Cyber Essentials and Cyber Essentials Plus cover the same five technical controls. The base level combines a self-assessment with an independent audit. Plus adds independent technical testing to confirm the controls work in practice. Choose by who is asking: a contract that names Plus means Plus, otherwise start with the base level.
What each level involves
Per the NCSC, Cyber Essentials is a self-assessment plus independent audit, with pricing tiered by organisation size and starting at 320 pounds plus VAT. Cyber Essentials Plus covers the same controls and adds independent testing of your systems. Its price depends on the size and complexity of your network.
The NCSC page we read does not list the test methods used in Plus. Ask your Certification Body what they will test and how long it takes.
A decision guide
Choose the base level when:
- this is your first certification,
- a customer asks for "Cyber Essentials" without more detail,
- you want to fix basics before spending on testing.
Choose Plus when:
- a tender or contract names it,
- you handle data where the buyer wants proof, not statements,
- you already hold the base level and want stronger assurance.
Do not choose Plus first just to look serious. If the basics are shaky, testing will find that out at a higher price.
What proof means in practice
The base level relies on your answers, signed off by a board member or equivalent and marked by an assessor. Plus looks at your systems. The difference is between saying a device is patched and showing that a tested device is.
Prepare either way
- Inventory devices, accounts and cloud services in scope.
- Fix obvious gaps first: unsupported software, shared accounts, missing updates.
- Keep a short record of how updates and accounts are managed.
- Read the current requirements from IASME, because the wording changes between versions.
Our five controls checklist covers the preparation questions.
Quick check
Do the two levels cover different controls?
No. The NCSC says Plus covers the same controls and adds independent technical testing.
Should I go straight to Plus?
Only if a buyer requires it. Otherwise get the basics right at the base level first.
Sources
Last reviewed: 19 October 2026.
