Cyber Essentials vs Cyber Essentials Plus: Complete UK Guide (2026)

If you're a UK business owner looking into cyber security certifications, you've likely come across two options: Cyber Essentials and Cyber Essentials Plus. Both are part of the UK government-backed scheme — but they're fundamentally different in how they're assessed, what they cost, and who actually needs them.

This guide explains the difference clearly so you can make the right decision for your business.

The core difference in one sentence: Cyber Essentials is a verified self-assessment. Cyber Essentials Plus is an independent technical audit.

---

What Is Cyber Essentials — and Why Does It Matter for UK Businesses?

Cyber Essentials is the foundation-level certification. It's a self-assessment scheme governed by IASME (the Internet Alliance for Secure Messaging and eSecurity) on behalf of the National Cyber Security Centre (NCSC). Businesses complete a structured questionnaire covering five key technical controls:

• Firewalls — ensuring your internet-facing systems are protected by properly configured firewalls
• Secure configuration — making sure devices and software are set up securely, with unnecessary features disabled
• User access control — limiting who can access data and systems, and ensuring admin privileges are tightly controlled
• Malware protection — using anti-malware software or application controls to prevent malicious software
• Security update management (patching) — keeping software and operating systems up to date with security patches

Once you've completed the questionnaire and it's reviewed by a certified assessor, you either pass or receive guidance on what needs fixing.

What Is Cyber Essentials Plus?

Cyber Essentials Plus covers exactly the same five technical controls — but instead of a self-assessment, it involves an independent, hands-on technical audit of your systems. A qualified IASME assessor will verify your controls are actually in place and working, not just documented on paper.

This includes:

• Authenticated vulnerability scans of all in-scope devices
• Testing of end-user devices (laptops, desktops, mobile devices)
• External vulnerability scanning of all public IP addresses
• Live MFA verification — the assessor observes MFA prompts in real time
• EICAR malware test files sent via email and browser download
• Verification of patch management — credentialed scans for CVSSv3 ≥7.0 vulnerabilities

The key difference is evidence over assertion. Cyber Essentials Plus doesn't take your word for it — it confirms your defences are genuinely effective.

---

Cyber Essentials vs Cyber Essentials Plus: Side-by-Side Comparison

| Feature | Cyber Essentials | Cyber Essentials Plus | |---|---|---| | Assessment type | Self-assessment questionnaire | Independent IASME technical verification | | Who tests your systems | Nobody — you self-report | Qualified IASME assessor | | Vulnerability scanning | Not required | External scan of all public IPs + internal scanning | | MFA verification | Self-declared only | Live testing — assessor observes MFA login | | Malware testing | Not required | EICAR test files via email & browser | | Patch management testing | Not verified | Credentialed scans for CVSSv3 ≥7.0 | | Cost (micro-org) | £300–£400 + VAT | £1,499 + VAT | | Timeline | 2–4 weeks | 4–10 weeks | | Required for MOD/DESNZ | Often accepted | Required for many contracts | | Required for NHS | Most frameworks | Required for high-risk suppliers | | Credibility | Baseline | Highest — independently verified |

---

Which One Does Your Business Need?

Get Cyber Essentials Basic if:

• You're an SME looking to demonstrate baseline cyber security to clients or partners
• You want to begin working with the UK public sector or government contracts (Cyber Essentials is mandatory for many central government contracts involving personal data or sensitive information)
• You're a smaller business with limited IT complexity and a tighter budget
• You want to qualify for the free £25,000 NCSC cyber insurance (for organisations under £20m turnover)
• You want to get certified quickly and build from there

Get Cyber Essentials Plus if:

• You handle sensitive client or customer data (financial, medical, legal)
• Your clients — particularly larger enterprises or public sector bodies — specifically request it in contracts or procurement documents
• You want to differentiate your business with a more credible, independently verified standard
• You're operating in sectors such as defence, healthcare, or financial services
• Your contract or tender explicitly specifies CE+ (not just "Cyber Essentials")
• Your cyber insurance provider recommends or requires independently verified certification

Cyber Essentials Plus carries considerably more weight in tender processes and enterprise sales. If you're pitching to a large corporate or public body, having Plus on your credentials significantly strengthens your position.

---

The Cost and Time Difference: What to Expect

Cyber Essentials certification fees vary depending on your organisation size:

Cyber Essentials (Basic):

• Micro (0–9 employees): £300 + VAT
• Small (10–49): ~£400 + VAT
• Medium (50–249): ~£500 + VAT

Cyber Essentials Plus:

• Micro (0–9 employees): £1,499 + VAT (IASME assessment fee)
• Small (10–49 employees): £1,999 + VAT
• Medium (50–249 employees): £2,499 + VAT
• Large (250+): POA

Plus fees are set by IASME. Your IT provider (such as Coreitech) may charge separately for preparation support — gap assessment, remediation, and pre-assessment scanning. Full CE+ cost breakdown →

The time investment also differs. Cyber Essentials can often be completed in two to four weeks for a well-prepared business. Cyber Essentials Plus typically takes four to eight weeks due to the scheduling and technical audit process.

