Cyber Essentials vs Cyber Essentials Plus Explained

If you have been asked to "get Cyber Essentials" by a customer, an insurer or a public-sector framework, you have probably also seen the word "Plus" and wondered whether you need it, what the difference is, and what it will cost. This guide answers all three for UK businesses, in plain terms.

Cyber Essentials is a UK government-backed certification scheme, created by the National Cyber Security Centre (NCSC) and delivered by IASME. It comes in two levels: Cyber Essentials and Cyber Essentials Plus. Both check the same five basic security controls; the difference is in how thoroughly they are checked.

Why Cyber Essentials exists

Most attacks on small businesses are not sophisticated. The UK government's Cyber Security Breaches Survey 2025/26 found that 43% of businesses experienced a breach or attack in the previous year, with phishing by far the most common. Cyber Essentials exists to put the basic controls in place that stop the bulk of these everyday, opportunistic attacks. It is deliberately simple and low-cost, so that any organisation can reach a sensible baseline.

The five controls (the same at both levels)

Whichever level you go for, you are certified against the same five technical controls:

• Firewalls — protecting the boundary between your networks and the internet.
• Secure configuration — removing default passwords and unnecessary features, and locking devices down sensibly.
• User access control — giving people only the access they need, and controlling administrator accounts.
• Malware protection — antivirus or equivalent on every device.
• Security update management — keeping operating systems and software patched and supported.

These five map neatly onto the kind of hygiene that stops incidents such as the recent PHP2Shell vulnerability: supported, patched software and controlled access are exactly what the scheme asks for.

Cyber Essentials: the self-assessment

Standard Cyber Essentials is a verified self-assessment. You answer IASME's question set about how your systems are configured, and a qualified assessor reviews your answers and either certifies you or tells you what to fix. There is no site visit and no hands-on testing; it relies on your honest account of your setup.

It is quick and inexpensive, and for many businesses it is enough: plenty of contracts and cyber-insurance policies simply require "Cyber Essentials". It is the right starting point for almost everyone.

Cyber Essentials Plus: the audited version

Cyber Essentials Plus covers the same five controls, but instead of trusting your answers, an assessor tests them. They take a sample of your devices and cloud services and run hands-on checks, for example confirming that updates really are applied, that malware protection works, and that accounts are controlled. It is usually done remotely over screen sharing.

Because it is independently verified, Plus is what clients, insurers and some frameworks ask for when "we certify ourselves" is not enough. It must be completed within three months of your standard Cyber Essentials certificate, on the same scope.

Cyber Essentials vs Cyber Essentials Plus, side by side

The costs above are indicative market figures, not a quote. IASME sets the self-assessment fee by organisation size (from £320 to £600 + VAT); Cyber Essentials Plus is quoted individually by a certification body because the audit scales with your device sample, sites and cloud services, and published prices are broadly in the £950 to £4,000 + VAT range on top of the self-assessment.

Which should your business get?

A simple rule of thumb:

• Start with Cyber Essentials if you want a solid baseline and your contracts or insurers accept it. It is the fastest, cheapest way to show you take security seriously.
• Go to Cyber Essentials Plus when a customer, insurer, tender or framework specifically requires it, when you handle sensitive client data, or when you would simply rather have your controls proven than self-declared.

Either way, treat the certificate as the by-product of good security, not the goal. The work of getting ready, tightening configuration, controlling admin accounts, patching and rolling out multi-factor authentication, is what actually reduces your risk. Our guide to cyber security for UK businesses covers those fundamentals.

How it fits with the rest of your security

Cyber Essentials is a baseline, not a finish line. Once the five controls are solid, the next questions are about detection and response: who notices an attack, and who acts, especially out of hours. That is where managed detection and response comes in, and where a plan for the worst case matters, as in our ransomware action plan.

What getting ready actually involves

Whichever level you aim for, the preparation is the same, and it is where the real security benefit comes from. In practice, getting ready usually means:

• Turning on multi-factor authentication for every account, especially email, cloud services and remote access.
• Removing unsupported software and operating systems, such as any machine still on an end-of-life version of Windows, since the scheme requires supported, patched software.
• Controlling administrator accounts, so day-to-day work does not happen on admin logins and only the right people have elevated rights.
• Applying security updates on a schedule across operating systems, browsers, firewalls and applications, rather than when someone remembers.
• Standardising device configuration: default passwords changed, unnecessary features switched off, and devices set to lock.

Most of this is low-cost, and much of it may already be partly in place. The value is that the same work that earns the certificate also closes the gaps attackers use most.

Why businesses fail the first time

The common stumbling blocks are not exotic: multi-factor authentication missing on some accounts, a forgotten machine running software that is no longer supported, user accounts with more access than the role needs, or patching that is inconsistent across the estate. For Cyber Essentials Plus specifically, cloud services and home-working devices are easy to overlook when they should be in scope. Working through these before you apply, rather than during the assessment, is what turns certification from a gamble into a formality.

Talk to Omega IT

Omega IT is Cyber Essentials Plus certified (2026, via CyberSmart), so we work to the same standard we encourage clients to reach. If you want help understanding where your business stands against the five controls and what it would take to be ready, our cyber security services are the place to start.

Sources

• NCSC: Cyber Essentials overview
• IASME: Cyber Essentials (scheme, levels and fees)
• GOV.UK: Cyber Security Breaches Survey 2025/26

General guidance, accurate to October 2026; scheme details and fees can change. Diagrams by Omega IT.