Contracts and tenders
Evidence, not description.
Public sector and supply chain contracts increasingly ask for Plus rather than the base certificate.
Licensed IASME Certification Body
Cyber Essentials Plus certification
Independent technical testing that proves your Cyber Essentials controls work in practice, not just on paper. We carry out the audit ourselves and issue your certificate directly, so there is no hand-off to a third party.
Pricing
Published, by organisation size.
New applicants take both certifications. If you already hold a recent Cyber Essentials certificate, you may only need the audit.
| Organisation | Staff | Plus audit only | Both, new applicant |
|---|---|---|---|
| Micro | 0 to 9 | £1,095 + VAT fixed | £1,415 + VAT |
| Small | 10 to 49 | £1,395 + VAT fixed | £1,835 + VAT |
| Medium | 50 to 249 | From £1,750 + VAT | From £2,250 + VAT |
| Large | 250 or more | From £2,500 + VAT | From £3,100 + VAT |
The Plus audit must be completed within three months of your Cyber Essentials certification. Larger estates are scoped before quoting, and the Cyber Essentials fee itself is set by IASME and is the same at every certification body. Full detail is in the Cyber Essentials cost guide.
Why organisations need it
When declared is not enough.
Cyber Essentials shows you have answered the questions honestly. Cyber Essentials Plus shows an independent assessor has checked that the answers are true.
Discuss your assessmentDefence supply chains
Required from Level 2.
Defence Cyber Certification requires Plus from Level 2 upwards, so plan both certifications together. DEFCON 658 explained
Customers and insurers
One line answers it.
When a supplier assessment or an insurer asks how you know your controls work, an independently tested certificate is the answer.
Your own assurance
Know, rather than believe.
Confidence that patching, malware protection and access controls work across the whole estate, not just on paper.
What the audit checks
The five controls, tested on your systems.
The assessor tests a representative sample of your devices and services against the current Cyber Essentials Plus test specification.
| Check | What it confirms |
|---|---|
| External testing | Your internet-facing systems do not expose vulnerabilities or unnecessary services |
| Device patching | High and critical security updates are applied within the required timescales |
| Malware protection | Protection detects and blocks test files delivered by email and through the web browser |
| Account controls | Users do not hold unnecessary administrative rights, and administrator accounts are separate |
| Multi-factor authentication | Cloud services in scope enforce multi-factor authentication as declared |
Cyber Essentials Plus is not a penetration test. It verifies the five controls rather than looking for every possible way into your business. If you need an application or infrastructure tested in depth, that is penetration testing, and we explain the difference in Cyber Essentials Plus vs penetration testing.
What changed in April 2026
Two changes worth knowing before you book.
01
Your answers are locked
Your Cyber Essentials self-assessment must be final before Plus testing begins, and it cannot be changed afterwards. Accurate answers before booking matter more than ever.
02
Patching is checked twice
If testing finds missing updates, the assessor retests the failed devices and also checks a second random sample. The same vulnerabilities in both fail Plus and revoke Cyber Essentials, so patching has to be routine, not a pre-audit catch-up.
How it works
From first conversation to certificate.
Scope and timing
We confirm your Cyber Essentials certificate date, your scope and the devices the sample will be drawn from, so you know how much time you have.
Preparation
You get a clear list of what to have ready: access, the right people available, and the controls the audit will check.
The audit
Remote as standard, on site anywhere in the UK where that suits the environment or your preference better.
Your certificate
Issued directly by us when you pass. If something needs fixing, we tell you exactly what and why, then retest under the current rules.
Who carries out your audit
Assessed by people who test for a living.
Every Cyber Essentials Plus audit is carried out by a qualified Malwise assessor, working directly for the certification body that issues your certificate. Nothing is subcontracted or passed to a third party.
Our assessors combine certification work with hands-on security testing experience. That matters on the day: an assessor who tests for a living understands what the checks are really looking for, and can explain a finding in terms your team can act on.
Can I get Cyber Essentials Plus without Cyber Essentials?
No. Plus builds on a current Cyber Essentials certificate and must be completed within three months of it. New applicants take both, using the combined prices above.
Is the audit remote or on site?
Remote as standard, with on-site attendance where the environment or your preference makes it more practical. We work across the UK.
What happens if something fails?
We tell you exactly what failed and why. You fix it and we retest. For patching failures, the April 2026 rules add a second random sample, which is why keeping the whole estate patched routinely matters.
How long does it take?
Mostly as long as preparation takes. Once access is arranged, the audit itself is a small part of the process. Our timescale guide covers planning around a deadline.
Do you carry out the remediation?
Usually your own team or IT provider makes the changes, since they know the estate. We tell you precisely what is needed, and can help where you want it.