Key Takeaways
- Both levels assess the same five controls: firewalls, secure configuration, security update management, user access control and malware protection.
- Cyber Essentials is a verified self-assessment, while Plus adds independent technical testing of a sample of your devices and cloud services.
- Plus builds on the standard certification, so the self-assessment always comes first.
- Customer contracts or tender documents may set the level for you. If the choice is yours, let your risk and your customers’ expectations guide it.
- Plus costs more than the standard assessment because it needs technical experts’ time.
On this page
- What Is the Difference Between Cyber Essentials and Cyber Essentials Plus?
- Does Cyber Essentials Plus Cover More Controls?
- What Level of Assurance Does Each Certificate Give?
- Do You Need Cyber Essentials Before Cyber Essentials Plus?
- Does Cyber Essentials Plus Cost More?
- Who Needs Cyber Essentials Plus?
- Get Cyber Essentials or Cyber Essentials Plus with OmniCyber
- Related Questions
Cyber Essentials vs Cyber Essentials Plus: What is the Difference?
Last reviewed October 2026. Reflects Requirements for IT Infrastructure v3.3 and the Danzell question set.
Cyber Essentials and Cyber Essentials Plus assess the same five technical controls. The difference is how they are verified: Cyber Essentials is a verified self-assessment reviewed by a licensed Certification Body, while Cyber Essentials Plus adds an independent technical audit that tests whether those controls are working in your environment. Plus is therefore a higher level of assurance, and it builds on the standard certification.
What Is the Difference Between Cyber Essentials and Cyber Essentials Plus?
The difference between Cyber Essentials and Plus is how the controls are verified (IASME guidance). Cyber Essentials is a verified self-assessment reviewed by a licensed Certification Body, while Cyber Essentials Plus adds a technical audit of your systems by an independent assessor.
| Feature | Cyber Essentials | Cyber Essentials Plus |
|---|---|---|
| How it is assessed | Online questionnaire, reviewed by an assessor | The same questionnaire, plus a technical audit of your systems |
| Technical testing | None | Vulnerability scanning, device checks, malware protection and MFA testing |
| What it confirms | What your organisation states is in place, verified by an assessor | Whether the controls are working on the systems tested |
| Time limit | Six months from buying your assessment account | Within 90 days of your Cyber Essentials certification |
| Validity | 12 months | 12 months |
| Relative cost | Lower | Higher, because it needs technical experts’ time |
For how these time limits affect a customer deadline, see A Customer Has Asked for Cyber Essentials: What Should You Do?
Does Cyber Essentials Plus Cover More Controls?
No. Cyber Essentials Plus is based on the same technical requirements as Cyber Essentials, so it does not add controls. It tests the same five on a sample of real devices and cloud services.
A Plus audit typically includes:
- External vulnerability scanning of your internet-facing addresses
- Internal vulnerability scanning of a sample of devices
- Malware protection testing, including browser and email checks
- Checks that MFA is operating on your cloud services
- A review of administrator account separation
What Level of Assurance Does Each Certificate Give?
A verified self-assessment confirms what an organisation states is in place, reviewed by an assessor. Plus tests a sample of real devices to check whether those controls are working, which is a different level of evidence.
A self-assessment establishes how an organisation says it meets the requirements, while technical testing provides additional evidence of how those controls operate in practice. For example, a questionnaire answer might state that all devices receive high-risk and critical updates within 14 days. At the standard level, an assessor reviews that answer. At Plus, a vulnerability scan of a sample of devices shows whether it is true.
Neither certificate guarantees that an organisation is free from vulnerabilities. Plus provides stronger evidence that the controls are working on the devices tested, not proof that you are secure.
Do You Need Cyber Essentials Before Cyber Essentials Plus?
Yes. The verified self-assessment is a prerequisite for Plus, and the Plus audit must be completed within 90 days of your Cyber Essentials certification.
At OmniCyber, the Plus package includes the Cyber Essentials self-assessment, so both stages can be planned together. If you completed Cyber Essentials elsewhere, you can share your answers and certificate with us before your Plus audit. If you are unsure whether your environment is ready for testing, GRACE is a one-day readiness check.
Does Cyber Essentials Plus Cost More?
Yes. Plus costs more than the standard assessment because it needs time from technical experts to test your systems. The amount depends on your organisation and scope.
Who Needs Cyber Essentials Plus?
Where a contract specifies Plus, you need it. Where you have a choice, the right level depends on your risk and on how much assurance your customers expect, not only on the minimum requirement.
For certain UK central government contracts, Procurement Policy Note, PPN 014 requires suppliers to demonstrate appropriate cyber security controls. Cyber Essentials or Cyber Essentials Plus certification is a recognised way to meet these requirements, although equivalent controls may also be accepted. The level of assurance required depends on the contract and associated risks, so Plus is not automatically mandatory for all government suppliers. Where Cyber Essentials certification is required, it must be renewed annually for the duration of the contract.
Requests from customers, tenders and insurers vary, so check the exact wording and confirm the level in writing. See A Customer Has Asked for Cyber Essentials: What Should You Do? for how to read a request.
Where you do have a choice:
- Cyber Essentials may be sufficient where a recognised baseline is required, the associated risks are relatively low, and customers do not require independent technical testing.
- Plus suits situations where customers want evidence that controls work, not just that they exist, or where you want confidence that the basics are in place in practice.
Get Cyber Essentials or Cyber Essentials Plus Certified With OmniCyber
OmniCyber is an IASME-licensed Certification Body with dedicated Cyber Essentials specialists and more than ten years of certification experience.
We support Cyber Essentials certification and Cyber Essentials Plus certification, including renewals, with expert guidance to help you choose the right level and prepare for assessment.
Related Questions
Is Cyber Essentials Plus mandatory?
Not in general. It is required only where a contract or customer specifies it. Government procurement guidance refers to either level, and individual contracts can specify more.
Can I go straight to Cyber Essentials Plus?
Not without completing the self-assessment first. At OmniCyber the Plus package includes it, so both stages can be planned as one project.
How long do I have between Cyber Essentials and Cyber Essentials Plus?
You have 90 days from your Cyber Essentials certification to complete the Plus audit. See A Customer Has Asked for Cyber Essentials: What Should You Do? for how this affects the time available for remediation.
Do both certificates last the same length of time?
Yes. Both are valid for 12 months.
Not sure which level your customer needs? Speak to an Expert before you start.
Jennifer Goulbourne
Jennifer is a Digital Marketing Executive at OmniCyber Security, where she's responsible for engaging the company's existing customer base across digital channels and creating helpful resources on threat intelligence and security operations for cybersecurity professionals and business leaders.
