Cyber Essentials vs Cyber Essentials Plus: Which Do You Need?
A plain-English breakdown of the two UK Cyber Essentials certifications, who needs each, and how to choose between them.
Cyber Essentials and Cyber Essentials Plus are often spoken about as if they are the same thing. They are not. The difference matters because it affects cost, effort, contract eligibility and the credibility of your certification.
What both schemes cover
Both schemes are built around five technical controls: firewalls, secure configuration, user access control, malware protection, and patch management. Get these right and you have closed the door on a large slice of common attacks.
Cyber Essentials: the self-assessment
You complete an online questionnaire, declare your controls and submit it to a certification body. They review it and either issue the certificate or come back with questions. Most SMEs can complete this in 2 to 4 weeks with the right preparation.
Cyber Essentials Plus: the audited version
Everything in Cyber Essentials plus a hands-on technical audit by an external assessor. They sample your devices, check vulnerability scans, and verify that controls are actually in place. Pass means more, costs more, and takes longer.
Which one do you actually need?
Many public sector contracts and an increasing number of major private buyers require Plus. Some only ask for the basic certification. The right answer is usually driven by your top three or four target customers.
Common reasons firms fail first time
Inconsistent patching, lack of MFA on cloud admin accounts, BYOD without controls, and missing inventory of devices and software. Almost always fixable with two to four weeks of focused work.
Frequently asked questions
How long does Cyber Essentials Plus take to achieve?+
Typically 4 to 8 weeks if you start in reasonable shape. Longer if there are significant gaps to close first.
Does it expire?+
Yes. Both certifications are annual.
Will it reduce my insurance premium?+
Often yes. Many UK cyber insurers offer better terms for certified firms.
Next step
Want to talk this through?
Book a free 30 minute consultation. No sales pitch, just clear answers.
Book free consultation