Cyber Essentials vs Cyber Essentials Plus: which does your business need?

Cyber Essentials and Cyber Essentials Plus certify the same five technical controls. The difference is how they are checked. Cyber Essentials is a self-assessment questionnaire verified by a qualified assessor, with a fee set by organisation size from £320 +VAT ^{1Source 1Cyber Essentials (fees and certification process) — IASME Consortium, web page.iasme.co.uk/cyber-essentials/Accessed 2 November 2026See in Sources2Source 2Cyber Essentials — National Cyber Security Centre (NCSC), web page.www.ncsc.gov.uk/cyberessentials/overviewAccessed 3 November 2026See in Sources}. Cyber Essentials Plus adds an independent, hands-on technical audit of your systems by a certification body, priced on the size and complexity of your network and typically quoted at about £900 to £3,000 +VAT in the UK market ^{2Source 2Cyber Essentials — National Cyber Security Centre (NCSC), web page.www.ncsc.gov.uk/cyberessentials/overviewAccessed 3 November 2026See in Sources3Source 3Cyber Essentials Plus Test Specification v3.2 — National Cyber Security Centre (NCSC), April 2025.www.ncsc.gov.uk/sites/default/files/2026-05/cyber-essentials-plus-test-specification-v3-2%20english.pdfAccessed 3 November 2026See in Sources4Source 4Cyber Essentials cost UK: full pricing breakdown (2026 guide) — Intelance, reviewed August 2026 (certification body price guide).www.intelance.co.uk/cyber-essentials-cost-uk/Accessed 3 November 2026See in Sources}. Most small businesses need Cyber Essentials. You need Plus when a contract or customer specifies it, when you want independent proof that your controls actually work, or when you supply the Ministry of Defence at its higher assurance levels ^{5Source 5Defence Standard 05-138 Issue 4: Cyber Security for Defence Suppliers — Ministry of Defence, 14 May 2024.assets.publishing.service.gov.uk/media/664f42a7993111924d9d3ad8/Def_Stan_05_138_issue_4.pdfAccessed 3 November 2026See in Sources}.

The short version

• Both schemes cover firewalls, secure configuration, security update management, user access control and malware protection ^{6Source 6Cyber Essentials: Requirements for IT Infrastructure v3.3 — National Cyber Security Centre (NCSC), April 2026.www.ncsc.gov.uk/files/cyber-essentials-requirements-for-it-infrastructure-v3-3.pdfAccessed 3 November 2026See in Sources}.
• Cyber Essentials: a verified self-assessment, £320 to £600 +VAT by organisation size, reviewed within three working days of submission ^{1Source 1Cyber Essentials (fees and certification process) — IASME Consortium, web page.iasme.co.uk/cyber-essentials/Accessed 2 November 2026See in Sources}.
• Cyber Essentials Plus: the same assessment plus an audit of a sample of your devices and cloud accounts, completed within three months of the Cyber Essentials certificate ^{3Source 3Cyber Essentials Plus Test Specification v3.2 — National Cyber Security Centre (NCSC), April 2025.www.ncsc.gov.uk/sites/default/files/2026-05/cyber-essentials-plus-test-specification-v3-2%20english.pdfAccessed 3 November 2026See in Sources7Source 7Cyber Essentials: frequently asked questions — IASME Consortium, web page.iasme.co.uk/cyber-essentials/frequently-asked-questions/Accessed 2 November 2026See in Sources}.
• Buy Cyber Essentials first in every case. Plus is only possible on top of it ^{7Source 7Cyber Essentials: frequently asked questions — IASME Consortium, web page.iasme.co.uk/cyber-essentials/frequently-asked-questions/Accessed 2 November 2026See in Sources}.

What is the difference between Cyber Essentials and Cyber Essentials Plus?

What does the Cyber Essentials Plus audit involve?

The NCSC's test specification sets out five test cases: a remote vulnerability assessment, to check whether an internet-based opportunist attacker could get in with typical low-skill methods; an authenticated vulnerability scan of devices to check patching; a check of malware protection; a check of multi-factor authentication configuration; and a check of account separation ^{3Source 3Cyber Essentials Plus Test Specification v3.2 — National Cyber Security Centre (NCSC), April 2025.www.ncsc.gov.uk/sites/default/files/2026-05/cyber-essentials-plus-test-specification-v3-2%20english.pdfAccessed 3 November 2026See in Sources}. The assessor tests a representative sample of your devices, calculated using the method set by the scheme's delivery partner, and at least one normal user and one administrative user for every cloud service you use ^{3Source 3Cyber Essentials Plus Test Specification v3.2 — National Cyber Security Centre (NCSC), April 2025.www.ncsc.gov.uk/sites/default/files/2026-05/cyber-essentials-plus-test-specification-v3-2%20english.pdfAccessed 3 November 2026See in Sources}.

