Preparing for a Cyber Essentials Plus audit

A Cyber Essentials Plus audit tests whether the answers you gave in the questionnaire are true on your actual machines. Preparing for it is less about learning the requirements than about finding the machines where they quietly aren't met.

What the audit involves

The requirements are the same as Cyber Essentials. What's added is verification. An assessor typically:

scans your internet-facing systems for known vulnerabilities;
tests a sample of devices for missing updates older than fourteen days and for unsupported software;
tests malware protection by trying to deliver harmless test files by email and through a browser;
checks that MFA is enforced on cloud services and that admin and user accounts are separate.

Since April 2026, a second sample is taken to check that any fixes were applied across the estate, not just to the machines tested first. The audit has to be completed within three months of your Cyber Essentials certificate.

The weeks before

Have an accurate device list

The assessor samples from your estate. A list that's missing machines, or includes ones long gone, makes the sample harder to agree and undermines the questionnaire behind it.

Close the fourteen-day gaps on every machine

Not the machines you expect to be sampled — every machine. The assessor chooses the sample, and it tends to find the ones that are rarely used or rarely checked.

Remove unsupported software

An end-of-life operating system or application on a sampled machine is a failure. Check applications as well as the operating system.

Test your own malware protection

Make sure email filtering and endpoint protection block test files, and that browsers warn on malicious downloads, before the assessor tries.

Confirm MFA on every cloud service

For administrators and users, on every service that offers it — not just the main email platform.

Check admin separation

Administrators should have separate accounts for admin work and not use them for email or browsing.

On the day

Have someone available who can unlock sampled machines and provide access.
Make sure sampled laptops are on and connected, not in a drawer.
Have your device list and cloud service list to hand.
Note anything the assessor raises, with the machine and the date.

The audit is a sample; the requirement is the estate. Passing Plus says the sampled machines met the controls on the day. Keeping every machine in that state all year is what makes the next audit, and the certificate in between, mean something.

Quick answers

What does a Cyber Essentials Plus audit test?

Internet-facing vulnerabilities, a sample of devices for updates and unsupported software, malware protection, MFA on cloud services, and admin account separation.

How long after Cyber Essentials must Plus be done?

Within three months of the Cyber Essentials certificate.

Who chooses which devices are tested?

The assessor, and since April 2026 a second sample checks that fixes were applied across the estate.