Cyber Essentials vs Cyber Essentials Plus: which one are you being asked for?

The short version

Cyber Essentials is a self-assessment: you answer a questionnaire about your setup and an assessor at an IASME-licensed certification body reviews your written answers. Cyber Essentials Plus is the same standard, verified: after you hold the basic certificate, an assessor tests a sample of your actual devices to confirm the controls are really in place. Both are valid for twelve months. Both are assessed against the same NCSC requirements. Neither adds any controls the other lacks.

What is actually different

How you are assessed

For the basic level you write text answers — you don’t normally upload evidence, though your certification body can ask for it — and the assessor judges whether what you describe meets the requirements. For Plus, the certification body arranges a hands-on technical audit of a sample of your real devices to confirm the controls you described are actually in place. Exactly what is tested is set out in IASME’s Plus test specification — ask your certification body for the current version when you book. It takes real time from your side as well as the assessor’s.

What it costs

The basic assessment fee is set by IASME by organisation size — a few hundred pounds plus VAT. Plus is quoted individually by the certification body because the work depends on how many devices and locations are involved; our rough market estimate (not an IASME figure) is from around £1,350 and rise from there, on top of the basic fee. The cost guide has the fee tiers.

The order

You cannot go straight to Plus. Plus requires the basic certificate first, and there are rules about how soon after it the Plus assessment must happen — check the timing with your certification body when you book, because it affects how you plan the work.

What does not differ

The five controls, the scope rules, the password and MFA requirements, the 14-day update rule, the twelve-month validity. A business that genuinely meets the basic requirements has done the work that Plus checks; Plus simply proves it to someone who did not take your word for it.

Which one are you being asked for?

Read the request literally. If a tender, supplier questionnaire or insurer says “Cyber Essentials”, it means the basic level — the self-assessment. If it says “Cyber Essentials Plus”, it means the verified level, and you need both. Some frameworks say “Cyber Essentials or equivalent”, which the basic level satisfies. When a request is ambiguous, ask the person who wrote it; it is a five-minute email and it can save you a four-figure audit you did not need.

Plus is typically asked for in higher-risk work — contracts involving sensitive data, some public-sector supply chains, and larger corporate customers with their own assurance teams. For the majority of small businesses asked to “get Cyber Essentials” by a client, basic is what is meant.

Should you go for Plus anyway?

Sometimes. If you expect to be asked for Plus within the year, doing both together is cheaper than doing the basic, then repeating the preparation. If your clients are large and procurement-heavy, Plus on the certificate can shorten supplier onboarding. And some businesses simply want the reassurance that an independent tester looked. But Plus does not make you “more certified” in the eyes of a client who only asked for the basic level, and the money is often better spent on the thing that actually fails small businesses at the basic level: making sure every cloud account has MFA switched on.

A practical sequence

1. Establish which level is required from the contract or client, in writing if it is ambiguous.
2. Get ready for the basic level properly. Every control in the checklist, automatic fails first. This is the work either way.
3. Buy and pass the basic assessment through a certification body.
4. If Plus is required, book it with the same body promptly, fix anything the testing finds, and keep the timing window in mind.