At their core, Cyber Essentials and Cyber Essentials Plus evaluate the exact same five technical controls against identical requirements. The real difference comes down to who does the verifying. Cyber Essentials is a self-assessment that an assessor reviews and marks. Cyber Essentials Plus goes a step further by bringing in an independent technical auditor to test your live systems. You’ll generally want Plus if a contract, insurer, or client specifically demands it, or if you simply need solid, independent proof that your controls actually work in practice.
That is the quick answer, but the details matter now more than ever. The scheme underwent significant updates in April 2026, meaning much of the advice floating around online is already out of date.
Right, so what is Cyber Essentials?
Think of Cyber Essentials as the UK government’s baseline standard for cybersecurity. It’s overseen by IASME alongside the National Cyber Security Centre (NCSC) and focuses on five fundamental technical safeguards: firewalls, secure configuration, user access control, malware protection, and patch management.
The scheme specifically targets what IASME calls “commodity attacks”, broad, low-sophistication threats using off-the-shelf tools that anyone can grab online. It isn’t built to fend off a dedicated, well-funded adversary targeting your organisation specifically, and it has never claimed to be.
Certifications for both levels remain valid for twelve months, so you will need to renew annually.
And what does Plus add?
Plus starts with the exact same self-assessment questionnaire, but it doesn’t end there. A licensed assessor, working either remotely or on-site, actively tests your systems to make sure those controls are doing their job.
You end up with identical core requirements, but a vastly higher degree of assurance.
The differences that actually matter
| Cyber Essentials | Cyber Essentials Plus | |
| The five controls | Yes | Yes, the same five |
| How it’s assessed | Self-assessment questionnaire, marked by a qualified assessor | The same questionnaire, plus an independent technical audit |
| Who checks your systems | Nobody. Your answers get reviewed, your systems don’t | A licensed assessor tests a representative sample of your devices |
| Board sign off | A senior board member e-signs to confirm your answers are true | Same, and the questionnaire has to be final before testing starts |
| The pass bar | You can pass with one or two non-compliances | Anything found has to be fixed within 30 days, and you can’t pass until it is |
| Vulnerability scanning | None | External scan of every public IP, plus scans of sampled devices |
| Cost | For totality services to manage the process end to end, it starts from £1,375 +VAT. | Would be from £2,775 + VAT end to end. |
| Valid for | 12 months | 12 months |
| Why you’d pick it | Baseline credibility, supply chain questionnaires, a sensible first step | A contract, tender, regulator or insurer wants it, or you want proof rather than promises |
Notice that row about the pass bar? Most online guides gloss right over it, but it’s easily one of the most critical details in the table. As IASME explicitly notes, you can actually pass the standard self-assessment with one or two minor non-compliances. However, if those same issues turn up during a Plus audit, you get a strict 30-day window to fix them, and you won’t pass until every single one is resolved (IASME, updated May 2026).
Same core rules, but a significantly higher bar to clear, something definitely worth keeping in mind before committing.
What a Plus audit actually looks for
If you’re leaning toward Plus, it helps to understand what the hands-on assessment actually looks like. According to IASME, assessors will conduct:
- An external vulnerability scan across all your public IP addresses to spot exposed services, unpatched flaws, and misconfigured access controls.
- A representative device sample covering your operational environment, including servers, workstations, laptops, tablets, and phones across every operating system type in use.
- A thorough patching check on sampled endpoints to verify that software remains supported and that all critical or high-risk updates were installed within 14 days.
- Malware defence testing, which includes sending safe test files via email and browser downloads while the assessor watches how your system handles them.
- An account separation review, confirming that users cannot perform administrative tasks from their standard day-to-day accounts.
- Multi-factor authentication checks across every cloud service used by sampled staff, testing at least one standard user account and one administrator account per service.
If you have legacy software lingering somewhere in your network, a laptop that hasn’t seen updates in months, or staff running as local admins for convenience, an audit will uncover it. While a self-assessment assumes you already know about these gaps, Plus actively uncovers them.
