Key takeaways

• Both levels assess the same five technical controls. The difference between Cyber Essentials and Cyber Essentials Plus is verification, not requirements.
• Cyber Essentials is a verified self-assessment: you answer the IASME question set, a director or board member signs it, and an assessor marks it.
• Cyber Essentials Plus adds independent technical testing of the same controls on a sample of your devices and every cloud service.
• Basic Cyber Essentials is a prerequisite for Plus, and the Plus audit must be completed within 90 days of it.
• The five core technical controls are firewalls, secure configuration, access control, patch management, and malware protection.
• Both certificates last 12 months. Check which level your buyer asks for before choosing.

The one-line answer: Basic Cyber Essentials certification is you telling an assessor your fundamental cybersecurity measures are in place, checked and marked; Cyber Essentials Plus is a qualified assessor verifying key technical controls. Everything else, including cost, time, effort and whether a buyer will accept your certificate, follows from that. This post is for anyone who has been asked for Cyber Essentials in a tender or supplier questionnaire and needs to know whether that means basic or Plus; if you are new to the scheme, start with what Cyber Essentials is.

Choosing the wrong level is expensive in both directions: a Plus audit nobody asked for, bought before your estate is ready, wastes money, and a basic certificate at a tender that specified Plus can cost you the contract.

What is the difference between Cyber Essentials and Cyber Essentials Plus?

The Cyber Essentials scheme is the UK government-backed certification against the most common cyber attacks to discourage cyber criminals: the National Cyber Security Centre (NCSC) owns it and sets the requirements for both levels, and IASME, its delivery partner, licenses the certification bodies (Cyphere is one) whose assessors mark self-assessments and carry out Plus audits.

Two certification levels are available. Cyber Essentials, sometimes called Level 1 or basic assurance scheme, checks that basic technical controls are in place: firewalls, secure configuration, security update management, user access control and malware protection. The basic assurance scheme involves an online assessment revolving around the IASME self-assessment questionnaire. Cyber Essentials Plus, sometimes called advanced certification level or Level 2, uses the same baseline controls, and this certification level aims to verify those same controls through independent technical testing rather than introduce new ones.

The requirements are identical at both levels; what changes is the evidence behind the certificate.

Why the difference matters

A certificate is only as good as the controls behind it. A self-assessment captures what an organisation believes is in place; it cannot show whether one laptop missed an update or an online service was set up without multi-factor authentication (MFA). That gap is exactly what Cyber Essentials Plus exists to close, and it is why some buyers accept only Plus.

Commercially, basic certification answers the questionnaires that ask for a recognised baseline, supporting data security, and Plus gives a buyer independent evidence that demonstrates more rigorous access controls, stronger evidence of the organization’s cybersecurity posture, and better protection for sensitive data; Cyber Essentials Plus strengthens trust with clients, insurers, and regulators.

93% of certified organisations feel protected against common, Internet-based cyberattacks.

For the wider case, see our guide to Cyber Essentials benefits and IASME’s own explanation of the difference.

Cyber Essentials vs Cyber Essentials Plus at a glance

Our Cyber Essentials Plus checklist turns the right-hand column into a readiness list.

The Cyber Essentials certification process at each level: self-assessment vs independent audit

Cyber Essentials is a self-assessment, so the result relies on the accuracy of your answers. You answer the current IASME question set through an online portal, a director or board member signs a declaration that the answers are accurate, and an assessor marks every answer. Nobody tests your systems at this level.

Cyber Essentials Plus takes it further with an independent audit conducted by a certification body, testing the same five controls on your real systems to reduce the commodity cyber attacks from the Internet. IASME use this commodity term to describe common, low-skill, low-sophistication cyber attacks that target organisations’ cyber defences or organisations without any defences.

What does the Plus audit prove that Basic cannot?

The NCSC’s Cyber Essentials Plus Test Specification sets out five tests: an external vulnerability assessment, comprehensive vulnerability scanning including an authenticated patch scan of sampled devices to confirm that installed software is supported and fully patched, malware protection testing by email and browser, an MFA check on every cloud service, and an account separation check.

The device tests run on a sample drawn per operating system from the end user devices in scope (desktops, laptops, thin clients, tablets and smartphones) and from every internally hosted server and IaaS instance; our guide to Cyber Essentials Plus requirements explains the sampling and what fails each test.

That the controls exist on real devices. A sample chosen by an assessor is a different test from a questionnaire, and under IASME’s Danzell process a second sample then checks that missing updates were fixed across the entire scope, not just the sampled devices, as part of all the additional assessments that distinguish Plus from basic; see what happens if you fail Cyber Essentials Plus.

That your cloud services are protected. At Plus, every service is tested for MFA with a standard user and an administrator account (once per sign-in service where several share single sign-on). In our audits, MFA on cloud services is the requirement most often claimed and least often complete.

That your scope is real. The assessor verifies that the scope of the audit matches your Cyber Essentials certificate and, by technical means, that any sub-set is genuinely segregated; a significant deviation from that scope means a new Cyber Essentials certification first.

