Cyber Essentials vs Cyber Essentials Plus: which does your business need?

Cyber Essentials is the UK government-backed scheme that shows your business is protected against the most common online attacks. It's run by the National Cyber Security Centre (NCSC), with IASME as its delivery partner, and certificates are issued by accredited certification bodies.

There are two levels: Cyber Essentials and Cyber Essentials Plus. They cover exactly the same requirements — the difference is in how your business is assessed.

The five controls both levels check

1. Firewalls — your internet connection and devices are protected by properly configured firewalls.
2. Secure configuration — devices and cloud services are set up securely, with default passwords changed and unnecessary software removed.
3. User access control — people only have the access they need, admin rights are limited, and multi-factor authentication protects cloud services.
4. Malware protection — devices are protected against viruses and other malicious software.
5. Security update management — operating systems and applications are supported and kept up to date.

The difference at a glance

Which one do you need?

Cyber Essentials is usually enough when a customer, supplier or insurer asks you to show a baseline level of security. Some UK government contracts that involve handling sensitive or personal information require it, and many private-sector supply chains now ask for it too.

Cyber Essentials Plus is worth it when a contract specifically asks for it, when you handle higher-risk data, or when you want independent proof that your controls actually work — not just that you say they do. Some public-sector and defence supply chains require Plus for higher-risk work.

Common reasons businesses fail

• Unsupported software still in use — older versions of Windows or applications that no longer receive security updates.
• Updates not applied quickly enough — critical and high-risk security updates need to be installed within 14 days of release.
• Multi-factor authentication missing on one or more cloud services.
• Everyday work done on admin accounts instead of separate accounts used only for admin tasks.
• Forgotten devices — personal phones and laptops used to access work email and data usually count too.
• Default passwords left on routers, firewalls or other equipment.

How to prepare

1. Agree the scope. Decide which parts of the business, devices and cloud services the certificate covers.
2. List everything. Devices, operating systems, software, cloud services and network equipment.
3. Fix the gaps. Replace unsupported software, apply updates, turn on MFA, remove unnecessary admin rights and change default passwords.
4. Answer the questionnaire carefully, with evidence ready to back up your answers.
5. For Plus, prepare for the audit — make sure the sample devices the assessor tests are fully patched and protected.
6. Keep it up all year. The controls should stay in place between renewals, not just on assessment day.

How much does it cost?

Certification fees are set by the scheme and depend on the size of your organisation, and Cyber Essentials Plus costs more because of the technical audit. The bigger cost is usually the work to get ready — which is why a readiness review first saves time and failed attempts.

We're Cyber Essentials Plus certified ourselves, so we know what assessors look for. Cyber Essentials support is built into our managed packages, and we also help businesses prepare as a one-off project.