Blog › Article
Cyber Essentials or Cyber Essentials Plus?
They cover exactly the same requirements. The difference is who checks the answers: with Cyber Essentials you declare that the controls are in place; with Cyber Essentials Plus an assessor tests that they are.
Cyber Essentials vs Cyber Essentials Plus at a glance
| Cyber Essentials | Cyber Essentials Plus | |
|---|---|---|
| Requirements | The five technical controls | The same five controls |
| How it's assessed | Self-assessment questionnaire, reviewed by an assessor | Technical audit of your systems by an assessor |
| What's checked | Your answers | Your machines |
| Typical cost | £320–£600 + VAT, set by organisation size | Usually £1,500–£3,000 + VAT, set by the certification body |
| Prerequisite | None | A current Cyber Essentials certificate, within the last three months |
| Valid for | Twelve months | Twelve months |
What Cyber Essentials involves
You answer a questionnaire about scope and the five controls — firewalls, secure configuration, security update management, user access control and malware protection — and a board-level director or equivalent signs to say the answers are true. An assessor reviews them and, if they meet the requirements, issues the certificate.
It's quick and inexpensive, and for many organisations it's all a contract asks for. Its weakness is also its design: it records what the organisation says, on the day it says it. See Cyber Essentials requirements in 2026 for what each control asks.
What Cyber Essentials Plus adds
Plus keeps the same requirements and adds verification. An assessor tests a sample of your devices and what faces the internet, rather than taking the questionnaire on trust. That typically means:
- scanning your internet-facing systems for known vulnerabilities;
- checking a sample of devices for missing updates and unsupported software;
- testing that malware protection actually stops malicious files;
- confirming that MFA is really enforced on cloud accounts.
Because real machines are tested, Plus finds the gaps a questionnaire can miss: the laptop three weeks behind on updates, the account without MFA, the antivirus that was switched off months ago. Since April 2026, a second sample is taken to check that any fixes were applied across the estate, not just to the machines tested first.
Most Plus failures aren't about knowledge. The organisation usually knows what the controls require. What it doesn't know is which of its machines has drifted since it last looked. The sample the assessor picks is not the sample you'd have picked.
Which one do you need?
Cyber Essentials is usually enough when
- a customer or tender asks for "Cyber Essentials" without specifying Plus;
- you want a baseline and the bundled cyber insurance for eligible organisations;
- it's your first certification and you want to find the gaps first.
Cyber Essentials Plus is worth it when
- a contract specifically requires Plus, which is increasingly common in public-sector and supply-chain work;
- you handle sensitive data and want independent assurance rather than a declaration;
- you want to know, not assume, that the controls work on every machine.
Doing both in one go
Plus has to be completed within three months of the Cyber Essentials certificate, so most organisations buy them together. The sensible order is to fix the estate first, submit Cyber Essentials, then book the Plus audit while the answers are still fresh and still true. See what Cyber Essentials costs for a fuller breakdown.
The risk in that three-month window is drift: something that was true when you answered the questionnaire may not be true when the assessor arrives. Knowing each machine's state continuously, rather than on the day you submit, is what makes the audit a formality.
Quick answers
Is Cyber Essentials Plus harder to pass?
The requirements are the same, but Plus is tested, so anything that isn't actually in place is found. Organisations that genuinely meet the controls on every machine find it straightforward.
Can I go straight to Cyber Essentials Plus?
No. You need a current Cyber Essentials certificate first, and Plus must be completed within three months of it.
Does Plus last longer than Cyber Essentials?
No. Both are valid for twelve months and need renewing each year.