Cyber Essentials vs Cyber Essentials Plus: Which Do You Need?

Cyber Essentials and Cyber Essentials Plus cover the same five technical controls. The difference is how compliance is verified: Cyber Essentials is a verified self-assessment, while Plus adds an independent technical assessment that tests a sample of your systems. Choose Plus when a contract explicitly requires it or when you need independently tested assurance. Otherwise, Cyber Essentials is normally the appropriate starting point.

This guide is about the differences and which level you need. If you already know the level and want the figures, use our Cyber Essentials and Plus cost comparison or view current packages.

Cyber Essentials is the self-assessed certification level. Your organisation completes a questionnaire covering five control categories - firewalls, secure configuration, security update management, user access control, and malware protection. An IASME-licensed certification body reviews your answers and issues the certificate if you meet the requirements.

Cyber Essentials Plus adds independent, third-party verification. An external auditor reviews your self-assessment, then conducts a technical audit of your systems. This includes vulnerability scanning of your external-facing infrastructure and verification that the controls you described are actually implemented and working.

Cyber Essentials is appropriate when:

• You need certification quickly - Cyber Essentials can be completed in a single day with Fig Group. If you are facing an urgent tender deadline, it is the fastest route.
• Your clients require Cyber Essentials but do not specify Plus - Many contracts simply require "Cyber Essentials certification" without specifying the level.
• You are a small organisation with a simple IT environment - If you have fewer than 50 employees, a straightforward network, and no complex cloud infrastructure, Cyber Essentials demonstrates adequate controls.
• You want a cost-effective starting point - At £299.99 + VAT, Cyber Essentials is an affordable way to demonstrate commitment to cybersecurity fundamentals.
• A contract names Cyber Essentials without specifying Plus - Follow the exact wording of the requirement rather than assuming a higher tier is necessary.

Cyber Essentials Plus is the right choice when:

• Your clients or contracts specifically require Plus - If the requirement says Cyber Essentials Plus, the base certificate alone will not satisfy it.
• You want to demonstrate verified controls - Plus carries greater credibility because an independent auditor has confirmed your controls work, not just that you claim they do.
• You handle sensitive data at scale - Organisations processing significant volumes of personal data, financial data, or health data should consider the additional assurance that Plus provides.
• Your own risk decision calls for independent testing - Plus gives management and buyers evidence that a sample of the implemented controls was technically assessed.

Cyber Essentials process with Fig Group:

1. Purchase your Cyber Essentials certification and choose the organisation size

2. Complete the self-assessment questionnaire

3. Submit for review - orders before midday - certified in under 6 hours from self-assessment submission

4. Receive structured feedback if any gaps are identified (up to 3x)

5. Cyber Essentials Plus certificate issued on successful completion

Plus process with Fig Group:

1. Achieve Cyber Essentials certification first (this is a prerequisite)

2. Purchase your Cyber Essentials Plus certification

3. Schedule the third-party technical audit

4. Auditor conducts vulnerability scanning and control verification (1-3 days)

5. Certificate issued on successful completion

Yes. Many organisations start with Cyber Essentials to meet an immediate requirement, then upgrade to Plus when the business case demands it. Since Cyber Essentials is a prerequisite for Plus, achieving it first is always the right starting point.

For most organisations, start with Cyber Essentials unless the contract wording already specifies Plus. Cyber Essentials is the required baseline for Plus, so starting there does not close off the stronger assessment. If a buyer asks for Plus, schedule the independent assessment while the underlying Cyber Essentials certificate is within the scheme's permitted window.

If you are unsure which level you need, check the exact wording in the tender, supplier questionnaire or customer contract. You can then speak to our team or use our readiness checker to assess your current position.

Compare the cost of Cyber Essentials and Plus | View current pricing and packages | Explore Cyber Essentials Plus certification