What Is the Difference Between Cyber Essentials and Cyber Essentials Plus?
Compare Cyber Essentials and Cyber Essentials Plus, understand the evidence each provides, and choose the right route for your customers and business.
What is the quick answer?
Both levels assess the same five technical control areas. Cyber Essentials uses a verified self-assessment; Cyber Essentials Plus adds independent technical testing to provide greater assurance that the controls are implemented. Choose the level named in your customer requirement, or evaluate the evidence your business needs. Neither certificate guarantees that an organisation cannot suffer an incident.
What is the simplest way to explain the difference?
The difference is principally how assurance is obtained. Cyber Essentials involves an independently reviewed self-assessment. Plus adds technical verification. The NCSC comparison of the two levels confirms that both address the same five control areas. Plus is not a different list of security topics disguised by a similar name.
For a business decision, think about the evidence behind the answer. A well prepared questionnaire requires the organisation to know its environment and describe it accurately. Technical testing adds another way to check what is actually in place. That distinction matters when customers want more than a declaration about settings and processes.
Cyber Essentials preparation support can help you turn that distinction into a practical plan. Start by identifying the assurance requirement and your current position. Do not choose a level solely because its name sounds more comprehensive or because one fee is easier to approve.
↑ Back to contentsDo the two levels assess different security controls?
The five areas are firewalls, secure configuration, security update management, user access control and malware protection. The assurance method changes between the levels, rather than Plus becoming a complete examination of every aspect of security. Keep that boundary clear when explaining the scheme to management or customers.
A useful internal exercise is to appoint an owner for each area and ask how the business knows its arrangements work. The answer should connect policy, implementation and review. If a requirement is described in a document but nobody checks whether settings are applied consistently, technical assurance may expose that gap.
Use cyber security audit services where a wider investigation of your environment is needed. Keep the objectives distinct: certification preparation answers defined scheme questions, while a broader review may consider other risks. Clear objectives prevent confusion about what has been checked and what further work the business may still need.
↑ Back to contentsWhat does verified self-assessment mean in practice?
It does not mean that a business simply downloads a badge after ticking boxes. The organisation supplies answers for independent assessment and must take responsibility for their accuracy. The practical challenge is knowing whether those answers reflect all relevant systems and working arrangements rather than only the most familiar parts of the environment.
Prepare explanations in language a responsible business owner can understand. If an answer relies on a supplier, identify who supplied the information and what they checked. Avoid copying a generic statement from another company. Two businesses can use the same software while having very different account settings, device management and responsibilities.
The business should retain a working evidence record even where not every item is requested during assessment. That record helps management review the final declaration and supports future renewal. A concise explanation backed by current information is more useful than a large folder of screenshots that nobody can connect to the answers.
↑ Back to contentsWhat extra assurance does technical testing provide?
Testing gives an independent assessor a way to examine whether relevant technical arrangements are implemented. It can reveal a difference between what the organisation believes happens and what is present on the systems checked. That is why Plus can be useful when a buyer wants stronger evidence about practical implementation.
The added assurance should not be described as exhaustive proof about every possible weakness. Understand the assessment scope, method and boundaries. If a customer has a particular concern, such as a bespoke application or incident recovery capability, ask whether the certification evidence addresses that concern or whether another activity is needed.
managed cyber security services can support continuing security operation alongside certification. Keep the relationship clear: ongoing management helps maintain controls, while independent assessment provides a defined form of assurance. One does not remove the need for the other, and neither should be marketed as a promise that attacks or mistakes become impossible.
↑ Back to contentsDo we need basic Cyber Essentials before Plus?
IASME’s guide to certifying for Cyber Essentials Plus explains the route from the verified self-assessment to technical audit. The Plus audit must be completed within three months of basic certification. Plan the two stages together instead of obtaining the first certificate and then leaving preparation indefinitely.
Ask your chosen Certification Body how the dates will work for your organisation. A project plan should allow for practical preparation, access and any follow-up. The sequence is particularly important when a customer has set a deadline or several technology suppliers need to cooperate.
Treat the date constraint as a reason to plan well, not to rush declarations. The basic answers should be accurate when submitted. If readiness is uncertain, resolve that uncertainty before committing to a tight testing schedule. Ask for written confirmation of the proposed process and any assumptions affecting your engagement.
↑ Back to contentsHow should customer requirements guide the choice?
Read the actual wording. A request for Cyber Essentials Plus is more specific than a request for basic Cyber Essentials. If the customer permits alternatives, ask what evidence it expects and how it will assess that evidence. Do not assume that a different certificate or a planned application automatically satisfies the requirement.
