Cyber Essentials vs Cyber Essentials Plus: Which Do You Need?

Cyber Essentials vs Cyber Essentials Plus comes down to one question: do you need to prove your controls to someone else, or only to yourself? Cyber Essentials is a self-assessment against five technical controls, reviewed by a licensed provider. Cyber Essentials Plus covers the same five controls but adds independent technical verification, including vulnerability scanning and testing of devices by an accredited assessor. Certification at either level lasts 12 months (SureCloud).

If you sell to central government, or a customer contract names a scheme, the choice is usually made for you. If you are certifying to win trust, reduce insurance risk or simply get your house in order, standard Cyber Essentials is often enough to start.

What is the difference between Cyber Essentials and Cyber Essentials Plus?

The difference is how the controls are checked, not what is required.

Both levels assess the same five controls, as set out by the government: firewalls, secure configuration, security update management, user access control and malware protection (GOV.UK). Your organisation implements those controls either way.

Standard Cyber Essentials asks you to describe how you meet each control in a questionnaire, which a licensed certification body reviews before issuing a certificate (SureCloud). Nobody tests your laptops. The certificate reflects your answers.

Cyber Essentials Plus sends an assessor in to check. They run authenticated vulnerability scans, review device configurations, and test email and web browsing controls against the NCSC test specification (SureCloud). The certificate reflects what the assessor found.

That gap matters. A questionnaire can be answered optimistically by someone who believes patching is up to date. An audit finds out whether it actually is.

Cyber Essentials vs Cyber Essentials Plus at a glance

Always confirm current requirements, fees and assessment scope with your certification body or IASME before you commit, because scheme details and pricing change.

Which one do government contracts require?

Many public sector buyers ask for Cyber Essentials, and some ask for Plus. The government has required Cyber Essentials certification for contracts involving the handling of personal information or the provision of certain technical products and services to government since April 2014 (SureCloud). Cyber Essentials Plus is asked for where the buyer wants verified assurance rather than a self-declaration, and is required for some MoD supply chain contracts and for organisations handling more sensitive government data (SureCloud).

In practice, read the contract or tender question rather than guessing. Buyers usually name the level, the certificate's maximum age and sometimes the scope. If a tender says Cyber Essentials Plus, a standard certificate will not satisfy it. If it says Cyber Essentials, Plus is a stronger answer but rarely a cheaper one.

The NCSC has also been developing a Pathways route, which lets some larger organisations with complex or legacy estates demonstrate equivalent protection through alternative controls rather than the prescriptive ones (NCSC). That work has focused on large organisations, so most SMEs should plan on the standard route.

What drives the cost of each level?

Standard Cyber Essentials is priced mainly on the assessment fee, which IASME describes as around £320 to £600 plus VAT for basic certification depending on organisation size (IASME). Your real cost is usually the work to close gaps first.

Cyber Essentials Plus costs more because a human assessor has to test your estate. Expect fees to rise with the number of devices, sites, remote workers and cloud services in scope, plus remediation and re-testing if the first attempt fails. Ask any provider for a quote against your actual device count rather than a headline figure.

There is help available. The Cyber Essentials First Step Fund offers a 75% discount on certification for eligible small and medium-sized organisations seeking a new certificate, running until the end of March 2027 or until funding runs out (GOV.UK). The Cyber Resilience Pledge grant offers fully funded certification plus Cyber Advisor support to nominated SME suppliers of pledging organisations, running until the end of March 2029 (GOV.UK). Neither guarantees that you will pass.

What does preparation actually involve?

Most failed first attempts fail on the boring things: unpatched software, local admin rights handed out too freely, and forgotten devices. Here is a sensible order of work.

1. Define scope honestly. List every device, cloud service and person who touches business data, including home working kit and personal phones used for email. An assessor will find what you leave out.
2. Fix patching first. Security update management is usually the biggest gap. Set a routine so updates are applied without anyone remembering to do it.
3. Remove local admin rights. Day to day accounts should be standard accounts, with admin access granted only when needed.
4. Turn on multi-factor authentication. Prioritise email, remote access and any admin console.
5. Check firewall rules and default settings. Default passwords, unused services and permissive inbound rules are common findings.
6. Confirm malware protection is active and updating across every in-scope device, not just the ones in the office.
7. Keep evidence. Screenshots, policy documents and configuration reports make both the questionnaire and the audit far quicker.

We run ongoing security monitoring for clients as part of this work, so gaps surface between renewals rather than the week before an assessment. You can see how our security monitoring service fits alongside certification.

Which should you choose?

Choose standard Cyber Essentials if you want a recognised baseline, you are bidding for work that asks for it, or you are certifying for the first time with limited internal resource. It is the sensible starting point for most small businesses, and many never need more.

Choose Cyber Essentials Plus if a specific contract, customer or insurer asks for verified assurance, if you hold sensitive data on behalf of others, or if you genuinely want an outside pair of eyes on whether your controls work. It is also the honest choice if you cannot confidently answer the questionnaire without checking.

Whichever you pick, remember what the certificate is: evidence that a defined set of controls was in place at a point in time. It is not a guarantee that you will not be breached, and no certification is.

Frequently asked questions

Do I need Cyber Essentials before Cyber Essentials Plus?

Yes, in practice. Cyber Essentials Plus verifies the same five controls, and organisations normally complete standard certification first and then complete the Plus verification within three months of the certificate date (SureCloud).

How long does certification take?

Standard Cyber Essentials is typically faster because it is questionnaire based, while Cyber Essentials Plus takes longer because an assessor has to schedule and carry out testing. Timelines depend heavily on how much remediation you need first. Ask your provider for a realistic date based on your estate.

Does Cyber Essentials reduce insurance premiums?

Insurance data cited by IASME shows organisations certified under Cyber Essentials are 92% less likely to make a claim on their cyber insurance compared with those without certification (IASME). That is a strong argument for certifying, but check with your broker on how your own policy treats it.

Can a small business with no IT team get certified?

The scheme is designed to be achievable by organisations of all sizes, including sole traders and micro-businesses with limited technical expertise (IASME). Even where IT is outsourced, responsibility for security sits with the business owner, so someone internally needs to own the process.

The sensible next step is to write down your scope and check the five controls against reality before you buy an assessment. If you would rather have someone walk through it with you, get in touch and we will tell you honestly which level your situation calls for.