Cyber Essentials vs Cyber Essentials Plus: Which Does Your Business Need?

A tender lands on your desk. Somewhere on page 14, between the insurance requirements and the social value questions, is a single line: suppliers must hold Cyber Essentials Plus. Not Cyber Essentials. Plus.

It is one of the first questions we hear when a tender arrives, and it is a fair one. The two certifications share a name, a logo and the same five technical controls. Yet one can be completed online in a matter of days, while the other involves an assessor testing your laptops, your email and your cloud accounts directly.

This guide explains exactly what each certification covers, how the assessments differ, what changed in April 2026 and how to work out which one your contracts actually require. If you decide you need Plus, it also shows you how to prepare so the audit holds no surprises.

What Cyber Essentials Covers: The Five Technical Controls

Cyber Essentials is the UK government backed scheme, run by the National Cyber Security Centre (NCSC) with IASME as its delivery partner. Its purpose is narrow and deliberate: to protect organisations against the most common internet-based attacks, the opportunistic phishing, password guessing and exploitation of unpatched software that make up the bulk of everyday incidents.

It does that through five technical controls. They are not exotic. They are the basics that, when they are genuinely in place, stop a large share of attacks before they start.

The scope covers the devices, software and cloud services your organisation uses to handle its data, including laptops, desktops, mobile phones, servers, network equipment and the cloud services your people sign in to. Bring your own devices count too if they access organisational email or data.

What Changed in April 2026

The scheme is updated regularly, and the most recent change matters for anyone certifying now. Version 3.3 of the NCSC requirements, used with the new Danzell question set from 27 April 2026, leaves the five controls unchanged but enforces them more strictly:

• Cloud services are always in scope, and always need MFA. Version 3.3 states that cloud services cannot be excluded from scope, and the requirements say authentication to cloud services must always use MFA. That includes cloud email, file sharing, identity providers and remote access tools.
• The 14-day rule is firm. Updates rated critical or high risk by the vendor, with a CVSS v3 score of 7 or above, or released with no severity details at all, must be applied within 14 days of release. That covers operating systems, applications and router and firewall firmware.
• Plus assessors check update management more strictly. Testing now looks harder at whether updates are applied consistently across the estate, not just on the devices that happen to be sampled.

If your last certificate predates these changes, do not assume a renewal will go the same way. Under the current rules, a single cloud service without MFA, or one critical update left for three weeks, is enough to fail.

How Cyber Essentials Plus Is Different: Independent Technical Audit

Here is the key point, and the one most people miss: the controls are the same. Cyber Essentials Plus does not add new requirements. What changes is how you prove that you meet them.

With Cyber Essentials, you answer an online questionnaire, a board-level contact signs it off and a certification body reviews your answers. It is a self-assessment. If you say every laptop is patched, the assessor takes that answer at face value unless something in your submission contradicts it.

With Cyber Essentials Plus, an assessor checks. According to IASME, the Plus audit tests a representative set of user devices, all internet gateways and all servers with services accessible to unauthenticated internet users, typically sampling around 10 per cent of systems before deciding whether more testing is needed. In practice, that means:

• External vulnerability scans of your internet-facing systems
• Internal checks that sampled devices are patched and running supported software
• Tests that malicious email attachments and downloads are blocked or caught
• Checks that standard users cannot install software or run as administrators
• Confirmation that MFA is enforced on the cloud services in scope

Plus must be completed within three months of your last Cyber Essentials certificate. Under the Danzell process, your self-assessment answers are locked once Plus testing begins, so the audit measures your environment against what you actually declared.

Side-by-Side Comparison Table

The simplest way to see the difference is to put the two side by side. Use the button to strip out the rows that are the same, and the real distinction becomes obvious: it is all about evidence.

On cost, the self-assessment is the lower outlay of the two, because Plus adds assessor time for the technical testing. For most organisations, the bigger cost is not the certificate itself but the remediation work needed to pass it: replacing unsupported devices, tidying admin rights and closing MFA gaps. That work is identical for both certifications. Plus simply makes sure it has been done.

