What is Cyber Essentials Plus?
Definition
Cyber Essentials Plus is the higher level of the UK government-backed Cyber Essentials scheme. It covers the same 5 technical controls, but adds independent technical testing to check they work in practice.
- Category
- Security
- Also called
- CE Plus, Cyber Essentials+
- Last updated
Cyber Essentials is a certification scheme developed by the UK's National Cyber Security Centre (NCSC). The NCSC calls it the minimum standard of cyber security recommended by the government for organizations of all sizes. It's built around 5 technical controls aimed at the most common internet-based attacks: firewalls, secure configuration, security update management, user access control and malware protection.
There are two levels. Cyber Essentials is a verified self-assessment: you answer a question set, a board member or equivalent signs it off and an assessor marks it. Cyber Essentials Plus covers the same 5 controls but adds an independent technical audit. According to the NCSC, it goes a step further by testing your systems to verify the controls are working in practice.
For example, a supplier bidding for work might hold Cyber Essentials, while a buyer handling more sensitive data might ask for Plus because someone has actually tested the supplier's setup.
Cyber Essentials vs. Plus
- Both assess the same 5 technical controls and are independently verified.
- Only Plus includes technical testing of your systems.
- Cyber Essentials pricing starts from £320 plus VAT, depending on organization size. Plus is quoted by size and complexity of your network.
The NCSC also says that any UK organization with a turnover under £20m that certifies its whole organization is entitled to cyber liability insurance arranged by its delivery partner, IASME.
Why it matters
More buyers require certification from suppliers, and the controls are a sound baseline for any small business. It doesn't cover everything: it targets common attacks, not targeted ones.
How to protect yourself
- 1
Start with the free readiness tool
The NCSC offers a free Readiness Tool that gives a tailored action plan for certification, plus a free preview of the assessment questions.
- 2
Fix the 5 controls first
Turn on firewalls, set up devices securely, install updates promptly, limit who has admin access and run malware protection.
- 3
Choose the level that fits
If a customer or contract asks for tested assurance, go for Plus. Otherwise the basic level is the lower-cost start.
- 4
Check a supplier's certificate
You can search current certificates on IASME's website, the NCSC's delivery partner.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Both check the same 5 controls. Plus adds an independent technical audit that tests whether the controls work in practice.
How much does Cyber Essentials Plus cost?
The NCSC says Plus is priced according to the size and complexity of your network and is quoted. Cyber Essentials starts from £320 plus VAT.
Who needs Cyber Essentials Plus?
It's recommended for organizations of any size, and a growing number of buyers ask suppliers to be certified to bid for work. Check your contract for which level it asks for.
Is Cyber Essentials a legal requirement?
The NCSC describes it as the government-recommended minimum standard. Some contracts require it, but check the terms that apply to you.
Sources
Something wrong or out of date? Tell us and we'll re-check it.