How often do I need a vulnerability assessment?

Cyber Essentials Plus certification is valid for 12 months, so you must undergo a new vulnerability assessment each year to maintain your certificate. Additionally, if you make significant changes to your network, such as adding new internet-facing services or major infrastructure upgrades, it's wise to perform an internal assessment before your next annual audit to ensure you're still compliant.

What tools are used for the assessment?

Assessors in the UK typically use industry-standard tools like Nessus, Qualys, or OpenVAS. These tools scan for Common Vulnerabilities and Exposures (CVEs), misconfigurations, and default credentials. The NCSC provides guidance on acceptable scanning techniques, but the exact tool isn't specified. What matters is that the tool is up-to-date and configured to detect the most relevant threats to your systems. Your assessor will also do manual verification to reduce false positives.

Can I fail Cyber Essentials Plus on a vulnerability assessment?

Yes, you can fail if the assessment finds 'high' or 'critical' vulnerabilities that could be remotely exploited. However, the scheme allows a remediation period – typically 14 days – to fix any issues found before a final retest. If you can successfully patch or mitigate the vulnerabilities within that window, you'll pass. The key is to take the initial scan results seriously and address all flagged items promptly.

How much does Cyber Essentials Plus cost in the UK?

The cost for Cyber Essentials Plus in the UK varies by provider and business size. For a small company (under 50 employees), expect to pay between £300 and £800. Larger organisations with more complex networks will pay more. This fee usually includes the full external and internal vulnerability assessment, as well as the certification itself. Some providers offer discounts if you already have Cyber Essentials. Always request quotes from multiple accredited bodies to get the best value.

Cyber Essentials Plus Vulnerability Assessment in the UK: Your 2026 Guide

17 August 2026

Discover how a vulnerability assessment fits with Cyber Essentials Plus in the UK. Learn requirements, costs, and certification steps for 2026.

Read this page in: Deutsch

What is Cyber Essentials Plus?

Cyber Essentials Plus is a UK government-backed certification scheme, administered by the NCSC and IASME. It builds on the basic Cyber Essentials level by adding an independent external and internal vulnerability scan of your IT systems. For UK businesses, it's a powerful way to demonstrate robust cybersecurity practices to clients, partners, and regulators. Unlike the self-assessment for standard Cyber Essentials, Plus requires a hands-on technical audit. In 2026, it remains a key baseline for organisations bidding for public sector contracts or handling sensitive data. The certification proves you've implemented five core controls: firewalls, secure configuration, user access control, malware protection, and patch management.

Why Vulnerability Assessment Matters for Cyber Essentials Plus

The vulnerability assessment is the heart of Cyber Essentials Plus. It actively probes your external IP addresses and internal systems to identify weaknesses that attackers could exploit. In the UK, this matters because over 30% of businesses experience a breach annually, often due to unpatched software or misconfigured devices. The assessment verifies that your security controls actually work, not just that you've written a policy. It checks for known Common Vulnerabilities and Exposures (CVEs), default credentials, and outdated software. For UK businesses, passing this assessment means you can confidently handle personal data under GDPR, as it demonstrates a 'state of the art' security posture, reducing your risk of fines and reputational damage.

How the Vulnerability Assessment Works in the UK

For Cyber Essentials Plus, the vulnerability assessment is performed by an IASME-accredited Certification Body. They first scan your public-facing IP addresses from outside your network, then conduct an internal scan on a sample of user devices, servers, and network appliances. In the UK, the scan uses industry-standard tools like Nessus, Qualys, or OpenVAS, configured to the NCSC's requirements. The assessor will look for vulnerabilities rated 'high' or 'critical' that could be exploited remotely. If any are found, you have a window to remediate—typically 14 days—before the final fail. The process is thorough but practical, focusing on internet-facing systems and internal devices that hold sensitive data or are critical to your operations.

Common Pitfalls and How to Avoid Them

Many UK businesses fail their first Cyber Essentials Plus assessment due to simple oversights. Unpatched legacy software is the biggest culprit—Windows 7, for example, is not supported. Other frequent issues include weak admin passwords, out-of-school firmware, and missing antivirus on servers. To avoid failing, conduct your own internal scan before the official one. Use tools like Microsoft Defender or a free vulnerability scanner to preview what the assessor will see. Ensure all devices are patched, especially Java, Adobe, and web browsers. Also, check that your firewall rules restrict all traffic by default. If you're not sure, work with a UK consultancy that specialises in Cyber Essentials Plus preparation—they can guide you through the nuances of the 2026 guidance.

Choosing a UK Assessment Provider

Selecting the right IASME-accredited certification body is crucial for a smooth Cyber Essentials Plus experience. In the UK, you can choose from providers like IASME themselves, or accredited companies such as CyberSmart, IASME-approved assessors, and established security firms. Look for a provider that offers support beyond the scan—some will help you interpret results and advise on fixes. Pricing varies, typically from £300 to £800 for a small business, depending on the size of your network and the provider's location. In 2026, ensure your chosen provider is listed on the official NCSC website to guarantee validity. Also, ask about retesting policies, as some include one free retest if you need to remediate vulnerabilities after the initial scan.

FAQ

Yes, for Cyber Essentials Plus, an independent vulnerability assessment is mandatory. Unlike Cyber Essentials, which relies on self-assessment, Plus requires an external and internal scan by an accredited assessor. This scan verifies that your systems are resilient to common cyber attacks, specifically checking for known vulnerabilities and configuration gaps. Without passing this assessment, you cannot achieve the Plus certification.

cyber essentials plus requirements vulnerability assessment tools UK cyber essentials certification cost

Latest guides

Year 11 study plan uk — Best Options in the UK (2026)Website migration services uk — Best Options in the UK (2026)Content migration best practices uk — Best Options in the UK (2026)Intranet redesign uk — Best Options in the UK (2026)Sharepoint migration uk — Best Options in the UK (2026)Flexible Work for Coders in the UK (2026)