Cyber Essentials vs Cyber Essentials Plus — What's the Difference?

If you've looked into cyber security certification for your business, you'll have come across Cyber Essentials. You may also have seen Cyber Essentials Plus and wondered what the difference is, which one you need, and what it actually involves. Here's a clear breakdown.

What is Cyber Essentials?

Cyber Essentials is a UK Government-backed certification scheme run by the National Cyber Security Centre (NCSC). It was created to help businesses of all sizes demonstrate that they have the basic cyber security controls in place to protect against the most common online threats.

The certification covers five key technical controls:

• Firewalls — ensuring boundary firewalls are properly configured
• Secure configuration — removing unnecessary software, disabling default passwords, restricting admin access
• Access control — ensuring only authorised users can access systems and data
• Malware protection — anti-malware software installed and up to date
• Patch management — software and operating systems kept up to date with security patches

These five controls protect against an estimated 80% of common cyber attacks, according to the NCSC. Most breaches exploit gaps in exactly these areas.

Cyber Essentials vs Cyber Essentials Plus — the key difference

The difference comes down to self-assessment vs independent verification:

• Cyber Essentials — you complete a detailed self-assessment questionnaire about your security controls. An independent assessor reviews your answers. If they're satisfied, you're certified.
• Cyber Essentials Plus — same as above, but additionally, an independent technical expert visits (or connects remotely to) your systems and actually tests the controls are working as described. They run vulnerability scans, test your patch status, and verify your defences hands-on.

Cyber Essentials Plus is significantly more rigorous — and significantly more credible as a result.

Which one should my business get?

For most South Wales SMEs, Cyber Essentials is the right starting point. It's accessible, affordable, and demonstrates a meaningful commitment to security.

You should consider Cyber Essentials Plus if:

• You work with the UK Government or public sector — many contracts now require CE Plus
• You're in a regulated industry (financial services, healthcare, legal) where stronger evidence of controls is expected
• Your clients are larger enterprises that require it from their supply chain
• You've had a security incident and want independent verification that you're now properly protected
• You want the strongest possible signal to clients and partners that your security is taken seriously

What does certification cost?

Government certification fees (paid to the certifying body) start from around £300–£500 for Cyber Essentials and £1,500–£3,000 for Cyber Essentials Plus, depending on your organisation size.

On top of the certification fee, most businesses need some preparation work — ensuring your systems actually meet the requirements before you apply. This is where companies like us come in.

We offer a pre-assessment that identifies any gaps before you submit for certification — so you're not paying for a certification attempt you're not ready for.

Benefits beyond the certificate

Beyond the certificate itself, the Cyber Essentials process has real practical benefits:

• NCSC Cyber Liability Insurance — certified businesses can access cyber liability insurance through the scheme
• Government contracts — many public sector contracts require CE certification from suppliers
• Client trust — it gives clients, particularly larger ones, confidence in your security posture
• Actual security improvement — the process of achieving the certification forces you to fix things that genuinely need fixing

How long does it take?

For a well-prepared organisation, the Cyber Essentials questionnaire takes a few hours to complete. If remediation work is needed first, allow 2–4 weeks. Cyber Essentials Plus adds another 1–2 weeks for the technical verification stage.

Certification is valid for 12 months and needs to be renewed annually.