CYBER ESSENTIALS PLUS REQUIREMENTS: WHAT YOU NEED TO PASS IN 2026

WHAT IS CYBER ESSENTIALS PLUS?

Cyber Essentials Plus is the higher level of the UK government-backed Cyber Essentials scheme. While standard Cyber Essentials is a self-assessed questionnaire, CE Plus adds an independent technical audit carried out by an IASME-approved assessor. The assessor actively tests your systems to verify that the five security controls are correctly implemented - not just documented on a form.

CE Plus is assessed under the Danzell v3.3 standard (current as of 2026). The same five controls apply as standard CE, but the bar for evidence is significantly higher: an assessor is remotely testing your actual devices, network, and configuration rather than reviewing written answers.

THE PREREQUISITE: STANDARD CYBER ESSENTIALS FIRST

You must hold a valid Cyber Essentials certificate before the CE Plus audit can begin. Once your CE basic is certified, you have 90 days (3 months) to complete and pass CE Plus. If the 90-day window expires without a pass, your Plus application closes and you need to re-certify at CE basic level before restarting - incurring an additional cost.

In practice, most organisations complete both as part of the same engagement. We run the CE self-assessment first, then move straight into CE Plus preparation while the 90-day clock is generous.

THE FIVE CONTROLS ASSESSED

CE Plus tests the same five controls as standard Cyber Essentials. The difference is that an assessor independently verifies each one through hands-on technical testing rather than reviewing your written answers.

1. Firewalls and Internet Gateways

Your boundary devices must be configured to restrict both inbound and outbound traffic to only what is necessary. The assessor conducts an external vulnerability scan of your internet-facing systems to check for:

• Open ports that should be closed or restricted
• Unnecessary services exposed to the internet
• Default or weak configurations on boundary devices
• Software firewalls enabled on all in-scope devices (including laptops used outside the office)

Personal firewalls on individual devices are also checked - particularly for remote and hybrid workers whose devices connect directly to the internet without a corporate boundary firewall.

2. Secure Configuration

Devices must be configured securely with unnecessary software, accounts, and services removed or disabled. The assessor checks sampled devices for:

• Default accounts removed or disabled (including default admin passwords on network equipment)
• Unnecessary software uninstalled
• Auto-run and auto-play disabled
• Password or biometric authentication required to unlock devices

This control catches organisations that have a hardening policy but haven't applied it consistently across all devices.

3. User Access Control

User accounts must follow the principle of least privilege. The assessor verifies:

• Standard user accounts are used for day-to-day work (not admin accounts)
• Admin accounts are used only for administrative tasks
• Each user has a unique account - no shared credentials
• Default or unnecessary accounts are removed or disabled
• MFA is enforced on all cloud services, remote access, and admin accounts

The MFA requirement under Danzell v3.3 is one of the most common failure points. Multi-factor authentication must be active on:

• All cloud service accounts (Microsoft 365, Google Workspace, any SaaS)
• All remote access to organisational resources (VPN, RDP, remote desktop gateways)
• All administrator accounts - cloud and on-premises

The second factor must be independent of the device being used to authenticate. SMS codes, authenticator apps, hardware tokens, and passkeys all qualify.

4. Malware Protection

Anti-malware must be active on all in-scope devices with automatic updates enabled. The assessor tests this by:

• Checking that endpoint protection is installed, running, and up to date on every sampled device
• Running a safe simulated malware test (typically an EICAR test file) to verify protection is actively blocking threats
• Verifying that automatic signature updates are enabled and current
• Confirming that standard users cannot disable or bypass AV protection - user-disabled AV is an audit failure
• Checking that real-time / on-access scanning is enabled, not passive or monitoring-only mode

Malicious Content Blocking

As part of the malware protection assessment, the auditor also tests that malicious content is blocked before it reaches end-user devices:

• Email filtering must block or quarantine emails containing malicious attachments and suspicious links
• Executable file types (.exe, .bat, .vbs, script files) must be blocked or sandboxed in email - users should not be able to receive and run arbitrary executables
• The auditor will attempt to download test files (simulated malicious executables) during the assessment - if the download succeeds, it is a failure

On mobile devices, this means the device must not be jailbroken or rooted, must not have developer mode enabled, and apps must be installed only from authorised stores (Apple App Store, Google Play Store, or a managed enterprise catalogue). Sideloaded apps bypass security vetting and will be flagged.

5. Patch Management

This is the control that causes the most failures. The requirement is straightforward but unforgiving:

• Operating system patches (Windows, macOS, Linux, iOS, Android) within 14 days
• Browser patches (Chrome, Edge, Firefox, Safari) within 14 days
• Office suite patches within 14 days
• Any other in-scope software with critical or high-severity CVEs within 14 days
• Unsupported (end-of-life) software must be removed or isolated from scope

The assessor checks the actual patch level on every sampled device during the audit. If a critical patch was released 15 days ago and one sampled laptop hasn't applied it, that device fails - and if the issue appears in the second sample too, the entire assessment fails.

DEVICE SAMPLING: HOW THE AUDIT WORKS

The assessor selects a sample of devices based on each specific OS type and build (e.g., Windows 11 24H2, macOS Sequoia 15.4). The minimum sample size depends on how many devices share each OS version: 1 device = 1 sampled, 2-5 = 2 sampled, 6-19 = 3 sampled, 20-60 = 4 sampled, 61+ = 5 sampled. The sample is chosen by the assessor, not the client.

