Skip to content
Invadel

Compliance

Cyber Essentials Plus
Readiness Testing

Component tests from $4,200, free retest. See all pricing →

Get a fixed quote

Reply in one business day

Full scoping questionnaire 
Senior certified testers, manual-first185+ years combined experienceOnboarding within 24 hoursFree retest includedOur methodology

When you need it

When you need cyber essentials plus readiness testing

The situations that bring teams to this engagement, and where it fits alongside the rest of your program.

  • A UK public-sector contract, or a prime contractor bidding on one, requires Cyber Essentials Plus before award.
  • A UK customer’s security review lists Cyber Essentials Plus alongside ISO 27001 and SOC 2, and you hold neither yet.
  • You passed the self-assessed Cyber Essentials baseline and need the audited Plus level within the three-month window.
  • A previous Plus assessment failed on patching or configuration and you want the estate verified before the next audit.

Comparison

Cyber Essentials vs Cyber Essentials Plus vs ISO 27001

Cyber Essentials

What it is
A self-assessed questionnaire against five technical controls, verified by a certification body
Who audits
Your own answers, reviewed by an assessor
Effort
Days
Who asks for it
UK public-sector suppliers as a minimum
Our role
Guidance on the questionnaire

Cyber Essentials Plus

What it is
The same five controls, verified by an independent hands-on technical audit
Who audits
An IASME-licensed certification body, on your systems
Effort
Weeks, including remediation
Who asks for it
UK government and defense supply chains, UK enterprise customers
Our role
Readiness testing of every control, a free retest of failed checks, and the certification delivered through an IASME-licensed certification body

ISO 27001

What it is
A certified management system covering people, process, and technology, audited against Annex A
Who audits
An accredited certification body, over multiple audit stages
Effort
Months
Who asks for it
Enterprise customers worldwide, regulators, and partners
Our role
The penetration testing that evidences Annex A controls

For US companies

Can a US company get Cyber Essentials Plus? Yes, and here is how

Cyber Essentials is a UK National Cyber Security Centre scheme delivered through IASME and its licensed certification bodies, but certification is not restricted to UK organizations. US companies certify because a buyer requires it: UK central government contracts involving personal data or certain ICT services, Ministry of Defence supply-chain obligations that flow down through primes, and UK enterprise customers who treat it as a minimum bar.

The audit itself is performed remotely by the certification body, sampling devices and testing the boundary from the internet. Our readiness testing runs the same checks first, internal and external, on the same sample logic, so the audit finds what we already fixed. We deliver the certification end to end; the certificate is issued by the IASME-licensed certification body, as the scheme requires.

  • 1. Baseline. You complete the self-assessed Cyber Essentials questionnaire, which the certification body verifies.
  • 2. Readiness testing. We run the Plus checks internally and externally on a representative device sample and hand you a prioritized fix list.
  • 3. Fix and retest. Your team fixes what failed, and we retest it free.
  • 4. The Plus audit. The certification body runs the audit within three months of your Cyber Essentials certification and issues the Cyber Essentials Plus certificate.

The audit

How the Cyber Essentials Plus audit works

The certification body follows the NCSC’s Cyber Essentials Plus Test Specification. These are its five test cases, and our readiness testing runs each one first.

What the assessor checks

1. Remote vulnerability assessment
Your internet-facing IP addresses and services, scanned from outside for exposed weaknesses.
2. Patching
An authenticated vulnerability scan of the sampled devices, servers, and cloud instances. A vulnerability the vendor rates critical or high, or with a CVSS v3 base score of 7 or above, fails the test once its fix has been available for more than 14 days.
3. Malware protection
Test files sent by email and downloaded through the browser on each sampled device must be blocked, with anti-malware installed and running, or certificate-based application allow-listing verified instead.
4. Multi-factor authentication
Users sign in to each cloud service in scope, as users and as administrators, and MFA must be enforced.
5. Account separation
The accounts people use day to day cannot run administrative tasks without a separate admin login.

NCSC and IASME revise the specification with the requirements, so we test to the version your certification body will use.

