Cyber Essentials: what the scan has to pass

Cyber Essentials is usually described as a five-control scheme, which makes it sound like a policy exercise. The self-assessment mostly is. Cyber Essentials Plus is not: an assessor runs an external vulnerability scan against your internet-facing addresses, and the outcome turns on findings you either fixed in time or did not. That is the part teams discover late.

The two certifications are not the same test

Cyber Essentials is a self-assessment questionnaire, verified by a certification body, covering five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. You answer the questions and someone marks them.

Cyber Essentials Plus is a hands-on technical audit of the same five controls, carried out within three months of passing the self-assessment. It adds an external vulnerability scan of the in-scope internet-facing IP addresses, an authenticated scan of a sample of user devices, and practical tests of how email and browsers handle malicious files. Both certificates last twelve months, so this is an annual event, not a one-off.

The self-assessment asks whether you patch promptly. Plus checks.

The fourteen-day rule is the whole game

The update-management control requires that fixes for vulnerabilities described as critical or high risk are applied within fourteen days of the vendor releasing them. "Critical or high" means a CVSS v3 base score of 7.0 or above, or the vendor's own critical/high label where no score exists.

The external scan applies that same threshold. A vulnerability scoring 7.0 or higher, with a fix that has been available for more than fourteen days, is a fail. A 9.8 published yesterday is not — the clock has not run out yet. This is one of the few compliance thresholds that is genuinely mechanical, and it means your pass or fail is decided by remediation speed, not by finding count.

	Cyber Essentials	Cyber Essentials Plus
Method	Self-assessment questionnaire	Technical audit by an assessor
External vulnerability scan	No	Yes, on in-scope public IPs
Device sampling	No	Yes, authenticated
Fails on	Answers that don't meet the controls	An unremediated CVSS 7.0+ past 14 days
Valid for	12 months	12 months

Two other conditions sink certifications quietly. Unsupported software — an operating system or application past its end of support — has to be removed from scope or segregated from the internet, because it cannot receive the updates the control requires. And any service reachable from the internet needs a documented business need behind its firewall rule; "it has been open since 2019" is not one. That second condition overlaps almost exactly with the ports that should never face the internet.

Why teams fail on the day

The common failure is not a missing control. It is a gap between the scope someone declared and the addresses that actually answer. Scope for Cyber Essentials is the whole organisation by default, or a clearly separated sub-part; the assessor scans what is in it. A staging box, an old marketing subdomain, an appliance someone stood up for a project — if it resolves inside the declared scope, it is scanned, and the fourteen-day rule applies to it exactly as it does to production.

The second failure is timing. The assessment happens on a fixed date. If the first time anybody looks at the external attack surface is the week the assessor books in, every finding older than fourteen days is already a fail and there is no remediation window left to use. Fixing that is not a compliance problem — it is a scanning cadence problem, the same one behind why annual pentests miss drift.

Running your own scan first

Nothing stops you scanning the same addresses the assessor will, on your own schedule, and working the CVSS 7.0-and-above list down to zero before the audit date. That is the entire preparation: know which addresses are in scope, know what answers on them, know how long each finding has been open.

CyberSpec scans external assets on a schedule, attaches CVSS scores and vectors plus CVE and CWE references to each finding, and tracks first-seen and last-seen dates across repeated scans — so "has this been open longer than fourteen days" is a value you can read rather than reconstruct from old reports. The compliance coverage view maps open findings onto SOC 2, ISO 27001 and PCI DSS control families; Cyber Essentials mapping is not in that set, but the underlying evidence — severity, exposure, age — is the same data the assessor works from.

Book the audit second. Scan first, and give yourself more than fourteen days between the two.