What changed in April 2026 (and why it affects your decision)
The NCSC and IASME review the Cyber Essentials framework every year. The updates introduced in April 2026 brought some of the most meaningful changes we’ve seen in a while.
Updated requirements and questions. Requirements v3.3 and the Danzell question set apply to all assessment accounts opened on or after 27 April 2026. Accounts created prior to that date continue under the previous rules (IASME, November 2025 and February 2026).
If your application fell right around the transition period, take note: IASME referenced both 26 and 27 April across different announcements. Rather than guessing, double-check with your certification body to confirm which version applies to your assessment.
Missing MFA on cloud services is an automatic fail. If a cloud service offers multi-factor authentication and you haven’t enabled it, you fail automatically. It doesn’t matter whether MFA was free, included, or carried an additional licensing cost, or how well you performed across the rest of the checklist.
Strict zero-tolerance policy on key patching questions. Question A6.4 covers critical and high-risk updates for operating systems and network hardware, while A6.5 addresses the same for applications, extensions, and plugins. Both carry a strict 14-day patching rule, and failing either question instantly fails the entire assessment.
Cloud services must be included in scope. IASME clarified that any on-demand, web-accessible service storing or processing organizational data on shared infrastructure is firmly in scope. You can no longer leave cloud platforms out of your evaluation boundary.
More rigorous Plus retesting. If you fail an initial Plus audit, fix the issues, and return for a retest, the auditor will check your original sample plus a brand-new selection of devices. This prevents organizations from selectively patching only the audited hardware. Fail the retest, and your core Cyber Essentials certificate gets revoked as well.
Questionnaires are locked before testing. You can no longer tweak or adjust your self-assessment answers once the Plus auditing phase begins.
What does this mean when deciding which path to take? Standard Cyber Essentials is tougher to pass inadvertently now that MFA and patch management carry mandatory pass/fail rules. Even so, it still evaluates your self-reported setup. Cyber Essentials Plus remains the only way to bridge that gap with verified testing, and under the newer retesting standards, that verification applies with far greater accountability.
What does it cost?
Standard self-assessment pricing is fixed based on headcount, following standard government guidelines for business sizes. As of September 2026, IASME rates stand at £320 + VAT for micro-businesses (0-9 employees), £440 for small businesses (10-49), £500 for medium organizations (50-249), and £600 for large enterprises (250+). totality services can support and manage the process end to end starting from £1,375 + VAT for a micro business.Â
Cyber Essentials Plus does not have a single published price, as each quote depends on network complexity and the total auditing time required. You can request tailored quotes from up to three certification bodies via the IASME platform or contact a provider directly.
Treat any guide advertising a single blanket price for Plus with healthy skepticism. Realistically, overall costs scale based on device counts, operating system diversity, and the number of cloud environments in scope.
Keep in mind that evaluation fees don’t cover remediation. If your audit turns up unsupported legacy applications, unconfigured MFA, or overdue patches, addressing those issues represents the real investment, and that’s where your budgeting should start.
Do you need Cyber Essentials for government contracts?
If you’re bidding for UK public sector work, the short answer is yes.
Procurement Policy Note 014 replaced PPN 09/23 for procurements launched on or after 24 February 2025. Covering central departments, executive agencies, public bodies, and NHS entities, it mandates that suppliers bidding on higher-risk contracts demonstrate Cyber Essentials or Plus certification (or equivalent controls) prior to contract award.
Here are two common misconceptions worth clearing up:
First, it doesn’t apply to every single tender. PPN 014 specifically targets contracts involving elevated risk profile elements, such as handling sensitive government or citizen data or managing IT platforms operating at OFFICIAL level. It isn’t intended as a blanket requirement for all procurements.
Second, there is no arbitrary contract value threshold that automatically triggers Cyber Essentials Plus. Buying authorities evaluate risk individually for each procurement and state the required certification level in the tender documentation. Always check the tender requirements directly rather than trying to guess based on contract size.
So which one do you need?
Cyber Essentials is probably right if:
- A customer or prospect requested certification without specifying a level.
- You want clear market credibility quickly, backed by transparent upfront pricing.
- Your internal or outsourced IT team maintains clear visibility over every endpoint in your environment.
