Skip to content
Made in the UK

Cyber Essentials

What evidence does a Cyber Essentials Plus assessor ask for, including after the April 2026 changes?

By , CEO, CybaVerse. Last reviewed

A Cyber Essentials Plus assessor mainly gathers evidence by testing: scanning internet-facing systems, running authenticated scans on sampled devices, testing malware protection, and checking MFA and account separation on cloud services. Clients should have an accurate scope, asset list and user list ready, and since April 2026 missing MFA on cloud services is an automatic fail.

This page is part of our Cyber Essentials guide.

What does the assessor test?

The Cyber Essentials Plus test specification sets out five test cases. Together they check that the controls declared in the Cyber Essentials questionnaire are really in place. The assessor collects evidence by running the tests, so the best preparation is making sure the controls work rather than collecting paperwork.

Test caseWhat the assessor checks
Remote vulnerability assessmentInternet-facing systems for high and critical flaws
Software updatesAuthenticated scans of sampled devices
Malware protectionThat malware protection works on sampled devices
MFA configurationMFA on cloud services for sampled users
Account separationAdmin and standard accounts are separate

What should the client have ready?

Clients should have the facts the assessor needs to plan and sample the testing. The test specification calls for a representative sample of devices and at least one standard and one administrative user for each cloud service in scope. Missing or outdated information slows testing and risks a failed sample.

  • An agreed scope, including legal entities and locations
  • An up-to-date list of devices and operating systems
  • A list of cloud services in scope
  • Standard and administrative test users for each cloud service
  • Contacts who can grant access during testing

What changed in April 2026?

IASME's April 2026 update changed how assessments are run for accounts created after 26 April 2026. Missing MFA on cloud services became an automatic fail, and if a sampled device fails, the retest checks the original sample plus a new random sample. A second failure means the related Cyber Essentials verified self-assessment is revoked.

How should MSPs prepare a client, step by step?

The steps below suit most MSPs preparing a client for testing. They follow the NCSC test specification and IASME guidance. Start four weeks or more before the assessment, so there is time to fix findings and rescan before the assessor arrives and the sample is chosen.

  1. Step 1: Confirm scope and entities

    Check the scope matches the Cyber Essentials certificate.

  2. Step 2: Update asset and user lists

    Make sure every in-scope device and cloud service is listed.

  3. Step 3: Scan everything

    Run external and authenticated scans across all in-scope devices.

  4. Step 4: Check MFA everywhere

    Confirm MFA is enforced on every cloud service for every user.

  5. Step 5: Test malware protection

    Check protection is active and up to date on every device.

  6. Step 6: Prepare test accounts and access

    Set up the test users and remote access the assessor needs.

How does CybaVerse help?

CybaVerse delivers Cyber Essentials and Cyber Essentials Plus certification through MSPs as a service. CybaOps vulnerability scanning helps clients find and fix CE+ failures well before testing day, rather than discovering them when the assessor starts work on the sample.

  • CybaVerse delivers Cyber Essentials and Cyber Essentials Plus certification, run through the CybaOps platform.
  • CybaOps vulnerability scanning helps you find and fix CE+ failures before the assessment.
  • Cyber Essentials Plus works best as part of an ongoing security service, not a once-a-year exam.
  • CybaVerse holds Cyber Essentials and Cyber Essentials Plus itself.

CE+ evidence

What a CE+ assessor tests and asks for

A Cyber Essentials Plus assessor mainly gathers evidence by testing: scanning internet-facing systems, running authenticated scans on sampled devices, testing malware protection, and checking MFA and account separation on cloud services.

01 Readiness checks

Multi-tenantPartner / MSP CustomerCustomerCustomer+
CybaOps by CybaVerse

CE+ evidence

02 The 6-step path

  • Role-based access
  • UK-based analysts
  • ISO 27001

03 Outcomes

Explore

Hover or tap any part of the diagram to see what it does.

  • Delivered with
  • Cyber Essentials & CE+
  • CybaVM

What else do MSPs ask about assessor evidence?

These are the follow-up questions we hear most about Cyber Essentials Plus testing.

Can we choose which devices are sampled?

No. The assessor selects a representative sample. Because a failed sample now triggers a retest with additional random devices, every in-scope device needs to meet the standard, not just the ones you expect to be picked.

Do we need written policies?

Cyber Essentials Plus focuses on testing controls rather than reviewing documents. Accurate scope, asset and user information matters more. Your certification body will confirm anything else it needs before testing starts.

Can the scope change after testing?

IASME's April 2026 rules say the verified self-assessment cannot be changed after Cyber Essentials Plus testing. Get the scope right before testing begins, including legal entities and locations.

What should you do next?

See how CybaVerse delivers Cyber Essentials Plus on the CybaOps platform page. MSPs can read about the CybaVerse partner model for MSPs.

Related: Cyber Essentials vs Cyber Essentials Plus and Why do clients fail Cyber Essentials Plus on software updates?

See how CE+ preparation works.

Book a CybaOps demo