CYBER ESSENTIALS PLUS AUDIT: WHAT HAPPENS AND HOW TO PREPARE

WHAT IS THE CE PLUS AUDIT?

The Cyber Essentials Plus audit is an independent technical assessment of your IT environment. Unlike standard Cyber Essentials, which is a self-assessed questionnaire, CE Plus involves an IASME-approved assessor viewing your systems via screen share and actively testing that the five security controls are working correctly.

The audit is conducted under the Danzell v3.3 standard (current as of 2026). It covers the same five controls as standard CE - firewalls, secure configuration, user access control, malware protection, and patch management - but verifies them through live technical testing rather than reviewing written answers.

BEFORE THE AUDIT: THE PREREQUISITE

CE Plus cannot begin until you hold a valid Cyber Essentials certificate. You complete the CE self-assessment questionnaire first, receive your CE basic certificate, and then the technical audit follows. Once CE basic is certified, you have 90 days (3 months) to complete and pass CE Plus.

Most organisations complete both stages as part of the same engagement. At Vincent Cyber Defence, we run CE basic first and then move straight into CE Plus preparation while the 90-day window is generous.

HOW THE AUDIT IS CONDUCTED

The entire CE Plus audit is conducted remotely. No on-site visit is required. Here is what happens step by step:

1. Scoping and Scheduling

Before the audit day, your assessor confirms the scope of the assessment - the devices, cloud services, and internet-facing systems that will be tested. This should already be defined from your CE basic questionnaire. The assessor then schedules the audit and tells you what to have ready.

• A list of all in-scope devices by operating system type
• Details of cloud services in use (Microsoft 365, Google Workspace, SaaS platforms)
• Your internet-facing IP addresses and domains
• Screen sharing available via Microsoft Teams, Google Meet, or similar
• Someone available on the day to share their screen and navigate each device as directed

2. Device Sampling

The assessor selects a sample of devices based on each specific OS type and build (e.g., Windows 11 24H2, macOS Sequoia 15.4, iOS 18.3). The minimum sample size depends on how many devices share each OS version:

The sample is chosen by the assessor, not the client - you cannot pick which devices are tested. For example, if you have 30 devices running Windows 11 24H2 Pro and 5 running macOS Sequoia, the assessor would sample 4 Windows devices and 2 Macs from those groups.

3. Screen Share Session

On audit day, the assessor joins a screen share call - typically via Microsoft Teams or Google Meet. You will need someone on your side - usually an IT administrator or the person responsible for each device - to share their screen and navigate as the assessor directs.

The assessor works through each device methodically. They are not making changes - they are observing and recording the current state of your systems.

4. Device-Level Checks

On each sampled device, the assessor checks:

• Patch levels - operating system updates, browser versions, Office suite versions, and any other in-scope software checked against the 14-day rule (all critical and high-severity patches must be applied within 14 days of release)
• Endpoint protection - anti-virus or endpoint protection installed, actively running, signatures up to date, real-time scanning enabled
• User cannot disable AV - the assessor checks that standard users cannot turn off or bypass endpoint protection
• User account type - confirms the user is logged in with a standard account, not an admin account, for day-to-day work
• Software firewall - enabled and configured, particularly important for remote workers
• Unnecessary software - no end-of-life or unsupported software installed

5. Malicious Content Blocking

The assessor tests that your organisation can block malicious content before it reaches end users:

• Email filtering - the assessor checks that malicious attachments and suspicious links are blocked or quarantined. Microsoft Defender for Office 365, Google Workspace security, or equivalent must be active
• Executable blocking - executable file types (.exe, .bat, .vbs, script files) must be blocked or sandboxed in email
• Test file downloads - the assessor attempts to download simulated malicious executables (test files). If the download succeeds, it is a failure

6. MFA Verification

Under Danzell v3.3, MFA enforcement is verified technically across three areas:

• Cloud services - MFA must be enforced for all users on all cloud services in scope (Microsoft 365, Google Workspace, any SaaS platform). Not just admins - every user account
• Remote access - VPN, RDP gateways, and any other remote access mechanism must require MFA
• Admin accounts - all administrator accounts must have MFA, whether cloud or on-premises

The assessor typically checks MFA configuration in the admin console (e.g., Microsoft Entra ID conditional access policies) and may ask a user to demonstrate a login to confirm the MFA prompt appears.

7. External Vulnerability Scan

The assessor runs an external vulnerability scan against your internet-facing IP addresses and systems. This identifies:

• Unpatched services exposed to the internet
• Open ports that should be closed or restricted
• Misconfigured boundary devices
• Any critical or high-severity vulnerabilities on external-facing systems

Any critical or high-severity finding on an internet-facing system is an audit failure and must be remediated within the 30-day window.

8. Mobile Device Checks

If mobile devices (smartphones, tablets) are in scope - and they are if they access organisational data or email - the assessor checks:

• Device is not jailbroken or rooted
• OS and apps are up to date (same 14-day patching rule applies)
• Apps installed only from authorised stores (Apple App Store, Google Play, or managed catalogue)
• MDM compliance policies are applied and enforced (if using Intune, Jamf, or similar)

HOW LONG DOES THE AUDIT TAKE?