Devices in scope include:

• Laptops and desktops
• Servers (including cloud-hosted)
• Mobile phones and tablets that access organisational data
• Virtual machines
• Network equipment (firewalls, switches, access points)

The Second Sample Rule

If vulnerabilities are found in the initial sample and remediation is required, the assessor retests the original devices and selects a second independent sample to verify fixes have been applied consistently across the entire estate. If unresolved vulnerabilities appear in the second sample:

• The CE Plus assessment fails automatically
• Your underlying CE basic certificate is revoked
• You must re-certify at CE basic level before restarting CE Plus

This is why consistent patching across your entire estate matters - not just the devices you expect to be tested.

WHAT ABOUT CLOUD AND MICROSOFT 365?

Cloud environments are assessed where they fall in scope. For most organisations using Microsoft 365, this means the assessor checks:

• MFA enforcement across all user and admin accounts
• Conditional access policies (if using Azure AD / Entra ID)
• Admin account separation (dedicated admin accounts, not used for daily email)
• Security defaults or equivalent configuration enabled
• Guest and external sharing policies configured appropriately

Intune-managed environments are assessed for compliance policy enforcement - the assessor checks that policies are applied and enforced, not just configured.

REMOTE WORKERS

Remote and hybrid workers are included wherever they form part of your operational environment. Their devices are treated as in-scope and may be selected as part of the device sample. Key requirements for remote devices:

• Software firewall enabled and configured
• Full disk encryption active
• Patching current (same 14-day rule applies)
• VPN or equivalent secure access with MFA
• Endpoint protection installed and up to date

COMMON FAILURE POINTS

Based on our experience as assessors, these are the issues that most frequently cause problems during CE Plus audits:

1. Inconsistent patching - most devices are up to date but one or two are behind. The 14-day rule is absolute and applies to OS, browsers, Office, and all other in-scope software.
2. MFA not enforced on all required accounts - often missed on a secondary admin account, a service account with interactive logon, or a single user excluded from a conditional access policy. Every user on every cloud service must have MFA.
3. MFA missing on remote access - VPN or RDP gateways without MFA enabled. This is one of the most common CE Plus failures.
4. Test file downloads not blocked - the auditor attempts to download simulated malicious files. If the download succeeds, it is a failure.
5. End-of-life software still installed - an old version of Java, Flash, or an unsupported OS on a single device.
6. Default accounts still enabled - particularly on network equipment like routers and access points.
7. Mobile devices not managed - personal phones accessing company email without a screen lock, up-to-date OS, or with sideloaded apps.
8. Admin accounts used for daily work - users logged into their admin account for email and browsing.

TIMELINES AND WINDOWS

Two deadlines run simultaneously once your CE basic is certified:

• 90-day window: from your CE basic certification date to complete and pass CE Plus
• 30-day remediation window: from the date the CE Plus assessment started, if issues are found

Whichever expires first is the binding deadline. If either window closes before you pass, your CE Plus application ends and you restart from CE basic.

The technical audit itself typically takes a few hours to a day depending on scope. Results are usually confirmed within 3-5 business days. The full CE Plus process - including CE basic and preparation - usually takes one to three weeks.

PREPARATION CHECKLIST

Before your CE Plus audit, confirm the following is in place across your entire estate - not just the devices you expect to be sampled. These align to the seven areas tested during the audit:

1. AV/endpoint protection installed, actively running, and auto-updating on all in-scope devices
2. Real-time scanning enabled - not passive or monitoring-only mode
3. Standard users cannot disable or bypass AV protection
4. Unique individual accounts for every user - no shared logins
5. Separate admin accounts for admin tasks - not used for daily email and browsing
6. Least privilege applied across all user accounts
7. All critical and high-severity patches applied within 14 days - OS, browsers, Office, plugins, firmware
8. No end-of-life or unsupported software in scope
9. Mobile devices up to date, screen-locked, not jailbroken or rooted
10. Mobile apps installed only from authorised stores (App Store, Google Play, or managed catalogue)
11. Email filtering blocks malicious attachments, executable file types, and suspicious links
12. Test file downloads blocked at network or endpoint level
13. External vulnerability scan run - no high or critical findings on internet-facing systems
14. Unnecessary open ports and exposed admin panels closed or restricted
15. Remote access (VPN, RDP) not exposed without MFA
16. MFA enforced on all cloud services for all users - not just admins
17. MFA enforced on all remote access connections
18. MFA enforced on all administrator accounts
19. Software firewalls enabled on all laptops and desktops
20. Default accounts removed or disabled on all devices and network equipment

For the full detailed walkthrough, use our free interactive CE Plus readiness checklist - 25 items across all seven audit areas with a live progress score.

HOW VINCENT CYBER DEFENCE HELPS YOU MEET THESE REQUIREMENTS

Meeting CE Plus requirements is not just about knowing what the controls are - it is about having them correctly implemented and verified before the assessor arrives. At Vincent Cyber Defence, we work with you through the entire process.

• Pre-Assessment Check included as standard - before the formal audit, we review your controls against every CE Plus requirement listed above. Gaps are identified and resolved with you ahead of the assessment date - so you go in prepared, not surprised. Most certification bodies skip this step.
• Guided CE basic submission - we support you through the Cyber Essentials self-assessment questionnaire, explaining each requirement and reviewing your responses before submission. You complete and sign the declaration yourself, but you are not left to work it out alone.
• Direct lead assessor throughout - you deal with one named assessor from first contact through to your certificate. No helpdesk, no account managers, no rotating contacts. The person who audits your systems is the person who answers your questions.
• Free rescan included - if issues are found during the audit, one rescan to verify remediation is included at no extra charge. Most providers charge separately for this.
• Clear remediation guidance - if anything needs fixing, your assessor provides specific, actionable steps - not vague findings. You can hand these directly to your IT team or provider.

Our goal is simple: by the time the formal audit begins, you should already know you are going to pass.