Build a short register of customer assurance requirements. Include the relevant entity, certification level, scope, evidence deadline and renewal expectation. This helps the business avoid completing a project that answers one customer’s question while overlooking another customer’s different condition.
The commercial owner should remain involved. Technical staff can explain preparation and assurance, but the business must decide what commitments it can make. Where the requirement is unclear, seek clarification through the agreed purchasing or contract process. A documented answer is more dependable than an informal interpretation passed between sales and IT.
↑ Back to contentsWhich level should a small business consider?
Size alone does not decide the answer. A small business may provide a sensitive service or face an explicit Plus requirement. A larger business may initially need the verified self-assessment for a particular supplier screen. Consider the service, customer expectations and evidence required before using headcount as a shortcut.
A smaller organisation should also assess its ability to maintain the arrangements after certification. It may be easy to gather a project team temporarily but harder to assign ongoing ownership. Choose support that leaves the business with understandable responsibilities and a routine for managing change.
small business IT support can help coordinate practical work when there is no internal department. Ask for a scope, an evidence plan and a clear division of tasks. The purpose is to make the route manageable, not to suggest that small businesses should accept weaker security or that a supplier can take over every business decision.
↑ Back to contentsHow does the assessment scope affect the comparison?
Compare like with like. A certificate covering a clearly defined part of an organisation is not automatically equivalent to one covering a wider environment. The level and scope both matter. Customers need to understand whether the systems involved in delivering their service are represented by the evidence offered.
Before deciding, map legal entities, locations, devices and relevant services. Identify shared infrastructure and unusual arrangements such as a separate business unit or an acquisition. Discuss boundaries with the Certification Body rather than assuming a scope based only on what is convenient to manage.
IT infrastructure management can provide a firmer asset and ownership picture. A good inventory makes the discussion more precise and helps reveal where one team’s assumptions differ from another’s. Scope should be an explicit part of management approval and customer communication, not a technical detail discovered after the certificate is issued.
↑ Back to contentsHow do cloud services and remote workers change preparation?
They make ownership and coordination especially important. Your preparation team needs to understand the services employees use and the devices through which work is performed. If the business has grown through ad hoc purchasing, relevant information may sit with department managers rather than the main IT contact.
Make a service register containing the business owner, technical administrator and purchasing contact. Ask remote teams how they actually work instead of assuming the head office arrangement applies everywhere. Record gaps in knowledge openly, then assign discovery tasks before answers are finalised.
managed cloud services can help organise responsibilities across hosted systems. For either level, confidence comes from understanding the environment. Plus does not turn an incomplete inventory into a reliable one, and basic assessment does not excuse broad guesses. Better information supports a smoother route whichever level your business chooses.
↑ Back to contentsWhich option costs more, and why?
Plus generally involves additional technical assessment work, so do not compare it with the basic assessment fee as though the deliverables were identical. Obtain a scoped quote and ask what is included. Preparation, remedial changes and retesting may have their own commercial terms.
The most useful comparison is the full effort required to achieve and maintain the chosen level. A low assessment fee can sit beside substantial internal work, while a supported package may include coordination that your team would otherwise provide. Make those assumptions visible rather than treating only the supplier’s headline total as the cost.
Avoid unsupported claims about typical prices or guaranteed savings. Your business can request prices based on its actual environment and compare written inclusions. A quote should explain uncertainties and change approval. That gives finance a defensible decision without needing an invented market average or an optimistic estimate of how quickly every gap can be fixed.
↑ Back to contentsWill Plus remove the need for other security work?
No certification should become a reason to stop assessing the risks important to your business. Customer information, important applications, fraud exposure and service recovery may raise questions that need separate attention. A defined baseline assessment is valuable precisely because its purpose can be explained without overstating it.
Keep a broader security improvement list with business owners and priorities. Distinguish activities needed for the current certification project from other work the organisation should consider. That allows management to avoid two opposite mistakes: assuming the certificate covers everything, or delaying a useful baseline while trying to solve every security issue at once.
managed endpoint detection and response may be relevant to detecting and responding to suspicious endpoint activity as part of that wider programme. Evaluate it against your operating needs. Do not turn a comparison of certification levels into a list of product claims or suggest that purchasing one service guarantees the outcome of an independent assessment.
↑ Back to contentsWhat should management ask before signing off either route?
Ask who owns the scope, who verified the supporting information and which issues remain unresolved. Management should understand the basis of the answers and the practical work planned. It should also know who will maintain the arrangements after the assessment rather than assuming the project team will continue indefinitely.
