Cyber Essentials vs Cyber Essentials Plus: What's the Difference?

The difference between Cyber Essentials and Cyber Essentials Plus is how the same five security controls are checked. Cyber Essentials is a verified self-assessment: you answer a questionnaire and a certification body’s assessor marks it. Cyber Essentials Plus adds a hands-on technical audit, in which the assessor tests a sample of your devices, your internet-facing systems and your cloud accounts. Both certificates last 12 months, and the Plus audit must be completed within three months of the basic certificate.

The short version: basic Cyber Essentials tells a customer what you say you do. Cyber Essentials Plus shows them an independent assessor checked that you actually do it.

Sovereign Secure is an IASME-licensed certification body and issues both certificates. This guide compares Cyber Essentials vs Cyber Essentials Plus in detail, shows what each costs and how long it takes, and helps you decide which one you need.

Key takeaways

• The requirements are identical; only the method of checking them differs.
• Cyber Essentials Plus always builds on a current Cyber Essentials certificate, within a three-month window.
• Plus costs more because an assessor tests real devices, so size and device variety drive the price.
• Many public sector contracts require basic Cyber Essentials; defence and larger enterprise buyers often ask for Plus.
• Since April 2026, a failed Plus patching test is retested on a fresh random device sample, so partial fixes no longer work.

What is the difference between Cyber Essentials and Cyber Essentials Plus?

Both levels test the five technical controls set out in the NCSC’s Requirements for IT Infrastructure: firewalls, secure configuration, security update management, user access control and malware protection. Our guide to the Cyber Essentials controls explains each one. The comparison table at the top of this guide shows where the two levels differ: the controls are identical, and only the way they are checked, the cost and the evidence you end up with change.

What does basic Cyber Essentials involve?

You answer the current IASME question set (Danzell, since April 2026) for everything in scope: every laptop, desktop, server, phone, network device and cloud service your organisation uses. A board-level representative signs a declaration that the answers are true. An assessor at a licensed certification body then marks each answer against the Cyber Essentials requirements.

If an answer doesn’t meet a requirement, the assessor explains why and you can amend and resubmit within your package’s limits. With us, a Gold package is assessed within one working day, Silver within two and Bronze within three to five. Our page on Cyber Essentials certification explains the packages, and our guide to what happens in a Cyber Essentials assessment covers how answers are marked.

What is Cyber Essentials Plus, and what does the audit add?

Cyber Essentials Plus is the audited level of the scheme: as well as marking your self-assessment, the assessor tests your controls directly, following the NCSC’s Cyber Essentials Plus test specification. A typical audit includes:

• External vulnerability scan of your internet-facing IP addresses, plus a check that public login pages are protected against password guessing.
• Authenticated patch scans of sampled laptops, desktops and servers, looking for high or critical vulnerabilities with a fix more than 14 days old.
• Malware tests: harmless test files sent by email and downloaded in the browser, to confirm they are blocked or can’t run without a clear warning.
• Mobile checks on a sample of phones and tablets that access company data.
• MFA and account checks on cloud services, and confirmation that administrators use separate admin accounts.

The sample is set per operating system version, not per organisation:

Our Cyber Essentials Plus requirements checklist covers what to have ready on the day, and our Cyber Essentials Plus certification page explains how we run remote and on-site audits.

What is the price difference between the two levels?

Cyber Essentials Plus costs several times more than the basic certificate, because an assessor spends time testing real devices. Basic Cyber Essentials follows IASME’s published fee bands. For Plus, the figures below are published prices from UK providers we reviewed in September 2026.

Some providers sell the basic assessment as an extra on top of the Plus price, so compare totals for the same scope. The number of operating system versions, sites and cloud services, and whether the audit is remote, all move the figure. Our Cyber Essentials Plus cost guide explains each driver, and our Cyber Essentials cost page lists our basic packages from £320 + VAT.

How long does each level take?

Cyber Essentials: preparation takes anything from a few days to a few weeks, depending on how many gaps you need to close. Once you submit, marking takes 24 hours to five working days with us, depending on the package.