The audit got stricter in April 2026 with version 3.3 of the requirements: a retest after a failure now covers the original sample plus a new random sample of different devices, and a second failure revokes the Cyber Essentials certificate as well ^{12Source 12Cyber Essentials Plus v3.3: the audit changes UK buyers should know — Forensic Control, 5 May 2026 (certification body).forensiccontrol.com/news/cyber-essentials-plus-v3-3-the-audit-changes-uk-buyers/Accessed 3 November 2026See in Sources}.

How much do they cost?

The Cyber Essentials fee is fixed by IASME, the NCSC's delivery partner, by organisation size: £320 +VAT for 0–9 employees, £440 for 10–49, £500 for 50–249 and £600 for 250 or more ^{1Source 1Cyber Essentials (fees and certification process) — IASME Consortium, web page.iasme.co.uk/cyber-essentials/Accessed 2 November 2026See in Sources}. Cyber Essentials Plus has no fixed fee; the NCSC says it is priced according to the size and complexity of your network ^{2Source 2Cyber Essentials — National Cyber Security Centre (NCSC), web page.www.ncsc.gov.uk/cyberessentials/overviewAccessed 3 November 2026See in Sources}. Published UK price guides give a feel for the market:

• One certification body prices Cyber Essentials and Plus together at £1,240 +VAT for a micro organisation rising to £1,800 for a large one, and the Plus audit on its own from £920 +VAT, noting Plus is often quoted elsewhere at £1,400 to £4,000 ^{8Source 8How much does Cyber Essentials Plus cost? (2026 UK price guide) — Layer 7, June 2026 (certification body price guide).layer7.uk/insights/cyber-essentials-plus-cost/Accessed 3 November 2026See in Sources}.
• Another certification body says Plus commonly costs £1,500 to £3,000 +VAT in the market, and lists its own price below that range ^{4Source 4Cyber Essentials cost UK: full pricing breakdown (2026 guide) — Intelance, reviewed August 2026 (certification body price guide).www.intelance.co.uk/cyber-essentials-cost-uk/Accessed 3 November 2026See in Sources}.
• A managed IT provider's guide puts the audit at £1,500 to £5,000 or more, and the total for a small or medium business, including consultancy and fixing gaps, at £2,000 to £8,000 ^{9Source 9Cyber Essentials cost in the UK: 2026 pricing guide — Cloudswitched, 12 April 2026 (provider price guide).www.cloudswitched.com/blog/cyber-essentials-cost-uk-2026-pricingAccessed 3 November 2026See in Sources}.

Those figures exclude the work to meet the controls in the first place, which is usually the biggest cost. Our guide to what Cyber Essentials costs and how long it takes covers readiness and remediation at market prices.

Who asks for Cyber Essentials, and who asks for Plus?

• UK central government and the NHS. Procurement Policy Note 014 requires suppliers on contracts that handle citizens' personal information or process OFFICIAL data to hold Cyber Essentials or Cyber Essentials Plus, renewed every year of the contract; it says Plus should be used where there is a higher risk of cyber security threats ^{11Source 11PPN 014: Cyber Essentials scheme — Cabinet Office, 17 February 2025.www.gov.uk/government/publications/ppn-014-cyber-essentials-scheme/ppn-014-cyber-essentials-scheme-htmlAccessed 3 November 2026See in Sources}. The PPN applies to central government departments, their agencies and NHS bodies rather than Northern Ireland's departments, but NI public bodies and prime contractors often ask for the same evidence.
• The Ministry of Defence. Defence Standard 05-138 (Issue 4, May 2024) requires Cyber Essentials at every level of its supplier cyber security model, and Cyber Essentials Plus covering the scope of the contract at Levels 2 (Advanced) and 3 (Expert) ^{5Source 5Defence Standard 05-138 Issue 4: Cyber Security for Defence Suppliers — Ministry of Defence, 14 May 2024.assets.publishing.service.gov.uk/media/664f42a7993111924d9d3ad8/Def_Stan_05_138_issue_4.pdfAccessed 3 November 2026See in Sources}.
• Insurers. The NCSC reports data from the scheme's insurer showing certified organisations are 92% less likely to make a claim, and notes that some insurers discount for Cyber Essentials or Plus ^{13Source 13NCSC Annual Review 2025: empowering organisations with NCSC tools and services — National Cyber Security Centre, 14 October 2025.www.ncsc.gov.uk/collection/ncsc-annual-review-2025/chapter-02-resilience-at-scale/empowering-organisations-ncsc-tools-servicesAccessed 3 November 2026See in Sources14Source 14Cyber insurance guidance — National Cyber Security Centre (NCSC), 2020.www.ncsc.gov.uk/guidance/cyber-insurance-guidanceAccessed 3 November 2026See in Sources}.
• Customers and tender panels. 69% of certified organisations told the NCSC the scheme had increased their market competitiveness, and 48% said it saved time on security due diligence ^{13Source 13NCSC Annual Review 2025: empowering organisations with NCSC tools and services — National Cyber Security Centre, 14 October 2025.www.ncsc.gov.uk/collection/ncsc-annual-review-2025/chapter-02-resilience-at-scale/empowering-organisations-ncsc-tools-servicesAccessed 3 November 2026See in Sources}.

