Cyber Essentials vs Cyber Essentials Plus: Which Certification Do You Need?

If you've looked into improving your business's cybersecurity — or you've been asked to demonstrate it for a contract or tender — you've probably come across Cyber Essentials. But there are two levels: Cyber Essentials and Cyber Essentials Plus. They sound similar, and the difference isn't always obvious at first glance.

This guide explains what each certification covers, how they differ, and which one makes sense for your business. If you're new to the scheme entirely, our Cyber Essentials certification guide covers the fundamentals in detail.

What Is Cyber Essentials?

Cyber Essentials is a UK government-backed cybersecurity certification scheme. It was introduced to help organisations of all sizes protect themselves against the most common cyber threats — the attacks that account for the vast majority of breaches.

The scheme focuses on five key technical controls:

• Firewalls — securing the boundary between your network and the internet
• Secure configuration — ensuring devices and software are set up securely
• User access control — limiting who can access what, and with what privileges
• Malware protection — defending against viruses, ransomware, and other malicious software
• Security update management — keeping software patched and up to date

These aren't exotic, advanced security measures. They're the basics — but they're the basics that a staggering number of businesses still get wrong.

Cyber Essentials (Standard): The Self-Assessment

Cyber Essentials at the standard level is a self-assessment. Your business completes a questionnaire about how you've implemented the five technical controls. A qualified assessor then reviews your answers and, if everything meets the required standard, issues the certification.

What's involved

• You complete an online self-assessment questionnaire
• The questionnaire covers all five control areas
• A certification body reviews your submission
• No physical or technical testing of your systems takes place
• Certification is valid for 12 months

The standard level is the entry-level option in terms of both cost and effort. Most small businesses can achieve it within a few weeks, depending on how much remediation is needed to bring their systems up to standard.

Cyber Essentials Plus: The Verified Audit

Cyber Essentials Plus builds on the standard certification by adding independent, hands-on technical verification. Instead of just taking your word for it, a qualified assessor actually tests your systems to confirm the controls are working as described.

What's involved

• You must first hold a current Cyber Essentials (standard) certificate
• An assessor conducts on-site or remote technical testing
• Testing includes vulnerability scans of your external IP addresses
• Assessors check a sample of your devices for secure configuration
• They verify that malware protection is active and effective
• They test that user access controls are properly implemented
• Certification is valid for 12 months

What the Cyber Essentials Plus Audit Actually Tests

The Plus assessment follows a published test specification. In practice, the assessor checks:

1. Your internet-facing systems: an external vulnerability scan of your public IP addresses and services.
2. Patching on a sample of devices: an authenticated scan of laptops, desktops and servers. High and critical security updates must be applied within 14 days of release, and unsupported software such as Windows 10 without Extended Security Updates is a fail.
3. Malware protection: that anti-malware is running and up to date on the sampled devices.
4. Email and web defences: test files are sent by email and downloaded in a browser to check harmful files are blocked or warned about.
5. Multi-factor authentication: that MFA is switched on for cloud services such as Microsoft 365 and Google Workspace.
6. Admin accounts: that people use standard accounts day to day, with admin rights kept separate.

Side-by-Side Comparison

Government Contracts and Cyber Essentials

One of the most common reasons businesses pursue Cyber Essentials is that it's required for certain government contracts. Since 2014, the UK government has mandated that suppliers bidding for contracts involving the handling of sensitive or personal data must hold at least Cyber Essentials certification.

For more detail on which contracts require it and how to position your business, see our guide on whether you need Cyber Essentials for government contracts.

While standard Cyber Essentials meets the minimum requirement for most government contracts, some contracts — particularly those involving more sensitive data or higher-risk environments — may specify Cyber Essentials Plus. It's worth checking the specific requirements of any tender you're interested in.

Which One Do You Need?

The right choice depends on your business's circumstances, your clients' expectations, and the level of assurance you want to demonstrate.

Cyber Essentials (standard) is right if you:

• Want to establish baseline cybersecurity practices
• Need to meet the minimum requirement for government contracts
• Are looking for a cost-effective starting point for formal security certification
• Want to demonstrate to clients and partners that you take security seriously
• Are a small business looking to reduce your exposure to common attacks

Cyber Essentials Plus is right if you:

• Handle sensitive client data and want independently verified protection
• Bid for government contracts that specifically require Plus
• Work in sectors where clients expect a higher level of security assurance (legal, financial, healthcare)
• Want the confidence that your controls have been tested by an external party, not just self-declared
• Need to satisfy cyber insurance requirements that mandate verified certification

Our Recommendation

Whichever level you pursue, the process of getting certified is valuable in itself. It forces you to review your security practices, close gaps, and build habits that protect your business long after the certificate is issued.

The Certification Process: What to Expect

For the standard level, the process is straightforward. You'll work through the self-assessment questionnaire, which asks detailed questions about how your organisation implements each of the five controls. If you're working with an MSP, they'll typically help you prepare — identifying gaps in your current setup and resolving them before you submit.

For Plus, the additional technical assessment usually takes a day or two, depending on the size of your organisation. The assessor will scan your external-facing systems, check a sample of devices, and verify your controls in practice. If issues are found, you'll have a window to remediate and re-test.

Both certifications are valid for 12 months, after which you'll need to recertify. This annual cycle is actually a strength — it ensures your security practices stay current rather than becoming a one-time box-ticking exercise.

How We Handle It

We get businesses ready for both levels. We check your devices, cloud accounts and firewall against the current requirements, fix the gaps, help you complete the self-assessment and, for Plus, run our own pre-audit checks so there are no surprises on the day. The certificate itself is awarded by an independent accredited certification body. See our Cyber Essentials and Cyber Essentials Plus services.