Both levels certify against the same five technical controls. The difference is who checks that the controls are actually in place.
Cyber Essentials is a verified self-assessment: you answer the question set, a board member or equivalent confirms the answers are true, and a licensed assessor marks the submission.
Cyber Essentials Plus starts from that same certification and adds an independent technical audit, where an assessor tests a sample of your systems rather than taking your description of them. The Plus audit must be completed within three months of the underlying Cyber Essentials certification, so the two are planned together rather than treated as unrelated annual assessments.
That is the whole distinction. Everything below is detail.
What Cyber Essentials is
Certification against five technical control themes: firewalls, secure configuration, security update management, user access control and malware protection. The question set is public, the requirements are published, and the assessment is a review of your answers against them.
It is the recognised baseline. Many government contracts require it, insurers increasingly ask for it, and supply chain questionnaires treat it as the minimum. Our Cyber Essentials certification page covers how we deliver it.
What Cyber Essentials Plus is
The same five controls, verified independently.
An assessor examines a representative sample of your devices rather than the whole estate, and carries out the tests the scheme specifies: confirming patch levels meet the requirement, checking malware protection is present and working, and testing how your email client and web browser handle known malicious files. Account separation and authentication are confirmed rather than declared.
It follows a defined test specification, which is what makes a certificate issued by one certification body mean the same as one issued by another.
Side by side
| Cyber Essentials | Cyber Essentials Plus | |
|---|---|---|
| Assessment method | Verified self-assessment | Self-assessment plus technical audit |
| Independent technical verification | No | Yes |
| Device sampling | Not applicable | A representative sample of in-scope devices |
| Who assesses | Licensed certification body assessor | Licensed certification body assessor |
| Prerequisite | None | Cyber Essentials certification, with the Plus audit completed within three months |
| Certificate validity | 12 months | 12 months |
| Typical cost | £320 to £600 + VAT by size, set by IASME | Set by each certification body; ours starts at £1,095 + VAT |
| Typical timescale | Days once you are prepared | Longer, with a testing window to agree |
| Usually asked for by | Government contracts, insurers, supply chains | Defence, government and security-conscious customers |
Do I need Cyber Essentials before Cyber Essentials Plus?
Yes, and there is a time limit worth knowing about.
Cyber Essentials Plus starts with Cyber Essentials: you cannot skip the first level and go straight to the second. The Plus technical audit must be completed within three months of the underlying Cyber Essentials certification. Miss that window and the base certification has to be repeated before Plus can proceed.
In practice that means planning both at the outset rather than deciding on Plus months later: certify, agree the testing window while the clock is running, and leave room for remediation if the audit finds something. It also means not rushing the base certification in the hope of arranging Plus at leisure afterwards.
Which one does your customer actually mean?
This is the question behind most enquiries, and it is worth answering precisely.
Read the wording. A contract asking for “Cyber Essentials” means the base certification. One asking for “Cyber Essentials Plus” means the audited level, and the base certificate will not satisfy it.
If it is ambiguous, ask. Procurement teams are usually specific when asked, and it is considerably cheaper than discovering the answer after certifying.
Consider where you are heading. If your market is defence, government or a supply chain that is tightening, Plus is increasingly the level being requested. Certifying at the base level with Plus in mind means scoping the estate once rather than twice.
And if nobody has asked for either, Cyber Essentials on its own is the sensible place to start. It is the foundation for Plus, the prerequisite for IASME Cyber Assurance, and the highest-value security work per pound available to a small organisation.
Cost
The Cyber Essentials assessment fee is set by IASME and is identical at every certification body, on a sliding scale from £320 to £600 + VAT by organisation size. Cyber Essentials Plus is priced by each certification body, so it varies.
Our prices for both levels, and where the rest of the money usually goes, are in the Cyber Essentials cost guide.
How long does it take?
For a prepared organisation, the base certification can be completed inside a working week. Plus adds time to agree a testing window and carry out the audit, and must be completed within three months of the base certification, which makes the sequencing a planning matter rather than an afterthought.
The variable is rarely the assessment. It is how long remediation takes if something needs fixing, which is covered in how long Cyber Essentials takes.
Scope applies to both
Both levels certify a defined boundary, and that boundary is decided the same way for each: every device that accesses organisational data, every cloud service holding it, and everyone using them.
Get this right before either assessment. Our Cyber Essentials scope guide covers whole organisation versus subset, cloud services, home working and the device ownership rules.
Get certified
We are a licensed IASME certification body for both levels, so the assessment and the certificate come from the same place rather than being passed on. Remote as standard, on site anywhere in the UK where that suits you better.
Get in touch or call 01722 445972 and we will tell you which level your situation calls for, and whether you would pass today. Full detail and published pricing is on our Cyber Essentials certification page.