Does Cyber Essentials Plus require a penetration test?
No. Cyber Essentials Plus doesn’t require a penetration test, and the Plus audit isn’t one. The audit is a hands-on technical check that the five Cyber Essentials controls you declared are actually working on a sample of your devices: an external vulnerability assessment, authenticated scans of sampled devices, a check that multi-factor authentication is enforced, malware protection tests and a review of admin accounts. A penetration test goes further. A tester tries to exploit weaknesses, chain them together and show what an attacker could reach.
Layer 7 does both. We carry out Cyber Essentials Plus audits as a certification body and run penetration tests as a CREST-accredited company, so we see the confusion from both sides. Some organisations book a penetration test thinking it’s what Plus needs. Others assume their Plus certificate means they’ve been penetration tested. Neither is right, and the difference matters when a customer or contract asks for one specifically.
What the Cyber Essentials Plus audit tests
Plus assesses the same five controls as basic Cyber Essentials: firewalls, secure configuration, security update management, user access control and malware protection. The difference is that an assessor verifies them on your live systems rather than relying on your answers. The audit covers:
- A remote vulnerability assessment of your external infrastructure, looking for vulnerabilities and internet-facing services.
- An authenticated vulnerability scan of a sample of in-scope devices, looking for missing patches and risky configuration.
- A check that multi-factor authentication is enforced on every cloud service that supports it.
- A malware protection test, including how your systems handle test files and malicious content arriving by email and web.
- A review of user accounts and administrative rights, to check admin access is separated from everyday accounts.
The assessor samples across each operating system and device type in your scope. The pass mark is the scheme’s: for example, critical and high-severity updates applied within 14 days. Our Cyber Essentials Plus audit checklist goes through every control.
What the audit doesn’t do is try to break in. It checks the controls are present and working. It doesn’t try to exploit a finding to see how far it goes.
What a penetration test adds
A penetration test starts where the audit stops. A tester:
- exploits weaknesses to prove they’re real, not just flagged by a tool
- chains smaller issues together, which is how most real attacks work
- tests business logic in your applications, such as whether one user can see another user’s data
- tests what you built, such as web applications, APIs and cloud configuration, which the Plus audit doesn’t examine in depth
- reports what an attacker could actually reach, ranked by real risk
| Cyber Essentials Plus audit | Penetration test | |
|---|---|---|
| Question it answers | Are the five baseline controls working? | What could an attacker actually do? |
| Scope | Set by the scheme: a sample of your in-scope devices and services | Agreed with you: the systems that matter to you |
| Method | Vulnerability scanning and control tests against a fixed specification | Manual testing and exploitation by a qualified tester |
| Applications | Not tested in depth | Web, API and mobile testing as scoped |
| Outcome | Pass or fail, and a certificate valid for 12 months | A risk-ranked report with evidence and fixes |
| Who sets the standard | The NCSC and IASME | The tester’s methodology, agreed in scope |
When you need both
You need both when someone asks for both. That sounds obvious, but it’s the case we see most:
- A customer or contract asks for a penetration test. A Plus certificate doesn’t meet that requirement. The audit isn’t a penetration test, and calling it one would mislead your customer.
- A contract asks for Cyber Essentials Plus. A penetration test report doesn’t meet that either. Only a certificate from a licensed certification body does.
- You run applications your customers use. The Plus audit doesn’t test your web application or API in depth. If those hold customer data, a penetration test is the way to find out how they’d stand up to an attack.
If nobody has asked for a penetration test and you’re working towards Plus, start with Plus. It’s the scheme’s baseline, it’s priced by organisation size, and it shows you where the basics are weak.
Does a penetration test help you pass Plus?
It can, but it’s not needed. If you’ve had a recent penetration test and fixed what it found, the common Plus failures (missing patches, MFA gaps, admin rights) will often already be closed. But a penetration test isn’t designed around the Plus specification. The fastest way to prepare for the audit is to work through the audit checklist itself.
Getting both from one team
Layer 7 has been an IASME Cyber Essentials Certification Body since 2014, and is CREST accredited for penetration testing and vulnerability assessment. Our own testers carry out the Plus audit and the penetration test, so there’s no hand-off between a certification body and a separate testing firm.
Cyber Essentials Plus with basic Cyber Essentials costs from £1,120 + VAT, or from £920 + VAT if you’re already certified at basic level. A focused web application or infrastructure penetration test typically starts from £5,000 + VAT, with a free retest included. For the difference between the two certification levels, read Cyber Essentials vs Cyber Essentials Plus.