The CE Plus audit is a hands-on technical assessment - not a questionnaire. Work through all seven control areas below and confirm each item is in place before your assessment date. Tick each item as you confirm it - your score updates as you go.
Tick each item below as you confirm it is in place for your organisation.
The auditor will verify that active malware protection is running on all in-scope devices. This is a live, technical check - not just a policy question. Anti-virus must be installed, active, and up to date on every device within scope on the day of assessment.
The audit checks that user and administrator accounts are properly separated, that no shared credentials are in use, and that privileged access is tightly controlled. This is verified against live system configurations.
The auditor will verify patch currency across operating systems, applications, and firmware. All high-risk and critical patches must be applied within 14 days of release. This is checked live against installed software versions during the audit.
Any mobile device - smartphone or tablet - used for work and within scope must be managed, secured, and running only software from authorised sources. Jailbroken or rooted devices are an automatic audit failure.
The audit includes technical tests to verify that malicious content - such as executable downloads and malware payloads - is blocked before it can reach end-user devices. test files are used. If your filtering does not block them, the audit will record a failure.
The auditor runs an authenticated and unauthenticated vulnerability scan against all internet-facing IP addresses within scope. High and critical vulnerabilities on external-facing systems will fail the audit. Run your own pre-assessment scan and address any findings before the assessment date.
MFA must be enabled on all cloud services for all users - not just administrators. Under Danzell v3.3 this is verified technically. Failure to enforce MFA where it is available is an automatic audit failure.
Our UK-based team will guide you through the audit process and confirm you're ready before booking your assessment date. No hidden charges - view pricing →
Don't yet have Cyber Essentials? CE Plus requires you to hold a valid Cyber Essentials basic certificate first - you have 90 days from CE basic certification to complete CE Plus. Use the CE basic readiness checklist →
This checklist is based on the CE Plus audit requirements under Cyber Essentials v3.3 (Danzell), effective April 2026. It is provided as a self-assessment guide only - formal certification requires an independent technical audit by an IASME Approved Certification Body. For questions about your readiness, contact our team.
The CE Plus audit covers seven technical control areas: anti-virus and endpoint protection, account separation and least privilege, patch management (14-day rule), mobile device security, malicious content blocking, external vulnerability scanning, and multi-factor authentication (MFA) on cloud services and remote access. Each area is tested live against your systems - it is not a questionnaire.
Yes. You must hold a valid Cyber Essentials basic certificate before undertaking CE Plus. You have 90 days from the date your CE certificate is issued to complete the CE Plus technical audit.
Cyber Essentials is a self-assessment questionnaire verified by a certification body. Cyber Essentials Plus is a hands-on technical audit where an assessor remotely connects to your systems and tests the controls directly - checking patch levels, running vulnerability scans, testing malware blocking, and verifying MFA is enforced across all in-scope services.
Common automatic fail triggers include: high or critical OS or application patches not applied within 14 days, MFA not enabled for all users on cloud services in scope, missing MFA on remote access connections, jailbroken or rooted mobile devices in scope, and malicious test files not being blocked at the network or endpoint level.
Work through all 25 items across the seven audit areas in the checklist above. Every item should be confirmed before you book your assessment date - each unchecked item is a potential audit failure. If you are unsure about any area, contact our team for a pre-assessment readiness review.
A CE Plus audit typically takes anywhere from a few hours to a couple of days depending on the size and complexity of your scope - the number of devices, cloud services, and internet-facing systems included. Smaller organisations with a simple IT setup can often complete the audit in a single session; larger or more complex scopes may require additional time across multiple sessions.
If your checklist is looking good, now is the time to book. Get your fixed-price CE Plus quote and we will guide you through every step of the audit.