The technical audit itself typically takes between 2 and 8 hours depending on scope:

• Micro organisation (5-10 devices) - usually completed in a single morning, 2-3 hours
• Small organisation (10-30 devices) - typically half a day, 3-5 hours
• Medium organisation (30-100 devices) - usually a full day, 5-8 hours
• Larger organisations - may span more than one day depending on scope complexity

Results are usually confirmed within 3-5 business days of the audit completing. If everything passes, your CE Plus certificate is issued. If remediation is needed, your assessor will tell you exactly what needs fixing.

WHAT HAPPENS IF SOMETHING FAILS?

If the assessor identifies issues during the audit, you have 30 days from the date the assessment started to remediate them. Your assessor will provide a clear list of exactly what needs to be fixed.

After remediation, the assessor retests the original devices and selects a second independent sample to verify that fixes have been applied consistently across the entire estate - not just on the devices that were originally tested.

Both the 30-day remediation window and the 90-day window from your CE basic certification run simultaneously. Whichever expires first is the binding deadline.

MOST COMMON AUDIT FAILURES

Based on our experience as assessors, these are the issues we see most frequently:

1. Inconsistent patching - most devices are current but one or two have fallen behind. A single laptop with a 15-day-old critical patch will fail. The 14-day rule applies to OS, browsers, Office, plugins, and all other in-scope software.
2. MFA gaps - MFA enabled for most users but one account excluded from a conditional access policy, or a legacy protocol bypassing MFA. Every user on every cloud service must have MFA enforced.
3. MFA missing on remote access - VPN or RDP gateways without MFA. This is consistently one of the most common CE Plus failures.
4. Test file downloads not blocked - the assessor attempts to download simulated malicious executables. If the download succeeds, it fails the malicious content blocking check.
5. Admin accounts used for daily work - a user logged into an admin account for everyday email and browsing. Admin accounts must be separate and used only for administrative tasks.
6. End-of-life software - an old version of Java, an unsupported browser, or a legacy application on a single device.
7. Default accounts still enabled - particularly on network equipment such as routers, switches, and wireless access points.
8. Unmanaged mobile devices - personal phones accessing company email without being properly secured or managed.

HOW TO PREPARE FOR YOUR AUDIT

The best way to pass CE Plus is to go into the audit already knowing you will pass. Here is a practical preparation checklist:

Two Weeks Before

1. Run a full patch audit across all in-scope devices - check OS, browsers, Office, and third-party applications against the 14-day rule
2. Verify MFA is enforced on all cloud services for all users, all remote access, and all admin accounts
3. Run your own external vulnerability scan against your internet-facing IP addresses and remediate any high or critical findings
4. Check that endpoint protection is installed, active, up to date, and cannot be disabled by standard users on every device
5. Confirm admin account separation - no one should be using an admin account for daily email and browsing
6. Remove or isolate any end-of-life software from scope

One Week Before

8. Verify email filtering is blocking executable attachments and suspicious links
9. Test that malicious file downloads are blocked at the network or endpoint level
10. Check mobile devices in scope are up to date, not jailbroken, and using only authorised app stores
11. Ensure software firewalls are enabled on all devices, especially remote workers' laptops
12. Prepare your device list showing all in-scope devices by OS type

Day Before

14. Confirm screen sharing is set up and working (Microsoft Teams, Google Meet, or whatever your assessor uses)
15. Confirm someone is available on audit day to share their screen and navigate each device as directed
16. Run one final patch check - any critical patches released in the last 14 days must be applied
17. Check that all devices are powered on, connected, and accessible

For a detailed, interactive walkthrough of every item the assessor checks, use our free CE Plus readiness checklist - 25 items across all seven audit areas with a live progress score.

HOW VINCENT CYBER DEFENCE SUPPORTS YOU THROUGH THE AUDIT

At Vincent Cyber Defence, we do not just turn up on audit day and start testing. We work with you through the entire process - before, during, and after the assessment.

• Pre-Assessment Check included as standard - before your formal audit begins, we review your controls against every CE Plus requirement. Gaps are identified and resolved with you ahead of the assessment date, so you go in prepared - not surprised. Most certification bodies skip this step entirely.
• Guided CE basic submission - we support you through the Cyber Essentials self-assessment questionnaire, explaining each requirement and reviewing your draft responses before you submit. You complete and sign the declaration yourself, but you are not left to figure it out alone.
• Direct lead assessor throughout - you deal with one named assessor from first contact through to your certificate. No helpdesk, no account managers, no rotating contacts. The person who audits your systems is the person who answers your questions.
• Free rescan included - if issues are identified during the audit, one rescan to verify remediation is included in your fee at no extra charge. Most providers charge separately for this.
• Clear remediation guidance - if anything needs fixing, your assessor tells you exactly what, why, and how to resolve it. No vague findings - actionable steps you can hand to your IT team or provider.

The goal is straightforward: you should know you are going to pass before the audit begins. Our preparation process is specifically designed to make that happen.

COST AND PRICING

CE Plus pricing varies by organisation size because larger scopes require more assessor time. At Vincent Cyber Defence, our fixed pricing is:

All prices include the IASME certification fee. A Pre-Assessment Check is included as standard - we review your controls against CE Plus requirements before the audit begins, so gaps are fixed before the assessor starts. See our pricing page for full details.