# Cyber Essentials self-assessment and Cyber Essentials Plus How the self-assessment is signed off and marked, what the Plus audit actually tests, when it must happen, and when a buyer will want Plus. Source: https://sted.digital/docs/standards/cyber-essentials/self-assessment-vs-plus · Last reviewed 17 October 2026 · Strand Standards and regulations The Cyber Essentials self-assessment is an online questionnaire about your scope and the five controls, signed off by a board member and marked by an assessor. Cyber Essentials Plus tests the same controls within three months: an assessor scans your systems and sample devices, tries malware test files, and checks multi-factor authentication and administrator separation. ## The requirement in plain English Both levels share one set of requirements: version 3.3 of the NCSC's *Requirements for IT Infrastructure* for applications started on or after 27 April 2026. What differs is how you prove you meet them. ### The self-assessment You answer IASME's question set online: who you are, what your scope is, and how each of the five controls is met across it. A board member or equivalent signs off the answers as true. An assessor from a [certification body](/docs/glossary/certification-body) then marks them against the requirements, and a pass gives you a certificate valid for 12 months. ### Cyber Essentials Plus Plus starts from a passed self-assessment and must be completed within three months of that certificate. Before testing, the assessor gets your written permission, confirms by technical means that the Plus scope matches the self-assessment, and checks that any excluded sub-set really is separated. The tests follow the NCSC's *Cyber Essentials Plus Test Specification*, version 3.2 of April 2025, which is the version the NCSC lists in October 2026: - **Cyber Essentials Plus, firewalls.** A remote vulnerability scan of every internet address you use, including cloud servers, looking for services an unskilled attacker could break into. - **Cyber Essentials Plus, security update management.** An authenticated scan of sampled laptops, desktops, servers and cloud servers. Any critical or high-risk fix available for more than 14 days fails it. - **Cyber Essentials Plus, malware protection.** Test files sent by email and downloaded through a browser on sampled devices: known malware must be blocked, and test programs must not run without a warning. Devices that use allow-listing are checked for unsigned code instead. - **Cyber Essentials Plus, user access control.** A sign-in to each cloud service from an untrusted device or private browser window, as an ordinary user and as an administrator, must ask for a second factor. Separately, an ordinary account on each sampled device tries an administrative task and must be refused without a separate sign-in. Every test must pass, with one exception: the delivery partner may allow a pass where the deviations are marginal, under 5% of tests, and show no wider failure. ### When a buyer wants Plus The base certificate is what most contracts ask for. Government guidance (Procurement Policy Note 014, February 2025) tells buyers to ask for Plus where the cyber risk of a contract is higher. In practice Plus is most often asked for by buyers who hold sensitive data at volume, by NHS and digital health customers, and by enterprises whose own auditors sample their suppliers. If a tender names Plus, a self-assessment certificate alone will not meet it. This is guidance to help you understand the requirement, not legal advice. ## What good looks like A 40-person software company selling to NHS trusts decides on Plus because its biggest customer asks for it. - **Timing.** It books the Plus assessor for four weeks after the self-assessment certificate, leaving two months of the window for fixes and a retest. - **Dry run.** A month before, the IT lead runs the company's own vulnerability scan of its public addresses and an authenticated scan of three laptops, one from each build, and fixes everything older than 14 days. - **Malware check.** It emails itself a harmless industry test file and confirms the mail filter and the laptops block it. - **Cloud sign-in check.** For each cloud service it signs in from a private browser window as a normal user and as an admin, and confirms the second-factor prompt. - **Admin separation.** No daily account has local admin; the two admins use separate accounts. - **Records.