Cyber Essentials vs Cyber Essentials Plus: what’s the difference?
Cyber Essentials and Cyber Essentials Plus assess the same five technical controls. Cyber Essentials uses a verified self-assessment; Plus adds independent technical testing. The right choice depends on the assurance your business needs and any requirement from a customer or other organisation asking for certification.
If a tender says “Cyber Essentials Plus”, a Cyber Essentials certificate alone does not meet that wording. If the request simply says “Cyber Essentials”, ask the requester to confirm the level, scope and deadline before committing to an assessment.
This Cyber Essentials vs Cyber Essentials Plus guide helps you make that decision. Cache4 can help with the preparation and technical fixes for either route. It does not replace the current scheme requirements or advice from the certification body assessing your organisation.
Cyber Essentials vs Cyber Essentials Plus: how the evidence differs
The NCSC’s comparison of the two levels makes the central distinction clear: both cover the same technical controls, while Plus checks how those controls work through technical testing.
For Cyber Essentials, your organisation answers the assessment questions about its setup. A senior person confirms the answers are accurate, and an assessor reviews them. “Self-assessment” does not mean awarding yourself a certificate or ticking boxes without evidence.
For Cyber Essentials Plus, the verified self-assessment is a prerequisite. A certification body also carries out a technical audit of your systems. IASME’s scheme guidance explains that this provides additional assurance that the required controls are in place.
The practical difference for an owner is the work needed to demonstrate the answers. Ask the certification body what access, people and preparation the audit will require, and how any findings will be handled.
Our Cyber Essentials checklist covers the five control areas and preparation in more detail. Here, the question is which assessment route answers your actual business need.
Start with the requirement, not the company size
A small company can need Plus because a customer requests it. A larger company might begin by establishing the baseline and agreeing its next step. Headcount alone is not a sensible way to choose.
Before getting a quote, gather these four pieces of information:
Exact wording: what certificate or other evidence has been requested?
Organisation and scope: which business entity, services and systems must the evidence cover?
Timing: when must the certificate be supplied, and who confirms whether the proposed timetable is acceptable?
Decision-maker: who at the requesting organisation can answer questions about the requirement?
Keep the written answer with the requirement. A conversation with a salesperson or an assumption based on last year’s tender may not settle what is required now.
If the wording comes from an insurance conversation, ask the insurer or broker what it means for the particular policy. Do not assume that either certificate automatically meets every insurance condition.
Three situations, three useful next steps
Imagine these three fictional businesses. The examples show a decision process, not rules based on business size.
A small design agency has received a customer questionnaire asking for “Cyber Essentials or equivalent evidence”. Its first job is to ask what the customer accepts and which parts of the business must be covered. Buying a particular assessment before clarifying that could leave the original question unanswered.
A maintenance company is preparing a bid whose documents explicitly require Cyber Essentials Plus. It should speak to a suitable certification body about scope, prerequisites and the available timetable. Separately, it needs to identify who will organise its technical preparation and answer business questions.
A consultancy has no immediate contractual request but wants a more structured security baseline. It can review the official requirements, establish where its setup falls short and decide what level of independent assurance is worthwhile. It does not need to invent a customer deadline to justify improving the basics.
In each case, write down the intended outcome before comparing providers: the required evidence, covered organisation, deadline, internal owner and person who will accept it.
What should you ask a certification body?
Use IASME’s certification-body directory to find an appropriate assessor. Confirm that the organisation can provide the level you need.
Ask questions that make the whole job understandable:
How will we agree the assessment scope, including remote workers, cloud services and business devices?
What information do you need before quoting or booking the assessment?
Which preparation work is included, and which changes must we arrange separately?
For Plus, what will the technical testing involve and who needs to be available?
How are questions, findings and any follow-up checks handled?
What timetable is realistic for our current setup and required deadline?
Compare the answers alongside the fee. An assessment, help interpreting questions and work to fix technical gaps are different activities. Check which ones a proposal covers rather than assuming they are all included.
Prepare a short decision record
Copy these fields into a working document and fill them in with the business owner, IT provider and certification body as appropriate:
Required evidence and requester: ______
Organisation and agreed scope: ______
Required date and reason: ______
Proposed certification level: ______
Certification body and contact: ______
Known preparation gaps and owner for each: ______
Assessment and separate preparation costs: ______
Next decision, person responsible and date: ______
Use the current IASME assessment questions and requirements when checking readiness. An old completed questionnaire can provide context, but it is not a substitute for the requirements that apply to the assessment you are taking now.
Keep the security work going after certification
A certificate records an assessed position; your business keeps changing. People join, devices are replaced, software is added and access requirements move on.
Decide who will maintain the agreed controls and flag changes that may affect your position. Put renewal planning in the calendar rather than leaving it until a customer asks for an updated certificate.
Neither level guarantees that an incident cannot happen. Certification is one part of the wider job of protecting the business and being able to respond when something goes wrong.
How Cache4 can help with Cyber Essentials and Cyber Essentials Plus
Cache4 helps small businesses prepare for Cyber Essentials and Cyber Essentials Plus. We help you understand the requirements, identify gaps in your setup and put the agreed technical fixes in place. We support you through the process, with formal assessment and certification carried out by an independent certification body.
Book a free Discovery Call to discuss the level you need, the preparation involved and how we can help.
Comments