From the assessor’s desk

Plus uses multi-level assessment layers to confirm that controls work on real systems, not just on paper. A self-assessment tells me what you believe. An audit shows me what is there. The difference is usually one thing: the one laptop that missed an update, an online service without MFA, the one admin account that also reads email. Plus exists to find that one thing.

Harman Singh, IASME-licensed Cyber Essentials assessor, Cyphere

How much does each level cost?

Basic Cyber Essentials base level certification costs £500 to £700 + VAT, an IASME fee banded by organisation size and the same at every certification body. Cyber Essentials Plus with Cyphere starts at £1,299 + VAT for organisations under 50 staff, including the basic assessment, a readiness check and the audit, or £999 + VAT alongside an eligible Cyphere security engagement.

Remediation costs, such as replacing software past vendor support or licensing MFA, sit outside any quote at either level. See our Cyber Essentials cost guide for every band, which also helps answer whether cyber essentials worth the spend for smaller organisations, depending on needing the lighter basic route or the added assurance of Plus. Cyber Essentials Plus costs much more than Cyber Essentials.

How long does each level take?

The basic assessment can be completed in days once you are ready: the questionnaire takes a prepared applicant a few hours, and we mark within one or max two working days, most within one. Plus adds a readiness phase, the audit and any fixes; the audit is remote for the vast majority of organisations, and the assessor’s assessment and decision take one to two business days at most. Depending upon organisation size, Cyber Essentials Plus may take a week to a couple of months.

Plus also needs things Basic does not: your device and user scope with external IPs and internet-facing services, a technical contact (yours or your MSP’s) with remote access to the sampled devices, and test users with credentials and working email clients and browsers on those devices.

End to end, both certificates take one to two weeks if you are ready, and a couple of months if technical baselines need putting in place first; see how long Cyber Essentials takes.

Which level do buyers require?

A Cyber Essentials certificate is the entry requirement for a lot of public sector and supply chain work, but the level each buyer asks for varies, so check the contract. The pattern we see:

• Central government: since 2014, suppliers bidding for certain public contracts (those involving personal information, or ICT systems that store or process OFFICIAL data) have needed Cyber Essentials. PPN 014 lets the contracting authority specify either Cyber Essentials or Cyber Essentials Plus, with Plus to be used “when there is a higher risk of cyber security threats”. Cyber Essentials qualifies you to bid for public sector contracts and comply with tender pre-requisites.
• NHS Supply Chain asks in-scope suppliers (those handling personal data or supplying IT and digital products) for Plus. See Cyber Essentials for NHS suppliers.
• Defence: every Defence Cyber Certification level starts with Cyber Essentials, and Levels 2 and 3 require Cyber Essentials Plus. See our DCC Level 0 guide.
• Private-sector supply chains vary. A prime contractor’s questionnaire usually says which level.
• Insurers and brokers: in our experience, they accept either level, and some ask which one you hold when pricing.

Our guide to whether Cyber Essentials is mandatory lists each requirement with its source.

When is basic certification enough?

Basic is the right answer more often than the marketing suggests. Choose it when:

• Nobody is contractually asking for Plus, and you want a recognised baseline against the most common cyber threats
• You are bidding for work where the tender specifies Cyber Essentials without qualification
• You are a small business starting the cyber security journey and implementing fundamental cybersecurity measures is enough to start with
• You still have unsupported devices or uncontrolled personal devices in scope, which Plus samples like any other device
• Your budget is tight, and the alternative is doing nothing this year

When to choose Cyber Essentials Plus

Choose Plus when:

• A contract, tender or customer specifically requires it
• You fall into one of the buyer cases above, such as an in-scope NHS Supply Chain supplier
• A customer questionnaire asks for independently verified security measures
• You want independent evidence that the controls work, for your own assurance rather than a buyer’s; the upgraded certification helps harden the organization’s cyber defences, not just prove them to buyers

If you already know you need Plus, go straight to it and treat the two certificates as one project; our basic certification guide covers the self-assessment route if that is where you are starting. 61% of Cyber Essentials certified organisations prefer working with other certified companies. You are free to go direct to IASME (Information Assurance for Small and Medium Enterprises) and buy the certification to just pay certification fees, or work with a certification body such as Cyphere who will guide you, support you with consultations and gap analysis, all the way until certification is awarded. This explains why there is a difference in price between IASME and certification bodies.

From the assessor’s desk

If nobody is asking for CE Plus and your estate still has unsupported devices, I would rather you spent the money fixing them and certified at the basic level first. Buying an audit you are likely to fail is not good value, and I will say so.

Harman Singh, IASME-licensed Cyber Essentials assessor, Cyphere

How the April 2026 changes widened the gap

Since 27 April 2026 (the Danzell question set and version 3.3 of the requirements), cloud services cannot be excluded from scope, and three areas are automatic fails at both levels: unsupported software, a SaaS in scope without MFA, and high or critical security updates not applied within 14 days. At basic, an assessor takes your word on all three; at Plus, the scans and MFA checks test them directly.