Cyber Essentials Plus: allow a few weeks from booking. A typical timeline:

1. Book the audit date before you submit the basic assessment.
2. Return the asset declaration form at least two weeks before the audit, so the sample can be worked out.
3. Pass the basic assessment, ideally at least a week before the audit.
4. Audit day: most small organisations finish in a day.
5. If anything fails, fix it and complete the retest within 30 days.

Everything must fall within three months of the basic certificate’s issue date. Miss the window and the basic assessment has to be repeated first.

Cyber Essentials vs Cyber Essentials Plus: which one do you need?

To choose Cyber Essentials or Cyber Essentials Plus, work through these questions in order:

1. Does a contract, tender or customer name the level? Then that decides it. Check the wording: “Cyber Essentials” and “Cyber Essentials Plus” are different requirements.
2. Do you handle sensitive personal data, client systems or payments, or supply defence or other high-risk buyers? Plus gives the independent evidence those customers look for.
3. Do you want proof, not just a declaration, that your controls work? Boards and insurers increasingly do. Choose Plus.
4. None of the above? Start with Cyber Essentials. Treat it as a structured gap analysis, and plan the Plus audit into the three months that follow if you need it later.

According to the government’s scheme overview, Cyber Essentials is mandatory for central government contracts that involve handling personal information or providing certain ICT products and services. Some buyers, notably in defence, set Plus as the minimum for higher-risk contracts. Our guide Is Cyber Essentials mandatory? covers the procurement rules in full. If a customer asks for ISO 27001 rather than either level, our comparison of Cyber Essentials vs ISO 27001 explains how the schemes fit together.

Can you get Cyber Essentials Plus without Cyber Essentials?

No. Cyber Essentials Plus is an audit of the answers you gave in your basic assessment, so you need a current Cyber Essentials certificate first, and the audit must be finished within three months of it.

Since the April 2026 scheme changes, the basic self-assessment must be completed, finalised and left unchanged before Plus testing starts, so you can no longer adjust your answers based on what the audit finds. What you declare at the basic stage is what gets tested. Our summary of the Cyber Essentials changes for 2026 covers the rest of the update.

Is Cyber Essentials Plus harder to pass?

The bar is the same, but there is nowhere to hide. Answers that were true for most devices fail when the one laptop that missed an update is in the sample. The failures we see most often are:

• Patching gaps: a browser, PDF reader or router firmware update more than 14 days overdue.
• Unsupported software: an operating system or application past its vendor’s end-of-support date.
• MFA exceptions: a shared mailbox, legacy account or secondary cloud app without MFA.
• Admin rights: standard users with local admin rights, or admins reading email from privileged accounts.
• Personal devices: staff phones that access work email but run an old operating system.

The April 2026 changes raised the stakes. If devices fail the security update tests, the retest covers a new random sample of devices as well, to show the fix has been applied across the organisation. IASME states that a second failure will result in the basic certificate being revoked. Patch the whole estate, not just the devices you expect to be sampled.

Do both certificates need renewing?

Yes. Both last 12 months from the date of issue, with no grace period. To keep Plus, you renew the basic assessment and repeat the audit each year. Our Cyber Essentials renewal page explains how to plan it, and how to switch certification body at renewal.

Why use Sovereign Secure?

Sovereign Secure Ltd is an IASME-licensed Cyber Essentials certification body, so you deal with one organisation from scoping to certificate. We are also ISO 27001 certified and a PCI SSC Qualified Security Assessor (QSA) company. We can quote for both levels together, audit remotely or on site, and remote Plus retests of up to an hour within a month are free.

Next step

If you already know you need Plus, request a Cyber Essentials Plus quote, or complete our scoping questionnaire and we’ll send a fixed price for both levels. If you’re starting with the basic certificate, choose a package on our Cyber Essentials cost page and plan the audit into the following three months. Not sure you would pass either level yet? Our free Cyber Essentials readiness check gives you a score and a fix list in 20 questions.