left in June.

NCSC publishes the tests. The document is called the Cyber Essentials Plus Test Specification, it runs to 24 pages, and version 3.2 has been the current one since April 2025. Nothing in it is secret. An assessor is following a script you can download this afternoon, and there are five test cases in it.

Test one: what the internet can already see

Before anybody comes near your office, the assessor scans every IP address your business uses from outside, including anything you run as infrastructure-as-a-service. The purpose, in the specification's own words, is to test whether an internet-based opportunist attacker can hack into your system with typical low-skill methods.

Two practical notes sit in that section and both catch people. If your internet connection uses dynamic addressing, the scope gets defined by DNS entries instead, which means somebody has to know which names actually point at you. And the specification warns about carrier-grade NAT sending assessment traffic to the wrong destination entirely, which is a polite way of saying that on some connections you can end up having a stranger's kit scanned.

Everything the scan finds gets judged service by service. This is the half of a business that almost nobody has looked at, and it overlaps heavily with what we covered in the box in the comms cupboard: an admin interface published to the internet, a forwarded port that was for a supplier three years ago, a management page nobody knew was reachable.

Test two: the fourteen-day rule

The second test is an authenticated vulnerability scan of the sampled machines. Not a look from outside. A scan running with credentials, on the device, reading what is installed.

The pass criteria are specific enough to plan around. The assessor flags anything the vendor describes as critical or high risk, anything with a CVSS version 3 base score of 7 or above, and anything where the vendor gave no detail about what the update fixes. Then one question decides it: has a fix been available for more than 14 days?

If yes, that sub-test fails.

Fourteen days is the whole budget. It covers the weekend the update landed, the fortnight the laptop spent in a bag, and the machine somebody deferred restarting because they had tabs open. A monthly patch window does not fit inside it, and neither does a policy that patches servers promptly and leaves end-user devices to look after themselves. We went through what a working patch process looks like in patching that actually happens.

One more line in that section is worth reading twice, because it closes the escape route people reach for. Virtual patching is not accepted as a long-term mitigation for the vulnerabilities of legacy unsupported operating systems. Wrapping the old machine in something clever does not make the old machine compliant. Taking it out of scope properly might, and that is a conversation for the scoping stage.

Test three: the files in the inbox

This is the test people are surprised by, and it is the one that involves your staff rather than your servers.

The assessor needs an external email system that does no filtering and is not on any deny list, plus a set of test files hosted on a website the certification body owns. Sometimes you have to allow that site through your own filtering first, which feels backwards until you understand what is being measured.

It runs like this. First a plain email with no attachment, to prove mail from that address arrives at all. Then one email per file type, each carrying a test file, and a member of your staff sits there and tries to open each one while the assessor watches. The same exercise runs again through the browser: can the user reach the web, can they download the files, and are they blocked when they try to open what they downloaded.

The distinction between the two categories of test file is the part worth explaining to whoever is being watched. Malware test files should be detected and the user blocked from reaching them. Executable test files are allowed to arrive, but the user must at least get a warning and a prompt before anything runs. An executable that launches with no interaction at all is a fail.

There is a quieter route through this test for kit where the file-based method does not suit: the assessor checks the anti-malware logs to confirm it is installed, running and updating the way the vendor says it should. And if you use certificate-based application allow listing instead of anti-malware, the test changes shape completely, checking that your trusted root certificates are the operating system's standard set and that an unsigned executable simply will not run.

Test four: multi-factor authentication, watched

Test four covers cloud services, and the method matters more than the subject. The assessor watches your users sign in to each service from an untrusted device, or from an incognito session, precisely so that a remembered device cannot quietly do the authenticating for you.

Every cloud service in scope gets tested for both a normal user and an administrator. Where several services share one sign-in, that authentication service only needs testing once, which is one of the practical arguments for consolidating logins rather than collecting them.

Pass is simple. The user gets prompted for a second factor before they get in. No prompt, no pass. If you are still working out which factors are worth deploying, the MFA piece covers the trade-offs.

