Both certifications prove your business has solid basic cyber security — but they’re not the same, and you don’t always need the higher one. Here’s the difference in plain English, and how to decide.
What they have in common
Both Cyber Essentials and Cyber Essentials Plus certify the same five core controls: firewalls, secure configuration, security update management (patching), user access control, and malware protection. Get these right and you’ve closed the doors most attackers walk through. Both certifications last 12 months.
Cyber Essentials — the self-assessment
Standard Cyber Essentials is a self-assessment: you complete a questionnaire about your setup, and it’s reviewed and verified by a certification body. It’s quicker and cheaper, and it’s the right starting point for most businesses. It gives customers and partners confidence, and it’s enough to meet many contract requirements.
Cyber Essentials Plus — independently tested
Cyber Essentials Plus covers the exact same five controls, but instead of taking your word for it, a qualified assessor tests them hands-on — including a technical audit and vulnerability scan of your systems. It’s a higher bar and a stronger assurance, which is why some larger clients, public-sector buyers and insurers ask for it specifically.
So which do you need?
As a rule of thumb: if you want a solid baseline and to satisfy most requirements, standard Cyber Essentials is the place to start. If a contract, framework or insurer specifically asks for Plus — or you simply want the stronger, independently-verified assurance — go for Cyber Essentials Plus. In practice, most businesses do Cyber Essentials first and step up to Plus when they need it.
How we help
Frequently Asked Questions
If a contract or insurer requires it, or you want independent proof rather than self-assessment, yes. Otherwise standard Cyber Essentials is a strong, cost-effective baseline — many businesses start there and upgrade later.
Twelve months. You re-certify annually to keep it current, which also keeps your security up to date.
