Cyber Essentials and Cyber Essentials Plus are two levels of the same UK government-backed scheme, and the difference matters more than many businesses realise. Both cover the same five technical controls — but the way they are assessed is very different, and so is the assurance they provide. If you are bidding for public sector contracts, tightening cyber insurance, or simply want a credible baseline, choosing the right level saves time and avoids a failed assessment. This guide explains what each certification involves, what they cost, and how to decide which one your London business actually needs.
What Cyber Essentials and Cyber Essentials Plus have in common
Both certifications are part of the same National Cyber Security Centre (NCSC) scheme, administered by IASME. Both assess the same five technical control areas: firewalls, secure configuration, user access control, malware protection, and security update management. The standard your organisation must meet is identical — the difference lies entirely in how that standard is verified.
These five controls are designed to protect against the most common internet-based threats, such as phishing, opportunistic malware and credential attacks. They are deliberately practical rather than exhaustive, which is why the scheme is achievable for small and medium businesses without a large security team.
Both certifications are valid for 12 months and cover your whole organisation or a clearly defined subset (a scope). Getting the scope right early is one of the most important steps, because it determines exactly which devices, cloud services and users are assessed. Many businesses combine certification with ongoing cyber security services so the controls stay in place all year, not just at audit time.
How the two certifications are assessed
Cyber Essentials is a self-assessment. You complete a detailed questionnaire covering the five controls, and a senior person in your organisation signs a declaration confirming the answers are accurate. A qualified assessor from a certification body reviews your responses and either passes you or asks for remediation. There is no external testing of your systems.
Cyber Essentials Plus includes everything in the base certification, plus hands-on technical verification. An assessor independently checks a sample of your devices and cloud services — running vulnerability scans, testing that malware protection works, confirming multi-factor authentication is enforced, and verifying that patching is up to date. You must hold a valid Cyber Essentials certificate before you can take the Plus assessment, usually within the previous three months.
In short: Cyber Essentials asks 'do you say you meet the standard?' while Cyber Essentials Plus asks 'can we confirm you actually do?' That independent verification is what gives Plus its extra credibility with clients, insurers and public sector buyers.
Cyber Essentials vs Cyber Essentials Plus at a glance
- Assessment method — Cyber Essentials: self-assessment questionnaire; Plus: self-assessment plus independent technical audit
- Independent testing — Cyber Essentials: none; Plus: vulnerability scans and hands-on checks on a device sample
- Cost — Cyber Essentials: tiered by organisation size, starting from a few hundred pounds; Plus: additional assessor fee on top, typically several times higher
- Time to achieve — Cyber Essentials: days to a couple of weeks; Plus: longer, as an audit must be scheduled and remediation completed
- Level of assurance — Cyber Essentials: basic self-declared; Plus: verified, higher assurance
- Best suited to — Cyber Essentials: baseline compliance and lower-risk supply chains; Plus: contracts and clients that demand proof
When Cyber Essentials (self-assessment) is enough
For many small businesses, the base Cyber Essentials certification is a sensible and proportionate starting point. It demonstrates that you have implemented the fundamental controls, it is quick to achieve, and it costs far less than Plus. If a tender or client contract simply requires 'Cyber Essentials', you do not need to jump to Plus.
It is also a good first step if your internal controls are not yet mature. Going straight for Plus when your patching, device configuration or endpoint security are inconsistent risks a failed audit and wasted assessor fees. Achieving the base level first lets you find and fix gaps before independent testing.
That said, self-assessment relies on the accuracy of your answers. If you are unsure whether your Microsoft 365 tenant, laptops and firewalls genuinely meet the standard, it is worth a technical review before you sign the declaration. A confident pass depends on real evidence, not optimistic answers.
When you need Cyber Essentials Plus
Cyber Essentials Plus is the right choice when someone else needs proof that your controls work, not just your word for it. This is increasingly common in public sector procurement, larger commercial supply chains, and regulated sectors such as legal, financial and healthcare services. Some contracts specify Plus explicitly, particularly where you handle sensitive or personal data.
Cyber insurance is another driver. Insurers increasingly ask about your security posture, and holding Plus can support your application or improve terms because it evidences independently verified controls. If you have suffered an incident or near-miss, Plus also gives your board genuine assurance rather than a paper exercise.
Because Plus involves testing real devices, it exposes weaknesses that self-assessment can miss — unpatched software, misconfigured accounts, or gaps in identity protection. Many London businesses find the audit itself valuable, regardless of the certificate, because it surfaces issues before an attacker does.
Preparing for a successful assessment
Preparation is where most of the effort lies, and it is largely the same for both levels. Start by defining your scope precisely — which sites, cloud services, servers, laptops and mobile devices are included. A vague or overly broad scope creates unnecessary work and increases the chance of failure. Bring-your-own-device and home working arrangements need particular care, as they are often overlooked.
Then work through the five controls methodically. Confirm firewalls are enabled and unnecessary services are closed, remove default passwords and unused accounts, enforce multi-factor authentication, ensure malware protection is active on every in-scope device, and check that operating systems and applications are receiving security updates within the required timescales — typically 14 days for critical fixes. Consistent remote IT support and patch management make this far easier to sustain.
Keep evidence as you go: device inventories, patch reports, configuration screenshots and access policies. For Plus especially, an assessor will want to see that these controls are genuinely operating. Fixing issues before the audit is far cheaper than a re-test. If your team is stretched, co-managed IT support can supplement your internal resource during the run-up.
How CLI Secure helps London businesses certify with confidence
We help UK businesses achieve both Cyber Essentials and Cyber Essentials Plus by getting the groundwork right first. That means reviewing your scope, assessing your current controls against the five requirements, and remediating the gaps before you commit to an assessment — so you pass first time rather than paying for re-tests.
Because certification is a snapshot in time, we focus on controls that hold up all year. Enforced patching, managed network security, device hardening and identity controls keep you compliant beyond the audit date and reduce your real-world risk, not just your paperwork. That continuity matters most when your next renewal or a new contract requirement arrives.
Whether you need a straightforward self-assessment to satisfy a tender, or the higher assurance of Plus for a demanding client, we can guide you through the process and keep the technical work manageable. If you'd like to discuss which level fits your requirements, get in touch and we'll give you a straight answer.