Test five: can an ordinary account do an administrator's job

The last test takes about a minute and fails more businesses than it should. A user logs in with their normal account and tries to run an administrative process. To pass, they must be stopped and asked for a separate login, and the process must not run under their own credentials.

This is tested on every sampled device, not one of them. Which means the small office where three people share one account, or where the owner's day-to-day login happens to be a local administrator because it was easier in 2021, fails here on principle rather than by accident. That whole subject, including the versions of it that survive in businesses that think they fixed it, is in who has administrator rights.

Sampling, and why "we only have nine laptops" settles nothing

Every test after the first runs against a sample rather than the whole estate. That sounds like a relief and mostly is not.

The specification tells assessors to satisfy themselves that the testing is representative of everything in scope, and that the number needed depends on how much variation your provisioning has produced. Where machines are built from one standard image, a handful covers a lot. Where they were bought one at a time from whoever was cheapest that month, it does not. The assessor also has to verify the sample size was calculated by the method their Delivery Partner sets, and the evidence of that calculation is retained by the certification body for at least the lifetime of the certificate.

IASME adds the rule that catches mixed estates: each type of operating system has to be tested. Windows laptops, the designer's Mac and the Linux box in the corner are three samples, not one.

Cloud services get sampled by account rather than by device, and the floor is at least one normal user and one administrative user for every service you use.

One fail fails the lot

The pass rule is the least ambiguous sentence in the document. Any single fail means a fail for the assessment as a whole. Every sub-test has to pass for its test case to pass, and every test case has to pass for the assessment to pass.

There is one narrow exception and it is not yours to invoke. Where the failures are marginal, affect less than five per cent of the tests performed, and the evidence does not indicate a wider failure of your security processes, the Delivery Partner may allow a pass at their discretion. IASME's guidance gives 30 days to remediate something found during the audit, and says plainly that you will not pass until it is remediated. The assessor is also told to finish the assessment even after a fail, so that you get the full picture rather than stopping at the first problem.

All of which is why the preparation is the actual product. An audit is a poor time to discover that a laptop missed a patch cycle, that an old admin account was never disabled, or that a home worker's device was never brought into scope in the first place. Every one of those is findable in advance, by running the same tests yourself first, which is what our Cyber Essentials Plus readiness work is.

What it costs, and who is paid for what

Two bills, from two organisations, and it is worth keeping them separate in your head.

The certification body charges for the certification. NCSC publishes standard Cyber Essentials as tiered by organisation size, starting at 320 pounds plus VAT, with Plus quoted according to the size and complexity of your network, because it needs an assessor's time. That money never reaches us.

Then there is the preparation. Ours is 1,755 pounds a year for Cyber Essentials Plus readiness: the pre-audit testing, the remediation work, coordinating the assessment, and keeping the controls in place across the twelve months rather than rediscovering them the week before renewal. Managed standard Cyber Essentials is 99 pounds per client per month. Cyber Essentials readiness on its own, mapped control by control with a pass or fail against each, is 650 to 950 pounds. Everything excludes VAT.

Now the part some providers leave out. Alpha IT holds neither Cyber Essentials nor Cyber Essentials Plus. We are not a certification body and not an assessor, and we cannot issue, award or refuse anybody a certificate. Only a body licensed by IASME can do that. Our own security position is published on our security page as a self-assessment, described as exactly that.

Two free things before you spend anything. IASME publishes a Cyber Essentials Readiness Tool that walks you through the requirements and produces a list of actions, and NCSC assures a Cyber Advisor scheme offering small businesses half an hour of advice at no cost. There is also an incentive most people miss: certify your whole organisation with a turnover under 20 million and you are automatically entitled to the cyber liability insurance IASME arranges, incident response included.

And if you are certifying because a customer asked, the numbers say you are early rather than late. Three per cent of businesses require their suppliers to hold Cyber Essentials. Among large businesses it is 26 per cent, up from 10 per cent the year before.