What we assess

What your Cyber Essentials+ test covers

We run the independent, hands-on verification Cyber Essentials Plus requires across all five technical controls, formatted so your assessor can act on it directly.

Firewalls & Gateways

Whether your boundary firewalls are configured to block untrusted traffic.

We test for

  • Boundary firewall configuration
  • Default rule review
  • Exposed service testing
  • Remote access controls

Secure Configuration

Whether systems are hardened and free of unnecessary, exploitable defaults.

We test for

  • System hardening
  • Default account and password checks
  • Unnecessary services
  • Auto-run and software controls

Access Control

Whether user accounts and privileges are properly managed and restricted.

We test for

  • User account management
  • Least privilege
  • Administrative account controls
  • Authentication checks

Malware & Patching

Whether malware protection is effective and systems are kept up to date.

We test for

  • Malware protection verification
  • Patch and update status
  • End-of-life software
  • Email and web protection

The controls

The five controls and the current question set

  • Firewalls: boundary and host firewalls configured to block unauthenticated inbound connections, with any open services justified and documented.
  • Secure configuration: default accounts and passwords removed, unnecessary software and services disabled, auto-run disabled, and device locking enforced.
  • Security update management: supported software only, high and critical vulnerabilities patched within 14 days of a fix being released.
  • User access control: unique accounts, least privilege, multi-factor authentication on cloud services, and administrative accounts used only for administration.
  • Malware protection: anti-malware software active and updated on in-scope devices, or application allow-listing where it is used instead.
  • The requirements and question set are revised roughly annually by NCSC and IASME, with each version named and dated. We test against the version your certification body will assess against.

Cost

What it costs

Readiness testing is priced as a fixed scope after we confirm the size of your estate and the device sample set, built from our external and internal testing, with a free retest of any failed checks before your assessment. The certification fee for the Plus audit is quoted separately, based on the size and complexity of your network.

Methodology

How we test

Full methodology →

Every engagement follows the Penetration Testing Execution Standard and the relevant OWASP guides.

These are the phases your compliance test runs through.

  1. 01

    Scope the boundary

    The systems your framework actually covers, and nothing you would pay to test twice.

  2. 02

    Test

    The component penetration tests run to PTES and OWASP standards by senior testers.

  3. 03

    Map to controls

    Every finding tied to the requirement or control it evidences.

  4. 04

    Report for the auditor

    Evidence formatted the way your assessor, examiner, or QSA expects to read it.

  5. 05

    Fix & retest

    A free retest so the audit shows closed findings, not open ones.

How it works

How your engagement runs

From scope through the final retest, your team stays in the loop at every step, with findings tracked live in our platform.

  1. 01

    CE baseline

    You first complete the self-assessed Cyber Essentials baseline questionnaire.

  2. 02

    Scope & plan

    We agree the in-scope systems, the device sample set, and a testing timeline.

  3. 03

    Readiness testing

    We run the internal and external testing your certification body will require.

  4. 04

    Retest & certify

    A free retest of any failed checks, then the Plus audit by an IASME-licensed certification body, which issues the certificate.

Component tests

The tests behind your Cyber Essentials+ evidence

Compliance testing is built from our standard fixed-scope engagements. Each one is scoped to your boundary and reported against the framework.

External penetration testThe internet boundary check the Plus audit performs, run first so nothing exposed reaches the assessor. From $4,200.Internal penetration testDevice-level verification of configuration, patching, access control, and malware protection across the sample set. From $6,000.Vulnerability scanningAuthenticated scanning of the in-scope estate to find the missing patches the 14-day rule catches. From $1,500 per scan.
Industries that need thisLaw FirmsAll industries

Proof

Proof in the field

Every engagement is confidential, so the work below is anonymized to sector and engagement type.

All case studies →

Free

Retest on every penetration test

185+

Years combined experience

14

Senior in-house specialists

24h

Onboarding after signing

Fintech · Payments

Web Application Penetration Test

High risk

Critical: a remote code execution flaw in the application’s web framework that could have given an attacker full control of the server. We escalated it to the development team while the test was still running.