** It keeps the assessor's report with the certificate, raises an action for each advisory note, and records the outcome and the scope in its annual management review. ## Evidence an auditor expects - **Signed self-assessment answers**: required. The assessor checks the board-level sign-off and that answers match the scope. - **Self-assessment certificate**: required for Plus, dated within the window, with the scope the Plus audit must match. - **Written permission to test**: required before Plus testing starts. - **List of internet addresses and cloud services**: required for Plus in practice; the external scan and the sign-in tests run from it. - **Device inventory by type and build**: usual. The assessor uses it to choose a representative sample, and must keep a record of how the sample size was worked out. - **Test accounts**: at least one ordinary and one administrator account for every cloud service tested. - **Plus report**: kept by you as [evidence](/docs/glossary/evidence) for customers; the certification body keeps its own records for the life of the certificate. ## Common mistakes ### Answering the self-assessment as policy, not practice The self-assessment asks what is true today, and a board member signs that it is. Answers that describe what the policy says, rather than what the devices do, pass marking and then fail the Plus scan. Check a sample of devices before you answer, not after. ### Booking Plus at the end of the window The three-month clock starts at the self-assessment certificate. Booking in the final week leaves no time to fix a failed test and be retested, and missing the window means starting again with a new self-assessment. ### The one laptop that is not like the others The sample is meant to be representative, so the assessor will pick the odd one out: the developer's personal build, the old reception PC, the contractor's loaned laptop. Bring every build up to standard, not just the standard build. ### Forgetting a cloud service in the sign-in test Each cloud service in scope is tested for multi-factor authentication, for both an ordinary user and an administrator. A service that signs in through your main identity provider is covered once; one with its own separate sign-in is tested on its own and is where failures cluster. ### Treating Plus as a penetration test Plus is a fixed, repeatable check of five controls. It does not test your application, your business logic or a determined attacker. A customer who asks for a penetration test wants a separate engagement, and a Plus certificate does not answer that request. ## How Sted helps Sted treats Cyber Essentials as required when the NHS Digital Technology Assessment Criteria apply to you, as committed when you hold or pursue it or a customer requires it, as strongly indicated when you sell to the UK public sector, and as recommended when Sted's benefit assessment says so; whether you need Plus is a later question. The Management Review Record (REC-MRR) is the one record template in Sted's knowledge base tagged to Cyber Essentials Plus; its specialist reviews include the scope of your Cyber Essentials Plus certification. Records are part of the Full Management System plan. Sted's knowledge base maps record templates to each Cyber Essentials control: the Network Security Configuration Record (REC-NSC) and Network Rule Review Record (REC-NRR) to firewalls; the Configuration Baseline Record (REC-CBR) and Approved End-User Technology Record (REC-AET) to secure configuration; the Vulnerability Record (REC-TIV) and Technical Assurance Test Record (REC-TAT) to security update management; the Access Review Record (REC-ARR), Authentication Configuration Record (REC-ACR) and Credential Issuance and Reset Record (REC-CIR) to user access control; and the Malware Protection Configuration Record (REC-MPR) and Malware Protection Review Record (REC-MPRR) to malware protection. Records are part of the Full Management System plan. Sted does not run penetration tests or scans; it records the result and tracks the actions. Sted does not mark or sign off the self-assessment and does not carry out the Plus tests. An assessor tests your systems; Sted holds the records you show them. ## Related guides and terms - [Cyber Essentials](/docs/standards/cyber-essentials): the scheme, its editions, cost and certification route. - [The five Cyber Essentials technical controls](/docs/standards/cyber-essentials/five-technical-controls): the requirements both levels are checked against. - [Cyber Essentials scope](/docs/standards/cyber-essentials/scope): the boundary the Plus audit verifies before it tests. - [The management review guide](/docs/guides/management-review): where the Plus outcome and scope are reviewed each year. - [Certification body](/docs/glossary/certification-body): who marks the self-assessment and carries out the Plus audit. ## Frequently asked questions Q: Do I need Cyber Essentials before Cyber Essentials Plus? A: Yes. Plus tests the controls you declared in a passed self-assessment, on the same scope, so the self-assessment certificate comes first. The Plus audit then has to be completed within three months of it. Q: Is Cyber Essentials Plus a penetration test? A: No. It is a fixed set of five tests against the five controls: an external scan, an authenticated scan of sample devices, malware test files, a multi-factor authentication check and an account separation check. A customer who asks for a penetration test wants something broader, run against your own systems and threats. Q: What happens if I fail part of the Plus audit? A: The assessor records each failed test in a report. If the failures are a few marginal deviations, under 5% of the tests performed, and point to no wider weakness, the delivery partner may still allow a pass. Otherwise no Plus certificate is issued and you fix the gaps and arrange retesting with your certification body.