Cyber Essentials Plus or a Penetration Test: Which You Need

Cyber Essentials Plus and a penetration test answer different questions. Cyber Essentials Plus checks, against a fixed specification, that five baseline controls are in place across a sample of your devices. A penetration test tries to break into the systems you name, by whatever route a skilled attacker would take, and reports what it reached. A contract that asks for one is rarely satisfied by the other, and many organisations need both.

What Cyber Essentials checks

Cyber Essentials is the UK government’s baseline scheme, run by the NCSC with IASME as its delivery partner. It covers five technical controls:

• Firewalls, at the boundary and on devices.
• Secure configuration, so that default accounts, passwords and unneeded software are dealt with.
• Security update management, so that high-risk and critical updates are installed within 14 days of release.
• User access control, including multi-factor authentication for cloud services and separate accounts for administration.
• Malware protection.

The basic level is a self-assessment: the organisation answers a question set online, a board member or equivalent signs it off, and an assessor marks it. The current requirements, version 3.3 with the question set called Danzell, apply to assessment accounts created after 26 April 2026. They made two things automatic fails: not using multi-factor authentication on a cloud service where it is available, whether free, included or a paid option, and not installing high-risk or critical updates within 14 days. They also state plainly that cloud services cannot be left out of scope.

What Cyber Essentials Plus adds

Cyber Essentials Plus has the same requirements, verified by a technical audit. An assessor from a certification body holding an IASME licence audits a representative set of user devices and the internet gateways and servers in scope, testing a random sample of them, typically around a tenth. The test specification sets out five tests:

1. A remote vulnerability assessment of the internet-facing systems.
2. An authenticated vulnerability scan of the sampled devices, to check patching.
3. Checks that malware protection works.
4. Checks of multi-factor authentication on cloud services.
5. Checks that users do not work with administrator privileges.

The Plus audit must be completed within three months of the Cyber Essentials certification it builds on, and both last twelve months. Since April 2026, a sample that fails the patching test is fixed and retested together with a new random sample of devices, and a second failure revokes the self-assessment certificate as well.

What a penetration test does differently

A penetration test, as the NCSC describes it, gains assurance by attempting to breach some or all of a system’s security the way an attacker would. It is a different kind of exercise from an audit against a specification:

	Cyber Essentials Plus	Penetration test
The question	Are five baseline controls in place?	What could an attacker reach, and how?
Scope	The organisation’s IT, sampled	The systems you choose: an application, a network, a cloud account
Method	Defined tests, the same for everybody	A tester’s judgement, following a methodology
Depth	Whether controls are present and configured	Weaknesses exploited and combined
Application logic	Not tested	Tested, on an application test
Result	Pass or fail, and a certificate	Rated findings with remediation

The difference that matters most is the fourth row. Cyber Essentials Plus confirms the basics are present; it does not try to chain a weak password, an over-privileged account and an exposed service into a route to your data, which is where the serious findings in most penetration tests come from. Nor does it test whether one customer of your web application can read another’s records. Vulnerability scan or penetration test covers the same distinction from the scanning side.

Which you need

Start from who is asking and why:

• A UK government contract. The government’s procurement rule, PPN 014, applies to central government departments, their agencies, non-departmental public bodies and NHS bodies. It asks for Cyber Essentials where a supplier handles citizens’ or staff personal information or OFFICIAL data, and for Cyber Essentials Plus where the risk is higher, renewed every year of the contract. Equivalent controls can be accepted where independently verified.
• A customer’s supplier questionnaire or an insurer. Usually Cyber Essentials or Plus, sometimes a recent penetration test as well. Answer what they asked for.
• A regulation or standard that names penetration testing. PCI DSS and DORA ask for penetration testing specifically, and no certificate stands in for it; PCI DSS penetration testing requirements covers the first.
• Wanting to know whether your data is at risk. A penetration test of the systems that hold it, internal, external or both; internal or external penetration testing helps choose.
• A new application going live. A penetration test of the application. Cyber Essentials Plus will not look at its logic.

Doing both, in the right order

For an organisation that needs both, Cyber Essentials first usually makes sense. Getting patching, configuration and multi-factor authentication right before the penetration test means the testers spend their days on the weaknesses that need a person to find, rather than reporting missing updates a scan would have caught. Schedule the penetration test once the Plus audit has passed and any fixes have settled.

Keep the two results in proportion afterwards. A current Cyber Essentials Plus certificate and a penetration test that finds an authorisation flaw in the customer portal are entirely compatible, and a board told only about the first may conclude more than it should.

For testing firms

Clients often ask why they need a penetration test when they already hold Cyber Essentials Plus, and the table above is the answer most of them need. Testing firms meet the scheme from the other side too: the NCSC’s CHECK scheme requires its companies to hold Cyber Essentials Plus on every system where engagement information is stored and processed, which CHECK vs CREST covers with the scheme’s other requirements.