Cyber Essentials Plus Readiness
Cyber Essentials Plus is an independent audit of the same controls as Cyber Essentials. This log book covers the self-assessment and every test the assessor will run, so nothing on audit day is a surprise.
- All 7 Plus tests
- 2026 retest rules
- Stays in your browser
Open a log book
Files saved from this tool, or from the earlier version of our Cyber Essentials log book, can be imported.
In this browser
What the assessor tests
- External vulnerability scan of your internet-facing addresses.
- Patching: an authenticated scan of a sample of devices for missing critical and high-risk updates.
- Malware protection on sampled devices.
- Malware by email: test attachments must be blocked or unable to run.
- Malware through websites: test downloads must be blocked or unable to run.
- Multi-factor authentication on your cloud services.
- Account separation: everyday accounts mustn't have admin rights.
New for 2026
- Your self-assessment must be finalised before testing starts, and can't be changed in response to what the audit finds.
- If the patching test fails, the retest covers the original devices plus a new random sample. Failing the retest revokes your Cyber Essentials certificate.
- Missing cloud MFA and updates older than 14 days are automatic fails in the self-assessment too.
- The Plus audit must be finished within 3 months of your Cyber Essentials certificate.
How is the device sample chosen?
The assessor picks devices at random from each type and operating system version you declared, so every device must pass, not just a few you prepare. Cloud services are checked for MFA one by one.
Should I record passwords for the assessor here?
No. Never put passwords in this log book. Agree test accounts with the assessor and share credentials securely on the day.
Can I start from my Cyber Essentials log book?
Yes: on that tool, use "Download file", then import the file here. Your self-assessment answers carry over, and the Plus sections are added.