Most UK SMEs should start with Cyber Essentials and only add Cyber Essentials Plus when a customer, tender or insurer asks for independent technical proof. Both certificates cover the same 5 controls. The difference is how those controls are checked. Cyber Essentials is a verified self-assessment, while Cyber Essentials Plus adds a hands-on technical audit of your real devices and systems. The rules also tightened in April 2026, so it is worth understanding the current position before you set a budget.
The short answer
Choose Cyber Essentials if you need a recognised baseline that shows customers you have the basics covered. Choose Cyber Essentials Plus if a contract, regulator or large client wants independent evidence that your controls work in practice. Plus builds on the basic certificate, so you will normally hold both, usually in that order.
What both certifications have in common
Both levels are backed by the National Cyber Security Centre and delivered through IASME. They test the same 5 technical controls, which the NCSC sets out on its Cyber Essentials overview.
- Firewalls And Internet Gateways
- Secure Configuration Of Devices And Software
- Security Update Management
- User Access Control
- Malware Protection
Both certificates last 12 months, so you renew every year whichever level you choose. Neither one is a legal requirement for most businesses, but both have become a common way to answer supplier questionnaires without writing a new response every time.
How the two levels differ
With Cyber Essentials you complete a detailed questionnaire about your setup. A board member or equivalent signs off the answers and an assessor marks them. With Cyber Essentials Plus a certification body goes further and tests your systems directly.
| Cyber Essentials | Cyber Essentials Plus | |
| How it is checked | Verified self-assessment marked by an assessor | Technical audit by a certification body |
| What is tested | Your answers about the 5 controls | A sample of user devices, all internet gateways and internet-facing servers |
| Fees | Fixed by IASME, from £320 plus VAT | Quoted by the certification body |
| Valid for | 12 months | 12 months |
| Starting point | Can be done on its own | Needs a verified self-assessment first |
| Typical timescale | Around 4 to 8 weeks from first conversation | A further 2 to 4 weeks |
The independence is the real difference. A questionnaire tells an assessor what you say is true. A technical audit shows whether it is.
What the Plus audit actually checks
Cyber Essentials Plus is an independent technical audit of the same 5 controls. The auditor checks a representative sample of your user devices, every internet gateway and every server with services reachable from the internet. It confirms that what you described in your questionnaire matches how your systems really behave.
In practice an assessor will typically look at the following.
- External Checks On Your Internet Facing Systems
- A Sample Of Laptops, Desktops And Phones
- Patch Levels Across Your Estate
- Multi Factor Authentication On Cloud Services
- Evidence That Malware Protection Is Working
You do not get to pick the sample, which is why a half-ready estate gets expensive. Every retest costs time and often money.
What changed in April 2026
The Danzell question set applies to assessment accounts created after 26 April 2026, according to the IASME update on the 2026 changes. Organisations with an account opened before that date have 6 months to certify under the previous requirements. Three changes matter most.
- MFA is now mandatory for all cloud services where it is available, and missing it is an automatic fail
- Cloud services can no longer be excluded from scope
- High-risk and critical updates must be applied within 14 days of release, with two new automatic fail questions covering operating systems, router and firewall firmware and applications
There are also Plus-specific changes. If you fail the update management sample test, the retest uses a new random sample, and a second failure revokes your verified self-assessment certificate. Your answers also cannot be changed once Plus testing begins.
That makes your Microsoft 365 tenant part of the conversation from day one. We have covered the detail in our guides on Cyber Essentials cloud scope for Microsoft 365, how Cyber Essentials v3.3 treats Copilot and ChatGPT use and passkeys, FIDO2 and Cyber Essentials. If you are wondering whether your current patching routine will hold up, our piece on the 72-hour patch window is a useful reality check.
How much each level costs
IASME sets the Cyber Essentials fee by organisation size, and these are the current IASME certification fees.
| Organisation size | Cyber Essentials fee (excluding VAT) | Cyber Essentials Plus |
| 0 to 9 employees | £320 | Quoted by certification body |
| 10 to 49 employees | £440 | Quoted by certification body |
| 50 to 249 employees | £500 | Quoted by certification body |
| 250 or more employees | £600 | Quoted by certification body |
Plus is priced by the certification body according to the size and complexity of your network. Quotes typically start at around £1,500 plus VAT and rise with the number of devices, sites and servers in scope, so ask for a written quote based on your actual estate.
The fee is rarely the biggest cost. The larger spend is usually fixing what the assessment finds, such as replacing laptops that no longer get security updates, buying licences that unlock MFA or moving staff off shared admin accounts. A quick zombie tech audit of old routers, cameras and office devices will show you how much of that work is waiting for you.
