Can I get Cyber Essentials Plus without Cyber Essentials?

No - Cyber Essentials Plus cannot be issued without a current Cyber Essentials certificate. The Plus audit builds on the same self-assessment as the standard Cyber Essentials scheme. In practice, both can be completed in a single engagement, so "starting from scratch" and "CE + CE Plus together" is a common path.

The IASME scheme rules require the self-assessment questionnaire to be reviewed and passed before the Plus technical audit takes place. Plus is not a separate product with a separate standard - it is the same five controls, verified by hands-on technical testing rather than by self-declaration.

A Plus audit, on top of the self-assessment review, adds:

• Authenticated vulnerability scan of a representative device sample.
• External vulnerability scan of internet-facing infrastructure.
• Email-filtering and malware-protection test (EICAR / test-URL delivery, receipt review).
• Browser-based malware test (known malicious URL blocked).
• Patch-management verification against the 14-day rule.
• MFA configuration check on cloud services in scope.

See the dedicated piece: Cyber Essentials Plus remote audit: how the assessor actually tests your controls.

Yes. Some certification bodies, including Fig Group, offer a combined package. Check whether the quoted Plus price includes the prerequisite Basic assessment; there is no need to buy Basic twice when it is included. The steps are:

1. The organisation submits the CE self-assessment.

2. A licensed assessor reviews the Basic submission. Fig Group's conditional six-working-hour guarantee applies only after receipt of a complete, compliant Basic submission before midday UK time on a UK Business Day, under the certification terms.

3. The Plus audit is scheduled within the following weeks - on a timetable agreed for the technical audit, within the scheme window.

The CE certificate issued in step 2 remains valid for 12 months; the Plus certificate issued at the end of step 3 is also valid for 12 months from its own issue date.

Cyber Essentials from £299.99 + VAT (Micro). Cyber Essentials Plus from £1,499.99 + VAT (Micro). Both scale by headcount. See the full pricing page.

Cyber Essentials Plus requires a current Cyber Essentials certificate - but both can be arranged in one engagement when the package includes the Basic step. A different suitably licensed Plus body can conduct the technical audit. For UK tender, MOD sub-contracting, and enterprise supplier work where Plus is specified, the cleanest route is to plan them together from the start. The Cyber Essentials Plus certification service explains the audit, preparation, current turnaround, and packages.

Start Cyber Essentials from £299.99 + VAT | Explore Cyber Essentials Plus | Cyber Essentials vs Cyber Essentials Plus