Cyber Essentials Plus Sample Size: How Many Devices Will Be Tested?
Published 27 October 2026
What IASME says
IASME's Cyber Essentials FAQ describes CE Plus sampling as a suitable random sample, typically around 10%, with the assessor able to expand testing. The NCSC CE Plus Test Specification sets out which tests are run on the sampled devices, such as checking for missing security updates and testing malware protection.
Why "10%" is not a guaranteed number
- Representative coverage comes first. A sample that only includes Windows laptops says nothing about your Macs or Android phones.
- Small estates need a minimum. 10% of eight devices is less than one device, which would not be meaningful.
- Problems widen the sample. If the assessor finds a failure, they may test more devices to understand how far it reaches.
- The assessor chooses. You do not get to pick the devices.
Device types, builds and operating systems
The assessor will want the sample to reflect each meaningful combination in your estate. Group your devices before the audit so you know what those combinations are:
| Group | Examples |
|---|---|
| Operating system and version | Windows 11, macOS, iOS, Android, Linux |
| Build or image | Standard office build, developer build, shared kiosk |
| Ownership | Company-owned, personal (BYOD) accessing organisational data |
| Role | Laptops, desktops, mobiles, servers, virtual desktops |
Virtual desktop estates have their own nuances. See VDI testing and sampling.
Internet gateways and exposed services are separate
User-device sampling is only part of CE Plus. The assessor also checks your internet-facing IP addresses and externally exposed services (for example firewalls, VPN gateways, and public-facing servers). Those checks are about what is reachable from the internet, not a sample of laptops, so make sure your list of external IP addresses is accurate.
Illustrative examples
These show how sampling tends to work in practice. They are not a calculation your assessor is bound to use.
- 10 devices, all Windows 11 on one build plus a few iPhones: expect at least one laptop and one phone, because both device types need coverage even though 10% would be one device.
- 50 devices across Windows, Mac and Android: around 10% is five devices, spread so each platform is represented.
- 100 devices with three Windows builds, Macs and mobiles: roughly ten devices, chosen so each build and platform appears, possibly more if the estate is very varied.
Prepare the whole estate, not the guessed sample
Because the sample is random, expandable and representative, the only safe preparation is to make every in-scope device compliant. Fixing the devices you expect to be picked is also at odds with the declaration you made for the whole scope. Under IASME's April 2026 update, a failure in update-management testing leads to a retest of the original sample plus a new random sample, so guessing is even less effective. See the CE Plus readiness checklist.
How sample size relates to price
Larger and more varied estates take longer to test, which is why CE Plus is priced by organisation size. Our CE Plus price for organisations with 1 to 9 employees is £1,400 + VAT, with bands above that. See Cyber Essentials Plus for the current bands.