When customers, contracts and insurers ask for each level
Central government buyers follow Procurement Policy Note 014, which applies from 24 February 2025. It asks buyers to require Cyber Essentials or Cyber Essentials Plus, or equivalent controls, on contracts that involve things like citizens’ personal information, government staff data or systems handling OFFICIAL information. It sets no minimum contract value, and it tells buyers to be proportionate rather than asking for it by default.
So the honest answer is to read the tender wording. Some will name Cyber Essentials, some will name Plus and some will accept equivalent evidence. Other private buyers set their own rules.
For insurance, eligible UK organisations with turnover under £20m that certify their whole organisation receive cyber liability insurance arranged by IASME, including 24/7 incident response support. That is a useful extra, but insurers still ask their own questions at renewal. Our article on cyber insurance renewals, MFA and old PCs explains what underwriters tend to focus on.
Professional services firms often meet this through client due diligence rather than a tender. If that sounds like you, our pages on IT support for law firms and IT support for financial services cover the wider security expectations in those sectors.
Which one should you choose
| Your situation | Likely fit |
| Answering customer security questionnaires | Cyber Essentials |
| Renewing cyber insurance | Cyber Essentials, then check your insurer’s questions |
| Bidding for government work involving personal or OFFICIAL data | Read the tender, then Cyber Essentials or Plus |
| A large client or regulator wants independent technical evidence | Cyber Essentials Plus |
| Lots of remote staff and personal devices | Fix the basics first, then consider Plus |
| New to all of this | Cyber Essentials first |
A common mistake is paying for Plus because it sounds more impressive. If nobody has asked for it, put that money into fixing gaps first. You can always add Plus later, once the basic certificate is in place.
Getting your estate ready
We help UK businesses get their IT estate ready for certification, and an accredited partner carries out the assessment itself. That keeps the result independent and means you are not marking your own homework. Our Cyber Essentials support covers the gap assessment, the fixes and the preparation for Plus.
In our experience, the gaps that hold businesses back are rarely exotic. They tend to be MFA switched on for some cloud services but not all, old devices that no longer receive updates and admin accounts used for everyday work.
A sensible order of work looks like this.
- Agree The Scope And List Every Cloud Service You Use
- Switch On MFA For Every User On Every Service That Offers It
- Retire Or Replace Unsupported Devices And Software
- Set A Routine To Apply Critical Patches Within 14 Days
- Remove Admin Rights From Everyday Accounts
Personal phones and laptops are a frequent trouble spot, so our guide to Microsoft 365 BYOD is worth reading early. Microsoft 365 access reviews help with the user access control side. If scoping feels unclear across several offices or countries, our IT consulting team can help you map it, and our cloud services and Office 365 support covers the tenant settings that assessors look at.
Before a Plus audit, ongoing vulnerability management services are the practical way to find and fix issues before an auditor does. If you are unsure how scanning differs from testing, see pen testing vs vulnerability scanning.
Certification is a baseline, not the whole defence
Cyber Essentials reduces your exposure to common attacks. It does not give you round the clock monitoring, and it will not help you recover if something still gets through. For that you need extra layers. Managed SOC services and MDR services watch for threats and respond to them, while email security services cut down the phishing that starts many incidents. Business continuity services make sure you can keep working if systems go down. Our overview of why your business should become Cyber Essentials accredited covers the wider case for starting.
Frequently asked questions
Is Cyber Essentials Plus mandatory?
No, both levels are voluntary. A customer, tender or insurer may ask for one, so check the exact wording of the requirement rather than assuming Plus is needed.
Can you go straight to Cyber Essentials Plus?
No. You need a verified self-assessment first. Certification bodies generally expect the Plus audit to follow within a short window, commonly 3 months, so confirm the exact timing with yours.
How long does Cyber Essentials Plus last?
12 months, the same as the basic certificate. You then renew each year.
What happens if you fail a Cyber Essentials Plus audit?
You fix the findings and the affected areas are retested. If you fail the update management sample test, the retest uses a new random sample, and a second failure revokes your verified self-assessment certificate.
Does Cyber Essentials include cyber insurance?
Eligible UK organisations with turnover under £20m that certify their whole organisation receive cyber liability insurance arranged by IASME. Read the policy terms, because they will not replace your own cover if your needs are larger.
Talk to us before you pick a level
If you are not sure whether your customers, contracts or insurer need Cyber Essentials or Cyber Essentials Plus, we can look at your estate and tell you what is likely to pass and what needs fixing first. Get in touch with Northern Star to book a readiness conversation.
