Cyber Essentials or Plus? Here's the difference.

The short answer

Both check the same five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. The difference is how you prove it.

	Cyber Essentials	Cyber Essentials Plus
How it works	Online self-assessment questionnaire, signed off by a director and marked by a certification body	Everything in Cyber Essentials, then a hands-on technical audit by an assessor
Who checks	An assessor reviews your answers	An assessor tests a sample of your actual devices and accounts
Timing	Whenever you're ready	The audit must be completed within 3 months of your Cyber Essentials certificate
Lasts	12 months	12 months
Cost	Fixed fee by organisation size	Quoted by the certification body, depending on devices and sites

See how much Cyber Essentials costs for the current fees.

What the Plus audit actually tests

The assessor checks that what you said in the questionnaire is true in practice. Expect:

• An external scan of your internet-facing systems, such as your router, firewall and any servers.
• Checks on a sample of laptops, desktops, phones and servers to confirm they're supported and patched.
• Tests that your malware protection blocks harmful email attachments and downloads.
• Checks that multi-factor authentication is switched on for your cloud services, such as Microsoft 365 or Google Workspace.
• Checks that staff use everyday accounts, with admin rights kept separate.

The size of the sample depends on how many devices and locations you have. A single missing update on a sampled laptop can be enough to fail, which is why preparation matters more for Plus.

Which one do you need?

Cyber Essentials is usually enough if a customer, insurer or tender simply asks for "Cyber Essentials", or you want a solid baseline and a badge for your website.

Go for Plus if a contract asks for it by name, which is common in public sector work, defence supply chains and contracts involving sensitive personal data. It's also worth it if you want real assurance your controls work, not just that you've answered the questions well.

Not sure? Check the contract or tender wording, or ask the customer. It's cheaper to ask than to certify twice.

What changed in 2026

Since April 2026, applications use the latest question set, known as Danzell. The headline changes:

• Multi-factor authentication is mandatory on cloud services wherever it's available. Missing it is now an automatic fail.
• Routers, firewalls and apps need patching, not just laptops and servers.
• A director must sign off the assessment and is accountable for the answers.

Checklist before you apply

1. A list of every device that touches company data, including personal phones used for work email.
2. No unsupported software or operating systems anywhere in scope.
3. Critical and high-risk updates applied within 14 days of release.
4. Multi-factor authentication on every cloud service that offers it.
5. Separate admin accounts, used only for admin tasks.
6. Default passwords changed on routers, firewalls and other devices.
7. Malware protection active on every device that needs it.
8. A director who has read the answers and is happy to sign.

How I help

I don't carry out the Plus audit myself, so there's no conflict of interest. Instead I prepare you for it and manage it: a gap review, hands-on fixes, the submission itself, then working with the assessor on the day and resolving anything they find. The goal is that you pass first time. Read more about how I help with Cyber Essentials.