In short: Cyber Essentials vs Cyber Essentials Plus comes down to evidence. Both certify the same five controls. Cyber Essentials is a verified self-assessment: you answer the question set and an assessor marks it. Cyber Essentials Plus adds independent technical testing of a sample of your devices and cloud accounts, within three months of the self-assessment, giving buyers stronger assurance.
The short answer
Start with Cyber Essentials. Every organisation has to, because Plus is built on a current Cyber Essentials certificate. Go on to Cyber Essentials Plus when a contract, customer or sector scheme asks for it, or when you want independent proof that your controls work, not just a signed declaration that they are in place.
Neither level has extra controls. Both are judged against the NCSC's *Requirements for IT Infrastructure* v3.3 and, from 27 April 2026, the Danzell question set.
Side-by-side comparison
| Cyber Essentials | Cyber Essentials Plus | |
|---|---|---|
| Controls | Five technical controls (Requirements v3.3) | The same five controls |
| How it is assessed | Verified self-assessment: online question set, director's declaration, marked by an assessor | Hands-on testing by an assessor against the NCSC Cyber Essentials Plus Test Specification |
| Evidence | Your written answers | Scans and observed tests on your real systems |
| What is tested | Nothing directly; answers must be detailed and true | External scan, authenticated patch scans, malware tests, MFA sign-ins, account separation |
| Prerequisite | None | A current Cyber Essentials certificate covering the same scope |
| Timing | Six months to complete an account; marking usually within days | Testing within three months of the Cyber Essentials certificate |
| Delivery | Online | Remote or on site, observed by the assessor |
| Price model | IASME's fixed fee, banded by employee count | Quoted individually by the Certification Body |
| Validity | 12 months | 12 months, renewed with a fresh self-assessment and retest |
| Assurance to buyers | Good baseline | Higher: independently verified |
What Cyber Essentials Plus adds
The self-assessment depends on accuracy. It is easy to answer "yes, all devices are updated within 14 days" and miss a laptop that has not been switched on for a month, or a cloud admin account set up without MFA. Plus finds these.
- Patching proof. Authenticated scans of sampled devices, servers and IaaS instances look for critical or high fixes outstanding for more than 14 days. See Cyber Essentials Plus vulnerability scans.
- Real malware tests. Test files are emailed and downloaded to check they are blocked or warned about.
- Observed MFA. Users and admins sign in to each cloud service while the assessor watches.
- Admin separation. A standard user tries to run an admin task and must be stopped.
Under Danzell the levels are also more tightly linked: your self-assessment must be unchanged before Plus testing starts, and a repeated failure of the update test revokes the self-assessment certificate. The Plus audit process explains how this works in practice.
Who requires which level
| Requirement | What it asks for |
|---|---|
| PPN 014 (central government, executive agencies, NDPBs, NHS bodies) | Cyber Essentials or Cyber Essentials Plus (or equivalent controls) before award on in-scope contracts, renewed annually for the contract term; the buyer decides the level |
| Defence Cyber Certification | Every level starts with Cyber Essentials; Levels 2 and 3 require Cyber Essentials Plus |
| Legal Aid Agency contracts | Cyber Essentials (or an equivalent standard) is mandatory for the life of the contract; Cyber Essentials Plus is recommended (Provider Data Security Requirements v5) |
| Colleges in England | Cyber Essentials is required under the funding agreement; optional for schools |
| Private-sector buyers | Varies; many ask for Plus from suppliers that handle sensitive data or connect to their systems |
Always check the exact wording of the tender or contract. If it says Cyber Essentials Plus, a basic certificate will not do. Our supply chain guide explains how buyers verify certificates.
Which should you choose?
Choose Cyber Essentials if no contract requires Plus, you are a small organisation getting a baseline in place for the first time, or you want to fix the basics before inviting testing.
Choose Cyber Essentials Plus if a buyer, contract or DCC level requires it, you handle sensitive data for others, you want independent evidence for your board or insurer, or you are already confident in your controls and want that recognised.
Many organisations do both in one project: certify the self-assessment, then book the Plus audit straight away so it falls inside the three-month window. Plus costs more, mainly because of assessor time and any remediation; see Cyber Essentials cost for the factors. For your organisation, ask us for a quote.
How we help with either level
Forever Systems prepares you for both levels and works alongside an IASME-licensed Certification Body, which carries out the assessment and issues the certificate. We start with a gap analysis, fix what we find, support you through the question set and, for Plus, rehearse the audit so test day holds no surprises. Staff awareness supports both: phishing-resistant habits make the email tests and day-to-day security easier to sustain; see security awareness training.
Contact us to work out which level you need.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Both certify the same five technical controls. Cyber Essentials is a verified self-assessment marked by an assessor. Cyber Essentials Plus adds hands-on testing of a sample of your devices and cloud accounts by an assessor, within three months of the Cyber Essentials certificate.
Can I go straight to Cyber Essentials Plus?
No. Plus requires a current Cyber Essentials certificate covering the same scope, so you always complete the verified self-assessment first. You can plan both together and book the Plus audit straight after.
Is Cyber Essentials Plus worth it for a small business?
It is if a customer or contract asks for it, or you want independent proof for insurers and clients. Otherwise many small organisations start with Cyber Essentials and move to Plus once their controls are mature.
Do government contracts need Cyber Essentials Plus?
PPN 014 lets in-scope central government and NHS buyers require either Cyber Essentials or Cyber Essentials Plus, or equivalent controls. The tender documents say which; defence work at DCC Levels 2 and 3 requires Plus.
Does Cyber Essentials Plus last longer than Cyber Essentials?
No. Both certificates last 12 months. Keeping Plus means renewing the self-assessment and repeating the Plus testing every year.