Outcome. The critical RCE was reported and remediated during the engagement via an emergency framework upgrade, which also closed the server-side request forgery, and the remaining findings were retested to confirmation.

1

Critical (RCE)

Mid-test

Critical remediated

2

High

Read the case study

HR & Payroll SaaS

Web Application Penetration Test

High risk

Critical: a file-inclusion flaw that let an attacker read sensitive files from the server through the application itself. High: stored cross-site scripting capable of session theft, insecure direct object references, and an authorization bypass that let an administrator create or delete organization owners.

Outcome. Delivered a remediation plan sequenced by real business impact, critical and high findings first, with a complimentary retest to verify every fix.

28

Findings

1

Critical

5

High

Read the case study
LatentPerygeeCity National BankAubaDesteiaDTCC
Request a reference 

Resources

Field notes from the offensive side

All articles →

Cyber Essentials Checklist: The Five Controls, Explained for US Companies

A Cyber Essentials checklist covering the five controls, scope, the Plus audit, the question set, and what a US company needs to certify for UK contracts.

Which Compliance Frameworks Require Penetration Testing?

A framework-by-framework guide to penetration testing for compliance: what SOC 2, PCI DSS, ISO 27001, HIPAA, GDPR, NYDFS and CMMC require, and how often.

IT Security Audit: What It Is and How It Works

What an IT security audit is, what it covers, how it differs from a penetration test, and how audit services support SOC 2, ISO 27001, and HIPAA.

Want to see a report first?

Read a sample report for a fictional client, or request a redacted one from a real engagement. Our guide explains what a penetration testing report should contain.

See the sample report

FAQ

Frequently asked questions

What teams most often ask before Cyber Essentials+ testing.

Still have questions? 
01What is the difference between Cyber Essentials and Cyber Essentials Plus?

Cyber Essentials is a self-assessment. Cyber Essentials Plus adds an independent, hands-on technical audit of your systems against the same five controls. We deliver Cyber Essentials Plus certification: readiness testing to the audit standard, a free retest of anything that fails, and the Plus audit, run by an IASME-licensed certification body that issues the certificate.

02Can you deliver Cyber Essentials Plus certification?

Yes, end to end. We run the internal and external readiness testing, retest any failed checks free, and arrange the Plus audit with an IASME-licensed certification body, which issues the certificate as the scheme requires. You have one point of contact from the baseline questionnaire to the certificate.

03How long does the assessment take?

Most assessments are completed within a few days depending on the size of your estate and sample set, followed by an evidence pack and a complimentary retest of any failed checks before your deadline.

04What happens if we fail a control?

We give you a prioritized remediation list and a complimentary retest, so you can close the gaps and certify without starting over.

05How much does Cyber Essentials Plus readiness testing cost?

Readiness testing is priced as a fixed scope after we confirm the size of your estate and the device sample set. It is quoted like our other engagements, with a free retest of any failed checks included. Starting prices for every service are on our pricing page. The certification fee for the Plus audit is quoted separately, based on the size and complexity of your network.

06Can a US company get Cyber Essentials Plus?

Yes. The scheme is UK-run, but certification is open to organizations anywhere, and IASME-licensed certification bodies perform the Plus audit remotely for overseas companies. US companies usually pursue it because a UK central government contract, a Ministry of Defence supply-chain requirement, or a UK enterprise customer requires it. Scope can be limited to the part of the business that serves the UK, and we help you draw that boundary before testing.

07Which version of the Cyber Essentials requirements do you test against?

The version current at the time of your assessment. NCSC and IASME revise the requirements and question set roughly once a year, with each version named and dated, so we confirm the version your certification body will assess against during scoping and test to that. If your baseline self-assessment was submitted under a previous version, we flag anything the newer requirements changed.

Ready to test your defenses?

Talk to our team about what your Cyber Essentials+ compliance requires.

Prefer the full scoping questionnaire? 
RelatedISO 27001 SOC 2 PCI DSS

Get a Fixed-Scope Quote

Tell us what you need tested. We reply within one business day.