Does Cyber Essentials Plus Require a Penetration Test? No. Cyber Essentials Plus does not require a penetration test. It requires an independent, hands-on technical assessment of the five Cyber Essentials controls, carried out by a certification body, and that assessment includes vulnerability scanning. But a scheme vulnerability scan is not a penetration test, and the two are often confused.

It’s one of the most common misunderstandings we come across. Businesses arrive convinced they need to commission (and pay for) a full penetration test to get certified, when the certification body already carries out the technical checks the scheme demands. Below, we explain what Cyber Essentials Plus actually assesses, why the confusion happens, and when a penetration test is genuinely worth doing alongside it.

What is Cyber Essentials Plus?

Cyber Essentials is a UK government-backed certification scheme, created by the National Cyber Security Centre and administered by IASME. It sets a baseline of protection against the most common internet-based attacks, and it’s built around five technical controls:

1. Firewalls
2. Secure configuration
3. Security update management (patching)
4. User access control
5. Malware protection

There are two levels. Cyber Essentials (the basic level) is a self-assessment: you complete a questionnaire, a senior person in the business signs it off, and a qualified assessor reviews your answers. There’s no scan and no hands-on testing at this level.

Cyber Essentials Plus covers the same five controls, but adds an independent, hands-on technical assessment to verify that what you declared is actually true. To be eligible for Plus, you first need to pass the basic self-assessment, and the scheme expects you to complete the Plus assessment within 90 days of that.

What the Cyber Essentials Plus assessment actually involves

This is the part people mistake for a penetration test. During the Plus assessment, a certification body carries out a set of practical checks on your in-scope systems, typically including:

• An external vulnerability scan of your internet-facing systems, to check for known, unpatched weaknesses an attacker could reach from outside.
• An internal, authenticated vulnerability scan on a representative sample of your devices, to confirm they’re patched, securely configured and free of known high-risk vulnerabilities.
• Malware protection tests, such as sending test files by email and attempting to download them through a browser, to prove your defences block malicious content.
• Checks on user access and multi-factor authentication, confirming that accounts, admin rights and MFA are set up the way the scheme requires.

It’s a thorough, evidence-based audit of a defined set of controls, at a single point in time. What it is not is an attempt to break into your systems the way a real attacker would.

So where does the confusion come from?

The mix-up almost always comes down to that word “scan”. Because a Cyber Essentials Plus assessment involves a technical specialist scanning your systems and reporting on vulnerabilities, it looks, from the outside, a lot like a penetration test. Add to that the fact that many providers offer both services, and it’s easy to assume they’re the same purchase.

They aren’t. A vulnerability scan and a penetration test answer different questions, and understanding the difference is the key to knowing what you actually need.

Does that mean you don’t need a penetration test at all?

Not quite, and this is where it pays to be honest rather than just reassuring.

Cyber Essentials Plus is a strong, worthwhile baseline, and passing it genuinely reduces your exposure to the commodity attacks that make up the bulk of cyber crime. But it is a baseline. By design, it doesn’t look at:

• Web application and API vulnerabilities beyond the sampled scan
• Business-logic flaws, such as manipulating prices, permissions or workflows
• Complex cloud misconfigurations and over-permissive access
• How far an attacker could move once inside your network
• Bespoke systems and integrations outside the standard control set

If you handle sensitive data, run customer-facing applications, or operate in a sector where a breach would be serious, those gaps matter. A penetration test is the tool that addresses them. It isn’t required for the certificate, but it’s often required for real-world security, and for the other obligations you’re likely juggling. Frameworks such as ISO 27001, standards like SOC 2, and increasingly your cyber insurer, all expect a level of testing that goes beyond the Cyber Essentials baseline.

So the accurate way to think about it is this: Cyber Essentials Plus and penetration testing are complementary, not alternatives.

How penetration testing and Cyber Essentials Plus work together

Used together, they reinforce each other, and a bit of sequencing makes life easier:

Test before you certify. A penetration test (or at least a readiness review) ahead of your Plus assessment surfaces the unpatched systems, weak configurations and access issues that would otherwise fail you, so you can fix them and pass first time. Reassessments and re-bookings cost time and money, and a failed Plus assessment can hold up a tender or a contract.

Go deeper once the baseline is in place. Once Cyber Essentials Plus confirms your fundamentals are sound, penetration testing takes over where the scheme stops, examining your applications, cloud and network the way an attacker would.

Get more from one piece of work. A good penetration test report doesn’t just help your security, it provides evidence you can reuse for ISO 27001, SOC 2, cyber insurance applications and customer security reviews. One engagement, several boxes ticked.

How to prepare for Cyber Essentials Plus

Whether or not you commission separate testing, a few things make the Plus assessment far smoother:

• Get your scope right. Build an accurate inventory of the devices, networks, cloud services and remote-working setups that fall in scope. Most avoidable failures start with a vague or incorrect scope.
• Patch, and keep patching. Missing security updates are one of the most common reasons organisations fail. Make sure high-risk patches are applied within the scheme’s timeframes.
• Turn on MFA everywhere it’s expected, especially for cloud services, email and administrative accounts.
• Remove unsupported software. Anything no longer receiving security updates is a likely fail.
• Do a readiness review. A short pre-assessment gives you time to fix gaps before the certification date, rather than discovering them on the day.