Cyber Essentials and Cyber Essentials Plus compared

Cyber Essentials and Cyber Essentials Plus check the same five controls against the same requirements. The difference is how they are checked. Cyber Essentials is a verified self-assessment: you describe your setup and an assessor marks your answers. Cyber Essentials Plus adds an independent technical audit, in which an assessor tests a sample of your systems to confirm the controls actually work. Plus is the higher level of assurance, and you can only take it after passing Cyber Essentials.

Side by side

What Plus adds

The NCSC Cyber Essentials Plus Test Specification sets out the tests. In summary, the assessor:

• scans your internet-facing IP addresses for exploitable services
• runs authenticated vulnerability scans on sampled devices to find critical or high-risk updates missing for more than 14 days
• checks malware protection, including sending test files by email and through the browser
• watches users sign in to your cloud services to confirm MFA is prompted
• checks that standard users cannot run admin tasks without separate credentials

See What Cyber Essentials Plus tests for the detail.

Plus must be done on exactly the same scope as your Cyber Essentials certificate. If the self-assessment said every laptop has a software firewall and automatic updates, the audit is where that is proved. Answers that were true on paper but not in practice are what make Plus harder to pass.

Which level do you need?

• A customer or contract names one. Read the requirement carefully. Some public sector and defence contracts ask for Plus; many supply chain questionnaires ask for Cyber Essentials only.
• You want evidence for your own board or insurers. Plus gives independent proof that the controls work, not just that they are claimed.
• You are starting out. Cyber Essentials is the first step either way. Many organisations certify Cyber Essentials first and then decide on Plus within the three-month window.

Timing matters

Because Plus has to be completed within three months of the Cyber Essentials certificate, plan both together if you know you need Plus. Book the audit before you submit the self-assessment, and make sure your patching is current across the whole estate. See The three-month window for Plus.

Under the Danzell question set, every issue found in the self-assessment must be fixed before the Plus audit starts, and you cannot change your self-assessment answers based on what the audit finds. If the audit finds the same missing updates on the second sample as on the first, you lose both Plus and the underlying Cyber Essentials certificate.

Common questions

Is Plus a different standard? No. It is the same requirements, tested rather than declared.

Does Plus replace Cyber Essentials? No. You hold both certificates, and both run for a year. To renew Plus next year you renew Cyber Essentials first.

Can I go straight to Plus? No. A current Cyber Essentials certificate with the same scope is a prerequisite.

Where does the insurance come from? The included cyber insurance comes with Cyber Essentials certification, for eligible UK organisations that certify the whole organisation. Check the policy documents for what is covered.

To plan your route and get a price for either level, request a quote.