Cyber Essentials vs Cyber Essentials Plus: Which Does Your Business Need?

Both certificates cover the same five controls. The difference is who checks them and how. For most small businesses the question is not which is better, but which one the contract in front of you actually asks for.

The short answer

Cyber Essentials is a verified self-assessment. You answer a question set about your devices, accounts and cloud services, and an independent certification body marks your answers. Cyber Essentials Plus uses the same requirements, then adds a technical audit in which an assessor tests a sample of your devices and accounts to confirm the answers are true.

Most small businesses start with Cyber Essentials. Plus becomes worthwhile when a client, tender or insurer specifically asks for it, or when you want independent evidence that the controls work in practice.

What the Plus audit actually tests

The Plus audit follows a published test specification. The detail varies with your setup, but you should expect the assessor to check the following.

• An external vulnerability scan of your internet-facing systems, such as your office router or any servers you expose.
• A sample of your laptops, desktops and phones, checked for missing critical or high-risk updates older than 14 days.
• Whether malware protection blocks test files delivered by email and downloaded through a web browser.
• Whether multi-factor authentication is enforced on your cloud services, such as Microsoft 365 or Google Workspace.
• Whether staff use separate accounts for administration rather than their everyday login.

How to tell which one you need

Read the exact wording in the tender or supplier questionnaire. "Cyber Essentials or equivalent" means the self-assessment is enough. "Cyber Essentials Plus" means the audit is required. If the wording is unclear, ask the buyer before you commit. It is a normal question and saves you paying for an audit you did not need.

If no one has asked for either, Cyber Essentials is still worth doing. The Cyber Security Breaches Survey 2025/2026 found only 5% of UK businesses hold it, so the certificate can set you apart, and the preparation closes the gaps behind common attacks.

Plan for the three-month window

If you know you need Plus, do the remediation work before you submit Cyber Essentials, not after. The audit has to happen within three months of your Cyber Essentials pass, so the two should describe the same, stable setup. Businesses that pass the self-assessment and then start fixing things often run out of time.

Where Plus audits most often go wrong

• A device in the sample is missing an update released more than 14 days ago.
• A staff member's personal phone accesses work email but has no screen lock.
• One cloud service, often an older one nobody thinks about, does not enforce MFA.
• An administrator browses the web or reads email from their admin account.
• Malware protection is installed but not configured to block malicious websites.

For the full list of requirements, read our Cyber Essentials requirements checklist, or see how we prepare businesses for Cyber Essentials. The scheme itself is described on the NCSC Cyber Essentials pages.