Cyber Essentials Plus Certification & Audit

Cyber Essentials Plus (CE+) is the audited level of the UK government-backed Cyber Essentials scheme. You pass the Cyber Essentials self-assessment first, then an assessor from an IASME-licensed certification body tests a sample of your devices, your internet-facing systems and your cloud accounts to prove the five controls work. The certificate lasts 12 months.

Often shortened to CE+ and sometimes written "Cyber Essential Plus", it uses the same five controls as Cyber Essentials certification, but instead of relying on your answers alone, an assessor tests them. The tests follow the NCSC’s Cyber Essentials Plus Test Specification. Buyers also call it Cyber Essentials Plus accreditation or a Cyber Essentials Plus assessment (CE+ assessment).

The three-month rule. Under the Cyber Essentials Plus scheme rules, you must hold Cyber Essentials (basic) first, and complete the Plus audit within three months of that certificate being issued. The audit tests the scope you certified at the basic level. Our Plus price includes the basic assessment, so you have one supplier and one timeline.

Remote or on-site. Audits can usually be run remotely using screen sharing and a scanning tool we provide, which keeps disruption and cost down for multi-site and home-working teams. On-site audits are available when a remote audit is not practical, including on-site Cyber Essentials Plus audits in London.

Timeline. Allow a few weeks. The asset declaration form is due at least two weeks before the audit and the basic assessment one week before. Most small organisations finish the audit itself in a day, and anything that fails must be fixed and retested within 30 days. Not sure you are ready? Check your Cyber Essentials Plus readiness with our free tool before you book.

Who asks for Plus? Buyers who want independent proof rather than a self-assessment, including many public sector, defence and NHS supply chains and enterprise supplier-assurance programmes. Under DEFCON 658 for MOD suppliers, contracts with a Cyber Risk Profile of Level 2 or 3 require Plus, and in the NHS DSPT a current Plus certificate moves an organisation outside Category 1 from Standards Met to Standards Exceeded. Check the contract wording: some ask for Cyber Essentials, others specifically for Plus, and our guide to government contract rules explains which.

Our IASME-licensed assessors. Your audit is carried out by an IASME-qualified Cyber Essentials Plus assessor from our team. Once you pass, you are listed on the public certificate search and can display the Cyber Essentials Plus badge while the certificate is valid. Sovereign Secure is also a PCI SSC-approved QSA company that provides penetration testing, so we can take the work further if a customer asks for more than CE+, and we are licensed by IASME for IASME Cyber Assurance, often the next step after Cyber Essentials Plus.

What does it cost? Published UK prices we reviewed in September 2026 range from £999 to £3,999 + VAT, set mainly by organisation size and the number of devices to sample. See Cyber Essentials Plus cost for the price bands and what drives them. We give you a fixed quote with the basic assessment included, and our Cyber Essentials Plus requirements page covers sample sizes and how to prepare.

What is a Cyber Essentials audit?

A Cyber Essentials audit is the hands-on technical assessment that leads to Cyber Essentials Plus. An assessor from an IASME-licensed certification body checks that the five controls actually work on a sample of your devices, your internet-facing systems and your cloud accounts, following the NCSC’s Cyber Essentials Plus test specification.

Basic Cyber Essentials is independently verified but has no technical audit: an assessor marks your self-assessment answers, which a board member or equivalent signs off. So when a customer or tender asks for an audited Cyber Essentials certificate, it means Cyber Essentials Plus. Most small organisations finish the audit in a day, remotely or on site, and anything that fails must be fixed and retested within 30 days. Our audit-day checklist shows what to have ready.