Review supplier responsibilities carefully. If one provider manages accounts and another manages devices, confirm how information will be combined. If a department owns a separate application, identify who can explain its settings. A complete answer may depend on several parties, and the internal coordinator needs a way to resolve disagreement.
Microsoft 365 support can support evidence gathering and configuration review for Microsoft environments. Keep the technical work traceable to the relevant requirement. A long list of tasks does not automatically give management assurance; an understandable account of what was checked, corrected and confirmed is more useful.
↑ Back to contentsHow do we prepare staff for a Plus audit?
Explain the purpose in practical terms before asking people to participate. Employees should know who is coordinating the work, what access may be requested and how to identify legitimate project communications. Keep the message proportionate and avoid presenting the audit as an examination of individual performance.
Agree availability with managers and make arrangements for remote workers or staff on leave. Clarify how technical staff will access relevant systems through approved methods. Unplanned requests are harder to manage and can encourage people to share credentials or information through unsuitable channels.
Use managed IT support to coordinate routine support and project activity where appropriate. The business should remain operational while the assessment work proceeds. Record temporary arrangements and remove them when no longer needed. A well organised audit experience depends as much on clear communication and scheduling as on the technology being examined.
↑ Back to contentsCan we move from basic certification to Plus later?
Yes, but timing and readiness must be planned with the Certification Body. Do not treat the upgrade as a purely administrative purchase. Confirm the applicable sequence, scope and assessment dates before telling a customer when you expect the higher level to be available.
Use the earlier preparation work as a foundation. Retain the inventory, account ownership information and evidence explaining the basic answers. Check what has changed since that work was completed. New devices, staff, services and supplier arrangements may affect the technical picture even over a relatively short period.
modern workplace security can help make repeatable device and identity practices part of ordinary operations. That reduces the need to rebuild understanding for each assurance activity. If the environment is changing substantially, discuss the implications openly rather than booking technical testing against information that is already becoming outdated.
↑ Back to contentsHow should we describe the level we hold?
Use the full certification name and accurate current status. State which entity holds it and make the scope available to the appropriate customer contact. Avoid shortening both levels to the same vague claim if the distinction matters to the buyer. A marketing statement should be consistent with the certificate and the current evidence.
If working towards Plus, describe that as preparation rather than achievement. Give any target date as a plan subject to the assessment outcome. The same care applies when a certificate expires or the business changes. Approved wording should have an owner who can update it when circumstances change.
This approach builds a more credible assurance conversation. Customers can decide whether the evidence meets their needs, and your team avoids promising more than the certification demonstrates. A precise statement can be shorter and more persuasive than broad claims about complete protection that no practical audit can establish.
↑ Back to contentsHow can we make the final choice confidently?
Record the decision in terms of requirement, evidence and operational readiness. Identify the customer or business objective, the certification level selected, the scope and the owner. Add the proposed timeline, budget basis and any assumptions that still need confirmation. This creates a concrete approval rather than a general intention to improve security.
If there is no named external requirement, decide what additional assurance would be useful and why. The answer may support a staged approach, but it should still include maintaining the controls throughout. Do not choose a lower level on the assumption that accurate implementation matters less when fewer technical checks are involved.
Whichever route you choose, success means more than displaying the right badge. The business should understand its systems, maintain clear responsibilities and answer customer questions accurately. That combination makes certification a useful part of everyday management and gives the organisation a stronger foundation for future security decisions.
↑ Back to contentsWhat else do businesses ask?
Is Cyber Essentials Plus a different set of controls?
Both levels assess the same five technical control areas. Plus adds independent technical testing to provide a higher level of assurance about implementation.
Does Cyber Essentials Plus mean we cannot be hacked?
No. It provides defined assurance within its scope. Continue managing incidents, recovery, changing risks and other security responsibilities.
Can we choose basic certification when a buyer asks for Plus?
Do not assume that basic certification meets a specific Plus requirement. Ask the buyer to clarify accepted evidence and confirm the agreement before committing.
Who wrote this guide, and how was it checked?
Written by Caleb Adoh, Growth Marketing Manager at NetMonkeys. Scheme distinctions were checked against the linked NCSC overview and IASME Plus guidance on 28 October 2026. Practical decision and preparation recommendations are editorial guidance. Confirm scope, dates and customer requirements with the relevant parties.
How can NetMonkeys help your business?
Talk to our team about your priorities and agree a practical next step.
Speak to NetMonkeys