When a Contract or Tender Requires Plus

Cyber Essentials has become a common baseline in UK procurement. Many public sector contracts, and a growing number of private supply chains, ask suppliers to hold at least the basic certificate. Plus tends to appear when the buyer needs stronger assurance, for example where a supplier:

• Handles personal, financial or sensitive information on the buyer's behalf
• Has direct access to the buyer's systems or network
• Supports critical services in sectors such as health, defence or energy
• Forms part of a regulated supply chain where the buyer must evidence its own controls

Requirements can arrive quickly. Legal aid providers are a recent example: the Legal Aid Agency's data security requirements for contracts starting on or after 1 October 2025 make Cyber Essentials mandatory and recommend Plus, putting certification on the agenda for firms that had never needed it before. We covered it in our guide to the Cyber Essentials deadline for legal aid providers.

The golden rule is to read the wording. "Cyber Essentials or equivalent" leaves room for interpretation. "Cyber Essentials Plus" does not. If a contract names Plus, the basic certificate will not satisfy it, however good your answers were.

Not sure where you sit? The quick check below gives you a steer in under two minutes.

Even when Plus is not required, it can be worth it. Customers increasingly want proof rather than promises, and a Plus certificate answers a whole block of security questionnaire questions with a single piece of independent evidence. As we argued in why Cyber Essentials is more than a tick-box exercise, the value lies in the controls being real, not in the badge.

How to Prepare for the Plus Audit Without Surprises

The most common reason a Plus audit fails is not a missing control. It is an assumption. "All our laptops are patched." "Nobody has admin rights." "MFA is on everywhere." The self-assessment lets you answer in good faith. The audit checks, device by device.

A sensible run-up looks like this:

The Five Gaps That Catch People Out

1. The forgotten device. An old laptop in a drawer, a reception PC or a phone that still syncs email. If it is in scope and unpatched, it counts.
2. Unsupported software. An application that has reached end of life, or an operating system version that no longer receives security updates. It has to be removed, replaced or taken out of scope properly.
3. One cloud service without MFA. Usually a niche tool someone signed up for directly: a design platform, a survey tool, a supplier portal.
4. Admin rights for convenience. Staff who were given local admin to install one thing and kept it. Under the scheme, admin accounts should be used for admin tasks only.
5. Patching that is slower than you think. Automatic updates that are deferred, devices that rarely restart or firmware on routers that nobody owns.

Running your own internal scan a few weeks before the audit is the single most useful thing you can do. It tells you what the assessor will see, while there is still time to fix it. Our vulnerability management service does exactly this, and a broader cyber security review can help if you are starting from scratch.

Which Should You Choose?

If a contract names Cyber Essentials Plus, the decision is made for you. Otherwise, a practical way to think about it is this:

• Choose Cyber Essentials if you are certifying for the first time, your contracts ask only for the basic certificate and you want a fast, structured way to get the fundamentals right.
• Choose Cyber Essentials Plus if customers want independent evidence, you handle sensitive data or you want certainty that your controls work as described, not just on paper.

Many organisations do both in one go: they complete the self-assessment, fix anything it reveals and book the Plus audit straight afterwards, well inside the three-month window. It avoids paying for remediation twice and gives you the stronger certificate from day one.

How Cybergen Can Help

Cybergen helps organisations achieve Cyber Essentials and Cyber Essentials Plus without the stress of finding problems on audit day. We are Cyber Essentials certified ourselves, so we know the process from both sides:

• Scoping and readiness assessment against the five controls and the current question set
• Hands-on remediation support for patching, configuration, access and MFA
• Internal and external vulnerability scanning before the formal audit
• Coordination with a licensed certification body for the assessment and the Plus audit
• Ongoing support so you stay compliant between annual renewals

For organisations that want to go further, CREST penetration testing tests the same environment against a determined attacker rather than a checklist. If a tender has just landed, speak to our team and we will tell you honestly how far you are from passing.

Cyber Essentials requirements, question sets and assessment processes are reviewed regularly and are subject to change. This guide reflects the scheme as at 29 October 2026. Check the latest NCSC and IASME requirements before you apply.

Frequently Asked Questions