Cyber Essentials Plus Isn't a Pen Test: What Each One Checks

We issue Cyber Essentials and Cyber Essentials Plus certificates and we sell penetration tests, so I’m happy to sell you either. What I don’t want to sell you is one when you needed the other, and that mix-up is common.

It usually goes like this. A customer’s security questionnaire asks when you last had a pen test. Someone attaches the CE Plus certificate, because there was an assessor, a scan and a report, and that felt like a test. Sometimes it gets through. Sometimes the customer’s security team writes back.

It’s an easy mistake to make, and the NCSC’s own test specification shows where the two part ways.

What a CE Plus audit tests

The CE Plus audit follows the NCSC’s Cyber Essentials Plus Test Specification. There are five test cases.

1. A remote vulnerability assessment of your internet-facing IP addresses. The spec says the aim is to find out whether “an Internet-based opportunist attacker can hack into the Applicant’s system with typical low-skill methods”.
2. An authenticated vulnerability scan of a sample of your devices. You fail if a fix for a high or critical vulnerability (or anything scoring 7 or more on CVSS v3) has been out for more than 14 days and isn’t installed.
3. A malware check, including test files delivered by email and through the browser.
4. An MFA check: at least one normal user and one admin login for every cloud service you use.
5. An account separation check: everyday user accounts shouldn’t have admin rights.

The sample is small by design. IASME’s sampling guidance sets a minimum for each operating system build: one device if you only have one, rising to five once you have 61 or more. The assessor picks them, not you.

That’s a decent check of the basics, scored pass or fail against a fixed standard. The threat it’s built around is narrow on purpose. The NCSC describes Cyber Essentials as “aligned to a very specific risk scenario: an attacker sitting on the Internet using ‘commodity capability’”. The government’s procurement note on the scheme, PPN 014, puts it more bluntly: the scheme “is not designed to address more advanced, targeted attacks.”

What changed in April

The scheme got stricter this year. Under the new question set (Danzell) and version 3.3 of the requirements, which apply to assessment accounts opened from late April 2026, three answers fail you outright:

• No MFA on a cloud service where it’s available, “whether it is free, included, or a paid option”.
• Question A6.4: high-risk or critical updates for operating systems and router and firewall firmware not installed within 14 days of release.
• Question A6.5: the same for applications, including their files and extensions.

Cloud services can’t be left out of scope any more either. If you opened your account before the change, IASME gave you six months to certify on the old questions. Six months from late April is about now, so your next CE Plus will be under the new rules.

I’m glad of all of it. The bar is higher than it was, but it’s the same kind of bar.

What a penetration test does that CE Plus doesn’t

The NCSC describes a pen test as an attempt “to breach some or all of that system’s security, using the same tools and techniques as an adversary might.” A CE Plus assessor checks that controls are in place. A pen tester assumes something has been missed, goes looking for it, and then sees how far it gets them. That’s why a CE Plus audit doesn’t look at:

• Your web application. Nobody on a CE Plus audit logs in as one customer and tries to read another customer’s records, or skips a step in your checkout to see what happens.
• What one compromised laptop leads to. CE Plus checks that users aren’t admins. It doesn’t check whether a standard user on your network can work their way to domain admin through a badly configured service account or a password left in a file share.
• Anything outside the sample. The laptop everyone forgot about is rarely the one the assessor picks.
• Findings below the line. The patch test fails on high and critical issues. Two medium findings chained together can get an attacker further than either rating suggests, and neither fails CE Plus.

I don’t count any of that against the scheme, which does what it says. The trouble starts when a certificate gets sent in answer to a question it was never meant to answer.

Which one do you need?

Start with who’s asking.

• If a contract asks for Cyber Essentials Plus, you need the certificate, and a pen test report won’t stand in for it. Central government departments and NHS bodies follow PPN 014 when deciding whether to ask for it.
• If a customer, auditor or tender asks for a pen test, a CE Plus certificate isn’t one. Send it as well if you have it, but they asked a different question.
• If you supply the NHS, it depends on your DSPT category. A valid CE Plus can take you out of assertion 9.2, and you may still need a test for DTAC. We covered that in DSPT 9.2 pen testing for NHS IT suppliers.
• If nobody’s asking and you want to know whether you’d hold up to a real attack, that’s a pen test. Start with whatever faces the internet and whatever holds customer data.

If you’re doing both this year, I’d book the pen test first. You fix what it finds before the CE Plus assessor runs their scans, and both reports read better for it. If you’re a legal aid firm, Cyber Essentials certification for legal aid firms covers why you need the certificate in the first place.

Not sure which one you’ve been asked for?

Send us what your customer or contract actually asked for, plus your current CE Plus scope if you have one. We’ll tell you whether the certificate covers it, and if it doesn’t, which test would.