Cyber Essentials vs Cyber Essentials Plus: what is the difference?

Both certifications test the same five technical controls. The difference is not what is measured, but who checks.

Cyber Essentials: you tell them

The base level is a self-assessment questionnaire, signed off by a senior person in your organisation and reviewed by a certifying body. You answer honestly about your firewalls, your patching, your user accounts, your malware protection and your device configuration. Nobody visits.

This is not a soft option — you are making a formal declaration — but it does rely on you knowing the truth about your own systems. Plenty of organisations discover mid-questionnaire that they do not.

Cyber Essentials Plus: they check

Plus starts with the same questionnaire, then adds an independent technical audit. An assessor tests a sample of your devices and cloud services: are patches actually applied, does the malware protection actually catch a test file, are the accounts actually configured as you said? It typically follows within three months of the base certificate.

It costs more and takes longer. In exchange, it is genuinely verified — which is why some contracts, particularly in the public sector and in supply chains handling sensitive data, will accept nothing less.

The five controls, either way

1. Firewalls — boundary protection, properly configured.
2. Secure configuration — no default passwords, no unnecessary services running.
3. User access control — people have the access they need and no more; admin accounts are used for admin only.
4. Malware protection — present, updating, on everything.
5. Security update management — supported software, patched within 14 days for critical fixes.

Which do you need?

Read the contract. If a tender or a client specifies Plus, base-level certification will not do. If nothing specifies either, start with base Cyber Essentials, get the controls genuinely right, and step up to Plus when a contract requires it — you will pass far more comfortably second time round.

Either way, the honest first move is to find out where you currently stand. We will audit your setup for free and tell you what needs doing before you spend a penny on certification.