Important: if you're pursuing CE+, you've need Cyber Essentials Basic first — it's a hard prerequisite. The CE+ assessment must start within 3 months of your CE Basic certificate.

---

Can You Go Straight to CE+ Without Basic?

No. You must hold a valid Cyber Essentials Basic certificate before undergoing CE+ assessment. Typically:

1. Achieve Cyber Essentials Basic certification
2. Within 3 months, complete the CE+ technical assessment
3. Receive your CE+ certificate (valid for 12 months)

---

Common Mistakes to Avoid

At Coreitech, we regularly help London businesses prepare for both certifications:

• Underestimating scope — businesses sometimes forget to include cloud services, remote working devices, or BYOD policies. If a device can access your company data, it likely falls within scope.
• Ignoring patch management — this is one of the most common CE+ failure points. Software unpatched within 14 days of a critical CVSSv3 ≥7.0 vulnerability being released will fail.
• MFA not enforced for all users — the single most common CE+ failure. Every user on Microsoft 365, Google Workspace, and any internet-facing cloud service must have MFA enforced, not just offered.
• End-of-life software — Windows 10 reached end-of-life in October 2025 and is now an automatic CE+ failure.
• Treating it as a one-off exercise — certification lasts 12 months. Your security posture needs ongoing attention.

---

Does Cyber Essentials Actually Protect Your Business?

There's a fair criticism that Cyber Essentials is a relatively low bar. And it's true — it won't protect against sophisticated nation-state attacks. But the NCSC's own data suggests the five controls would prevent around 80% of common cyber attacks. For most SMEs, the threat profile is opportunistic rather than targeted — and basic controls make a significant difference.

---

Further Reading

• Cyber Essentials Plus — full certification guide, costs & assessment explained
• [Cyber Essentials v

---

Technical Audit Requirements: Understanding the CVSS v3.0 Scanning Criteria

Unlike the self-assessment questionnaire, achieving cyber essentials plus requires a rigorous technical verification of your infrastructure. The core of this process is a series of vulnerability scans conducted by an IASME-accredited assessor. These scans use the Common Vulnerability Scoring System (CVSS) v3.0 to categorise risks. To pass the audit, your systems must show no vulnerabilities with a CVSS score of 7.0 or higher—typically classified as 'High' or 'Critical.'

This is a strict pass/fail threshold. The audit covers both your external-facing perimeter (your website, firewalls, and VPNs) and your internal network. If a scan identifies a vulnerability that allows for remote code execution without user interaction, or one that bypasses security controls, it must be remediated immediately. At Coreitech, we provide pre-audit scanning services for London-based firms to identify these 'High' and 'Critical' vulnerabilities before the formal assessment begins. This proactive approach ensures your business avoids the costs associated with a failed audit and a subsequent re-test, ensuring your infrastructure meets the highest security standards required for modern compliance.

The 'Willow' 2025 Updates: New Configuration & Patching Mandates

The 'Willow' update represents the latest evolution of the scheme, introducing stricter mandates for device management and software maintenance for 2025. A significant shift in these requirements involves the management of 'supported' software. Under Willow, any software reaching end-of-life (EOL) during the certification period must either be removed or have a documented, approved migration plan in place. The update reinforces the critical 14-day patching rule: any security update marked 'critical' or 'high' by the vendor must be applied to all in-scope devices within two weeks of release.

Furthermore, the Willow update tightens requirements for Multi-Factor Authentication (MFA) on cloud services. It is no longer sufficient to have MFA available; it must be enforced for all administrative accounts and any service accessible via a web browser. For SMEs in London Bridge and the surrounding areas, this necessitates a move away from manual updates toward automated patch management and Mobile Device Management (MDM) solutions. Coreitech helps clients navigate these 2025 mandates by implementing technical controls that ensure compliance across both office-bound and remote hardware, keeping you ahead of the evolving threat landscape.

Cyber Essentials Plus Audit Process: Remote vs On-Site Testing Protocols

The cyber essentials plus audit involves a hands-on verification by a qualified assessor to ensure your declared security controls are actually functioning. While many assessments are now conducted remotely using secure screen-sharing and remote monitoring tools, many London businesses opt for an on-site audit. Being based in SE1, Coreitech frequently facilitates on-site testing for local firms, which often simplifies the verification of physical hardware and internal network configurations.

The process involves testing a representative sample of your devices, including workstations, laptops, and mobile phones. The auditor will check that anti-malware software is active and updated, verify that standard users do not have administrative privileges, and perform a 'thin-client' test to ensure malicious files are blocked by your gateway or desktop protection. Choosing an on-site audit can often expedite the remediation process; if a minor configuration error is discovered, it can often be rectified and re-verified on the spot. This face-to-face interaction provides additional peace of mind and ensures that the technical nuances of your specific London office setup are fully understood by the assessor.

Common Reasons for Audit Failure (And How to Remediate Them)

Data suggests that nearly 50% of orga