Cyber Essentials Plus Testing

Cyber Essentials Plus (CE+) tests the same protections as Cyber Essentials (CE). The assessor tests a selection of systems; prepare the full scope.

Prepare for TestingAll CE and CE+ Guides

Before Testing Starts

The certification body chooses and runs the formal tests. Your organisation prepares the people, systems and authority it needs.

  1. Confirm the Scope and Booking

    Pass CE first and resolve outstanding questionnaire issues. Contact a licensed certification body to agree matching scope, quote, current procedure and a test booking.

  2. Confirm the Final Date

    Plan to complete Plus within the required three-month window after CE certification. Ask the body to confirm the final date in writing and schedule testing and any permitted follow-up inside it.

  3. Authorise Testing and Access

    The applicant’s authorised representative approves testing, with relevant system owners and providers confirming their permissions. Agree device availability, user participation and safe access. Keep credentials in approved systems.

What the Technical Checks Cover

Testing may be remote or on site. The assessor selects devices that represent the systems in scope. A vulnerability scan alone is insufficient.

Internet-Facing Systems
External scans check public IP addresses, the internet-facing addresses of your systems, for exposed weaknesses. Reconcile the addresses and hosted systems with your provider before authorising scans.
Devices and Updates
Representative devices and operating systems are checked for supported software and required security fixes. Have the relevant devices available and current update evidence ready.
Malware Defences
Checks examine protection against malicious software or restrictions on running applications. Agree test logistics with the assessor and involve the people using sampled devices.
User and Admin Accounts
Tests check that ordinary users cannot perform administrator tasks. Prepare the appropriate separate accounts and people who can demonstrate their use.
Cloud Sign-In
Checks cover multi-factor authentication (MFA): sign-in using more than one verification factor. Include all in-scope cloud services and the required user and administrator access.

Turn Findings into an Action

Every required test must pass. Ask for the finding, affected scope and required evidence before deciding the next step.

A Required Fix

The assessor identifies a missing update or another failed control.

What to Do

Your organisation or IT provider fixes the issue on all affected systems. The assessor confirms permitted verification or retesting, the deadline and the outcome. Fixing only one sampled device is insufficient.

An Unclear Finding

You believe a reported issue is inaccurate or do not understand the required action.

What to Do

Name someone in your organisation to send the evidence and question promptly. Ask the assessor why the issue affects the result and when a reply is due. Hemanth can help review evidence and coordinate the query.

A Deadline or Procedure Is Unknown

Sampling, later findings or a retest could affect the plan.

What to Do

Before booking, ask the body to confirm sample selection, later-sample consequences, allowed remediation/retests, fees and the final completion date in writing. Do not assume an extra attempt or an extension.

Fictional Example: One Finding, Several Laptops

A sampled laptop lacks a required browser fix. The provider is unsure whether remote laptops received it.

Next Action
The applicant’s IT owner asks the provider to check every affected laptop and evidence the corrections, then asks the assessor what verification is required and by when.
What This Settles
The action reaches every affected laptop. The independent assessor still decides whether the evidence and test results permit certification.

Continue With Your Next Question

Understand the Five ProtectionsPrepare and ApplyPlan Costs and Timing

Make the Testing Plan Clear

Record the agreed scope, final date, access approvals and owners for open findings. Hemanth can advise on evidence and the handoff; your organisation and provider make changes, and the independent body decides the result.

Open the Preparation WorksheetDiscuss Readiness With Hemanth