Cyber Essentials and Cyber Essentials Plus cover the same five technical controls. Cyber Essentials is a self-assessment questionnaire verified by a certification body. Cyber Essentials Plus adds hands-on testing of a sample of your devices by an assessor. Start with Cyber Essentials, then move to Plus if a contract requires it.
What do both levels cover?
Both are based on the same five controls set by the UK government-backed scheme:
- Firewalls
- Secure configuration
- User access control
- Malware protection
- Security update management
What is the difference?
| Cyber Essentials | Cyber Essentials Plus | |
|---|---|---|
| How it is assessed | Self-assessment questionnaire, verified by a certification body | Same controls, plus hands-on technical testing by an assessor |
| Evidence | Your answers, signed off by a board member or equivalent | Testing of a sample of devices, accounts and settings |
| Assurance | Shows the controls are claimed and checked | Shows the controls are verified in practice |
| Prerequisite | None | Cyber Essentials, achieved first |
| Renewal | Every 12 months | Every 12 months |
Which one do you need?
If a client or tender simply asks for Cyber Essentials, the self-assessment level is usually enough. Many public sector and supply chain contracts ask for Plus, so check the requirement before you start.
Few businesses are certified. The government's 2025 breaches survey found that only 3% of UK businesses hold Cyber Essentials, so certification can set you apart from competitors.
Why do businesses fail Cyber Essentials?
- Unsupported operating systems or software still in use.
- Security updates not applied within the required timeframe.
- Staff with administrator rights they don't need.
- Default passwords or settings left unchanged.
A readiness check before you apply catches these early.
Frequently asked questions
Certificates are issued by certification bodies licensed through the scheme's delivery partner, IASME. Consultancies can prepare you, but the certificate comes from a licensed body.
Certification lasts 12 months, after which you need to recertify.
It is not a legal requirement, but it is required for many UK government contracts and increasingly by private sector clients and insurers.