Cyber Essentials vs Cyber Essentials Plus usually becomes a live question at an awkward moment. A tender deadline is close, or a client’s security questionnaire is sitting unanswered in your inbox, and someone has asked for proof. They have good reason to. The government’s latest Cyber Security Breaches Survey found that 43% of businesses reported a breach or attack in the past twelve months.

If you haven’t yet read our guide on what to do when a client, insurer or tender asks for Cyber Essentials, start there. This piece picks up from that point and helps you choose the right level.

1. 1. What is the difference between Cyber Essentials and Cyber Essentials Plus?
   2. Which level will your clients, insurers and tenders accept?
   3. How much do Cyber Essentials and Cyber Essentials Plus cost?
   4. What does a Cyber Essentials Plus assessment involve?
   5. Is Cyber Essentials Plus worth the extra investment?
   6. Should you start with Cyber Essentials or go straight to Plus?
   7. How can a managed IT provider help with certification?
   8. Frequently asked questions

Both schemes check the same five controls: firewalls, secure configuration, user access control, malware protection and patch management. The difference is how that gets proven.

You complete a questionnaire about how your business is set up, and a certification body reviews it. There is no technical testing, as the NCSC confirms. Pricing is tiered by organisation size and starts at £320 plus VAT. In effect, you are telling someone that your controls are in place.

Same controls, but now someone else checks. An independent assessor runs authenticated vulnerability scans on a representative set of your devices, scans your internet facing systems, tests for weak passwords on exposed services and checks how email attachments and browser downloads are handled, according to Amtivo, a certification body. A failure in any one test area means an overall fail.

It depends entirely on the wording of the request. A bare “Cyber Essentials” usually means the basic level. Phrases like “Plus”, “technical testing” or “independently verified” mean the higher one. If it isn’t clear, ask. Guessing wrong costs weeks.

Larger firms are looking harder at their suppliers. When Marks & Spencer warned that its 2025 cyber attack could cost as much as £300 million, it said the breach began with a social engineering attack on a third party supplier. Few businesses can say they’ve been independently checked, either. Only 3% of businesses held Cyber Essentials in the 2025 breaches survey, so certification still sets a supplier apart.

UK organisations with turnover under £20 million that certify their whole organisation can opt in to cyber liability insurance arranged by IASME, with a £25,000 limit and 24/7 incident response support. Read the policy wording, because it excludes electronic theft of money. Your own insurer may have separate expectations, so check with your broker.

Under Procurement Policy Note 014, which applies from 24 February 2025, central government bodies must make sure suppliers on certain contracts, such as those handling members of the public’s personal data, meet set technical requirements. Certification is described as the quickest route, and it has to be renewed annually. Always check which level the tender actually names.

Cyber Essentials starts at £320 plus VAT, depending on your size. Cyber Essentials Plus is quoted according to the size and complexity of your network, so there is no standard price.

What moves that number is rarely the assessment fee. It is the work needed before the assessment: how many devices you have, how much needs fixing, and whether anything has to be retested.

It is a hands on technical test of a sample of your devices and internet facing systems, rather than a review of paperwork. The bar also went up on 27 April 2026, as NCC Group explains.

Patches more than 14 days old, unsupported software and weak passwords on exposed services are the usual culprits, according to Amtivo. For firms running Microsoft 365, gaps in MFA coverage are an easy one to miss, especially on older accounts and shared mailboxes.

IASME stipulates that Plus should be completed within three months of obtaining basic certification, as Amtivo notes. How long the preparation takes depends on how much remediation you need, so a gap analysis first will save you an unpleasant surprise.

Yes, when someone needs independent proof. If a client contract, a tender or an insurer asks for Plus by name, the question answers itself. The benefits of Cyber Essentials Plus certification go beyond the certificate: you find out whether your controls hold up under real testing, and you can show it to customers who would otherwise have to take your word for it.

If nobody has asked, basic certification done properly is a perfectly sensible place to stop for now. Fixing what the questionnaire turns up is often the better first spend than paying for a test you are not yet ready to pass.

Most businesses complete basic certification first, then book Plus within the three month window. There’s a logic to it. Assessors check that your systems match what you declared in your self assessment, and under the new rules your answers cannot be changed once Plus testing begins. Get the scope right at the first stage, and the second goes much more smoothly.

A good provider helps in three places. First, a gap analysis before you pay for any assessment. Second, fixing what it finds, such as patching, MFA across Microsoft 365 and removing old admin accounts. Third, technical audit support on assessment day, so nothing catches you out. You can read more about how we approach this on our Cyber Essentials and Cyber Essentials Plus page, or about our wider IT security services. If you would rather talk it through, get in touch.