How long do they take?

• Cyber Essentials: an assessor reviews a submitted questionnaire within three working days, and you have up to six months from purchase to submit ^{1Source 1Cyber Essentials (fees and certification process) — IASME Consortium, web page.iasme.co.uk/cyber-essentials/Accessed 2 November 2026See in Sources7Source 7Cyber Essentials: frequently asked questions — IASME Consortium, web page.iasme.co.uk/cyber-essentials/frequently-asked-questions/Accessed 2 November 2026See in Sources}. Preparation is what takes time: one to two weeks if your systems are well managed, four to eight weeks from a standing start ^{9Source 9Cyber Essentials cost in the UK: 2026 pricing guide — Cloudswitched, 12 April 2026 (provider price guide).www.cloudswitched.com/blog/cyber-essentials-cost-uk-2026-pricingAccessed 3 November 2026See in Sources}.
• Cyber Essentials Plus: the audit must be completed within three months of the Cyber Essentials certificate ^{7Source 7Cyber Essentials: frequently asked questions — IASME Consortium, web page.iasme.co.uk/cyber-essentials/frequently-asked-questions/Accessed 2 November 2026See in Sources}. Certification bodies say the test itself can often be done in a day once the scope and sample are agreed ^{8Source 8How much does Cyber Essentials Plus cost? (2026 UK price guide) — Layer 7, June 2026 (certification body price guide).layer7.uk/insights/cyber-essentials-plus-cost/Accessed 3 November 2026See in Sources}; provider guides suggest allowing two to eight weeks overall, and starting eight to twelve weeks before a deadline ^{9Source 9Cyber Essentials cost in the UK: 2026 pricing guide — Cloudswitched, 12 April 2026 (provider price guide).www.cloudswitched.com/blog/cyber-essentials-cost-uk-2026-pricingAccessed 3 November 2026See in Sources}.

How common is each certificate?

In the year to 2025, 39,790 Cyber Essentials certificates and 12,850 Cyber Essentials Plus certificates were awarded, both up about 17% on the year before, with a 1.1% fail rate ^{13Source 13NCSC Annual Review 2025: empowering organisations with NCSC tools and services — National Cyber Security Centre, 14 October 2025.www.ncsc.gov.uk/collection/ncsc-annual-review-2025/chapter-02-resilience-at-scale/empowering-organisations-ncsc-tools-servicesAccessed 3 November 2026See in Sources}. Take-up is still low overall: in the Government's 2025/2026 survey only 17% of UK businesses were aware of Cyber Essentials and 5% held it, rising to 12% of small and 35% of large businesses, and only 24% reported controls in all five areas ^{15Source 15Cyber security breaches survey 2025/2026 — Department for Science, Innovation and Technology (official statistics), 30 April 2026.www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026Accessed 3 November 2026See in Sources}. Holding either certificate still sets a business apart.

Which one should you choose?

• Start with Cyber Essentials if you hold customer data, want the included insurance, or bid for public sector work. For most small businesses in Northern Ireland it is the right first certificate.
• Go to Plus when a contract or customer names it, when you supply defence or regulated supply chains, or when you want an independent test rather than your own declaration. Plus also catches the gap between what the IT provider says is in place and what is actually running on the PCs.
• Don't choose Plus to look better if the basics are shaky: a failed Plus audit now puts the Cyber Essentials certificate at risk too ^{12Source 12Cyber Essentials Plus v3.3: the audit changes UK buyers should know — Forensic Control, 5 May 2026 (certification body).forensiccontrol.com/news/cyber-essentials-plus-v3-3-the-audit-changes-uk-buyers/Accessed 3 November 2026See in Sources}. Certify, fix, then audit.

How does BTNI help?

At BTNI, Cyber Essentials readiness is part of TechState™ Assured and Cyber Essentials Plus readiness part of TechState™ Verified, through our Cybersecurity service: the five controls are managed as standard, so certification reflects how the business is actually run. If you're a law or accountancy firm, our guide to Cyber Essentials for professional firms covers the client and insurer angle. For an estimate of what the right level would cost, use Find Your TechState™.