The gap between a confident self-assessment and a passed audit is therefore wider than it was, especially with a long tail of SaaS tools. See our guide to the April 2026 Danzell changes.

Achieving Cyber Essentials Plus: the prerequisite and the 90-day window

To achieve certification at the Plus level, an organisation must first hold a valid Cyber Essentials certificate and complete the Plus audit within 90 days; miss the window and the whole process, including the self-assessment, starts again. If findings need fixing, you have 30 days to fix and retest the affected checks inside that window.

The most common failure we see is an organisation submitting the basic application quickly without planning for Plus, then running out of time while fixes are made. If Plus is the goal, prepare for the audit tests before you submit the self-assessment, not after.

You do not have to use the same certification body for both, since every certificate is listed on the same IASME register, so you can switch for the Plus stage; our guide to choosing a Cyber Essentials certification body covers what to ask.

Is Cyber Essentials Plus the same as a penetration test?

No. Cyber Essentials Plus runs defined scans and tests against a sample, while a penetration test is a manual attempt to exploit weaknesses in specific systems or applications; the two complement each other rather than overlap. See our penetration testing services.

Keeping either certificate

Both certificates last 12 months from the day the application is assessed and marked as a pass, and both renew by a fresh assessment rather than an extension. Renewal is also the natural point to move from basic to Plus if a buyer has started asking; see our renewal guide.

How Cyphere does both in one engagement

Most organisations that need CE Plus are better off treating the two certificates as one project. We agree the scope once, run a readiness review against the audit tests before you submit the self-assessment, and book the audit with our in-house IASME-licensed assessor as soon as the basic certificate is issued. The remediation work is done once, and you are not paying for a second scoping conversation a month later.

Get a fixed Cyber Essentials Plus quote

FAQs

What is the difference between Cyber Essentials and Cyber Essentials Plus?

The difference is verification. Both assess the same five key controls. Cyber Essentials is a self-assessment marked by an independent assessor; Cyber Essentials Plus adds live technical testing of cyber security controls on a sample of your devices and every cloud service. Cyber Essentials typically involves lower costs and faster turnaround times.

What is Cyber Essentials Plus?

Cyber Essentials Plus is the higher of the two levels of the Cyber Essentials scheme. After the self-assessment, an assessor tests your key controls through an external vulnerability scan, a patch scan of sampled devices, malware tests to ensure you have robust antivirus solution, MFA checks and an account separation check.

Do I need Cyber Essentials before Cyber Essentials Plus, or can I go straight to Plus?

A valid Cyber Essentials certificate on the same scope comes first, and the Plus audit must be completed within 90 days of it. You can buy Plus as a single engagement, but the self-assessment still happens first; a Plus package sequences the two so the window is met.

Are the requirements different for Cyber Essentials Plus?

No. The five key controls and their requirements are identical at both levels. Plus adds independent testing of the same rules, not extra rules. The full requirements are in our Cyber Essentials requirements guide.

How much do Cyber Essentials and Cyber Essentials Plus cost?

Basic is £500 to £700 + VAT, an IASME fee set by organisation size; Plus with Cyphere is from £1,299 + VAT, or £999 + VAT alongside an eligible security engagement. You must renew Cyber Essentials annually to maintain certification.

Is Cyber Essentials Plus worth it?

It is worth it when a buyer asks for it, when you are an in-scope NHS Supply Chain supplier or need DCC Level 2 or 3, or when you want independent proof that the key controls work. If nobody is asking and budget is tight, basic certification plus genuine remediation is the better use of the money.

Do I need Cyber Essentials Plus for UK government contracts?

Not always. PPN 014 requires Cyber Essentials certification and lets the contracting authority choose basic or Plus according to the risk of the contract, so the tender will say which. NHS Supply Chain and DCC Levels 2 and 3 are the common cases where they expect their suppliers to hold Cyber Essentials Plus certification.

Can I fail Cyber Essentials Plus after passing Cyber Essentials?

Yes. The self-assessment captures what you believe is in place; the audit checks what is there. The usual causes are the three automatic-fail areas (unsupported software, a cloud service without MFA, and high or critical updates not applied within 14 days), plus anti-malware software that is installed but not blocking, and admin accounts used for everyday work.

What is the difference between ISO 27001 and Cyber Essentials Plus?

Cyber Essentials Plus independently tests five technical controls. ISO 27001 certifies a full information security management system covering governance, risk, people and physical security. Neither replaces the other. See Cyber Essentials vs ISO 27001.

Related Cyber Essentials guides

• What is Cyber Essentials?
• Cyber Essentials requirements: the five controls in detail
• Cyber Essentials Plus requirements: what the audit tests
• Cyber Essentials cost
• Cyber Essentials self-assessment
• Cyber Essentials renewal