Both certify the same five security controls. The difference is who checks. Cyber Essentials is a self-assessment your business completes and a certification body verifies. Cyber Essentials Plus adds an independent technical audit, where an assessor tests a sample of your devices, your internet gateways and your internet-facing servers to confirm the controls actually work. If a customer, a tender or a regulator asks for independent evidence, you need Plus. If nobody is asking yet and you want a sensible baseline, start with Cyber Essentials.
Here is how to decide, what each costs, what the five controls actually require, and how to pass first time.
What both cover
The scheme is run by the National Cyber Security Centre and delivered through IASME. The five controls are the same at both levels.
Firewalls. Every device and the network boundary has a firewall configured to block unsolicited inbound connections.
Secure configuration. Default passwords changed, unnecessary software and accounts removed, devices locked after inactivity.
Access control. Users have only the access they need, administrator accounts are separate and used only for admin, and multi-factor authentication is on where it should be.
Malware protection. Anti-malware on every device, kept current, or an equivalent control such as application allow-listing.
Patch management. Security updates applied within 14 days of release, on every device and piece of software in scope, and unsupported software removed.
Get those right and you shut out the large majority of common, untargeted attacks, which is the point of the scheme. None of them is exotic. All of them are routinely neglected.
The practical difference
With Cyber Essentials you answer a questionnaire honestly and an assessor reviews the answers. You are certifying that you have the controls in place. The questionnaire is detailed, around 90 questions, and it asks for specifics, which devices, which versions, which settings.
With Plus, someone comes and checks. They run vulnerability scans on your internet-facing systems, test a sample of devices, confirm the patching is as current as you said, and check that malware protection actually catches a test file. You are no longer certifying. You are being verified. Plus requires a current basic certificate first, and the audit has to happen within a short window of it.
That independent check is why Plus carries more weight with customers and in procurement. A self-assessment says you believe you are secure. An audit says someone checked.
What they cost
Basic Cyber Essentials is priced by organisation size and typically runs a few hundred pounds plus VAT, from around £320 for the smallest firms up to around £600 for the largest, before any help you buy to get ready. Plus runs from roughly £1,500 plus VAT upwards, driven by assessor time, and larger or more complex environments pay more.
Treat those as indicative and check the current IASME fees, because certification bodies set their own charges on top. The bigger cost for most firms is the preparation, which depends entirely on how far from the five controls you currently are.
Which you need
Choose Cyber Essentials if you are starting out, nobody has asked for audited proof, and you want a sensible baseline with a certificate to show for it. It is also a prerequisite for Plus, so nothing is wasted.
Choose Plus if you bid for public-sector or regulated work, if a bank or a large customer has asked for independent evidence, or if you handle data where a breach would be serious. In those situations the basic certificate is increasingly read as a starting point rather than an answer. Our fintech Cyber Essentials piece covers the regulated case in detail.
A third option is neither. If you are being asked for ISO 27001 by name, Cyber Essentials will not satisfy that, though it is a sensible first step towards it. Our piece on ISO 27001 for SMEs covers when that bigger standard is worth it.
What this looks like in practice
A 40-person professional services firm has never been certified. A client sends a security questionnaire asking for Cyber Essentials Plus. The firm has 60 days.
Week one, a gap check against the five controls. Findings. Two staff using the same admin login. Six laptops three months behind on updates. A file server on an operating system that went out of support last year. No multi-factor authentication on email.
Weeks two to four, fixes. Separate admin accounts. A patching schedule with a named owner. The old server retired. MFA on everything. Anti-malware checked on every device.
Week five, the Cyber Essentials questionnaire, answered honestly against the now-fixed estate. Certificate issued.
Weeks six to eight, the Plus audit. The assessor scans, tests a sample of laptops, confirms patching. Passes.
The client is satisfied, the firm is genuinely more secure, and the whole thing cost a few thousand pounds and about 15 days of internal time. Without the deadline it would have drifted for another year.
How to pass first time
Fix the five controls properly before you apply, rather than treating the questionnaire as the fix. Most failures are patching gaps and devices nobody knew were still on the network. Do an honest inventory first, every laptop, every phone used for work, every server, every cloud service.
Define the scope carefully. You can certify the whole organisation or a defined part of it. A tight, honest scope is easier to pass and still useful. A vague scope is how people fail on a forgotten device.
Put one person in charge. Certification drifts when it is everyone’s job.
For Plus, do a dry run. A vulnerability scan of your own internet-facing systems before the assessor arrives finds most of what they would find.
The honest caveats
Neither level makes you secure. They make you resistant to common attacks and give you proof of it. A determined, targeted attacker is a different problem. Also, Plus can be failed, and a failed audit means paying again, so the preparation matters.
The certificate lasts 12 months. Treat renewal as a check that the controls are still in place, because they decay. The firm that passed last year with a tidy estate has usually acquired a few unpatched devices since.
The common mistakes
Answering the questionnaire optimistically. The assessor checks, and Plus checks harder.
Forgetting the phones. Work email on a personal phone brings that phone into scope.
Letting the IT provider own it entirely. They can do the technical work. Someone in the business needs to own the certification and understand what it means.
Treating it as a one-off. The value is in keeping the controls in place, and the renewal is the discipline that makes that happen.
A technology review finds the gaps first. If nobody senior owns security in your business, our piece on Cyber Essentials and the fractional CTO explains how that gets handled without a full-time hire.
Frequently asked questions
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Both certify the same five controls. Cyber Essentials is a verified self-assessment. Plus adds an independent technical audit that tests your devices and internet-facing systems to confirm the controls work.
How much does Cyber Essentials Plus cost?
Typically from around £1,500 plus VAT upwards, depending on the size and complexity of your environment, on top of the basic certificate. Check current IASME fees, as certification bodies add their own charges.
Do I need Cyber Essentials before Plus?
Yes. Plus requires a current basic certificate, and the audit must take place within a short window of it.
How long does it take?
Basic certification can be done in a few weeks if the controls are in place. Plus typically takes two to three months including preparation. Firms far from the five controls need longer to fix the gaps first.
What are the five Cyber Essentials controls?
Firewalls, secure configuration, access control, malware protection and patch management. They are the same at both levels and they block most common, untargeted attacks.
Is Cyber Essentials enough for a small business?
As a baseline, yes, and it shuts out most common attacks. If a customer, tender or regulator asks for independent evidence, you will need Plus. If they ask for ISO 27001 by name, you will need that instead.