- You’d prefer to allocate budget toward resolving security gaps rather than auditing them.
Go for Cyber Essentials Plus if:
- A specific contract, regulator, insurer, or key account explicitly mandates Plus.
- You regularly bid on central government, NHS, or defense sector supply chain work.
- You manage sensitive personal or financial records and require independent verification over self-declaration.
- You lack total certainty surrounding patch management or MFA adoption across all endpoints.
- You want your certification to stand as tangible proof of security, rather than a badge on your site.
That point about patch management is easy to overlook. If your response to “are all critical patches applied within 14 days across every machine?” is “most likely,” that uncertainty is precisely what a Plus audit will catch. Discovering those gaps during an audit is far better—and far less costly—than uncovering them during a security breach.
How long does the whole thing take?
You have six months from application to complete and submit your self-assessment. If you’ve gathered your information beforehand, filling in the questionnaire takes about an hour, with most assessors returning feedback within three working days. If issues pop up, you get a two-day window to fix them and resubmit at no extra charge, miss that window, however, and you’ll have to reapply from scratch.
For Cyber Essentials Plus, the audit must take place within three months of achieving your core certification. As long as you fall within that window, you won’t need to redo the questionnaire.
In practice, the evaluation itself moves quickly, it’s the preparation that takes time. If MFA isn’t fully deployed or you’re managing legacy software, give your team a few weeks to prepare before starting the process.
Frequently asked questions
What is the main difference between Cyber Essentials and Cyber Essentials Plus? Both options evaluate the same five technical safeguards under identical standards. Standard Cyber Essentials relies on a self-assessment questionnaire reviewed by an assessor, whereas Cyber Essentials Plus adds hands-on technical auditing, external vulnerability scans, and direct device testing.
Is Cyber Essentials Plus worth the investment? It certainly is if a client or contract mandates it, or if you need verified proof of your patching, MFA, and account permissions. Plus offers genuine validation of your security controls, backed by stricter device sampling under current scheme rules.
How long does certification remain valid? Certifications for both levels last twelve months. IASME removes unrenewed entries from its public register after one year, sending automated renewal reminders roughly a month before expiry.
Must I complete Cyber Essentials before applying for Plus? Yes, completing the standard self-assessment is a mandatory step. Provided your Plus audit occurs within three months of passing, you won’t need to re-submit the questionnaire.
Is certification legally required? No general law mandates it. However, under PPN 014 it is effectively essential for suppliers competing for higher-risk central government or NHS tenders, and it is frequently required by insurers and commercial supply chains.
What triggers an automatic fail during assessment? Under the April 2026 guidelines, failing to enable MFA on a supporting cloud service or missing 14-day critical patch windows across operating systems or applications results in an instant fail. Using unsupported software will also block certification. Always review current questionnaire requirements prior to submission.
Can we complete Cyber Essentials without an external IT provider? Yes. IASME provides question sets and readiness resources free of charge, enabling self-led applications. However, many smaller organisations find that interpreting technical requirements accurately benefits from guidance by an IT partner or NCSC-assured Cyber Advisor.
Not sure which level you actually need?
We support London organisations through the entire Cyber Essentials certification process, from auditing your posture against the five controls and resolving gaps, to preparing and submitting your documentation. Certification is awarded by an accredited IASME body, with Plus audits performed independently by their qualified assessors.
If a tender or client contract asks for certification and you’re unsure which level makes sense, reach out to our team for clear, straightforward guidance.
You can also book a complimentary IT audit to see where your security stands against the five technical controls before making any commitments.
Authored by the team at totality services. Based in London at 20a St George Wharf, Vauxhall (SW8 2LE), we provide managed IT and security services to over 150 organisations across the UK. ISO 27001 and ISO 9001 certified Microsoft Partner. Our security and compliance specialists have guided clients through Cyber Essentials since the scheme’s inception.
This guide reflects the Cyber Essentials scheme as of September 2026 under Requirements for IT Infrastructure v3.3 and the Danzell question set. Standard requirements are updated annually, so please consult the IASME portal for current guidance prior to applying.