Cyber Essentials vs Cyber Essentials Plus

If a customer, supplier or tender has asked whether you hold Cyber Essentials, the next question is usually which level you need: Cyber Essentials or Cyber Essentials Plus. Both are part of the UK Government-backed scheme run by the National Cyber Security Centre (NCSC) and delivered by IASME. They cover exactly the same security controls, and what changes is how those controls are checked.

Cyber Essentials is not a legal requirement, but it is required for many central government contracts and increasingly asked for by customers, insurers and supply chains. This guide explains the two levels, the 2026 rule changes that catch businesses out, and how to choose.

The five controls both levels cover

Every Cyber Essentials certification, basic or Plus, is built on the same five technical controls:

Firewalls: protecting your internet connection so only the services you need are reachable, from the office router to the firewall on each device.
Secure configuration: removing default passwords, switching off accounts and software you do not use, and making sure devices lock properly.
Security update management: keeping operating systems, applications and router or firewall firmware patched. Software that no longer receives updates is not allowed.
User access control: giving people only the access they need, keeping administrator accounts for admin tasks, and protecting logins properly.
Malware protection: stopping malicious software from running on your devices. Our guide to what malware is and how it could affect your business explains the threat in more detail.

Cyber Essentials: a verified self-assessment

At the basic level, you complete an online questionnaire describing how your business meets each control. It asks about the devices you use, how your router is set up, how quickly updates go on, who has admin access and which cloud services you rely on.

A qualified assessor reviews your answers and, if they meet the standard, you are certified for 12 months. For many small businesses it is all a customer or contract asks for. The catch is that it relies on your answers being accurate, so it is worth having someone check your setup before you submit.

Cyber Essentials Plus: independently tested

Cyber Essentials Plus uses the same controls, but an assessor tests them for real. You need to hold the basic certification first, and the Plus audit has to be completed within three months of it.

The exact process depends on your assessor, but you can expect:

A vulnerability scan of your internet-facing systems, such as your router
Hands-on checks of a sample of your devices, confirming updates are installed and nothing unsupported is running
Tests that your malware protection blocks malicious files, such as email attachments or downloads
Checks that accounts and cloud services match your questionnaire, with MFA switched on

Because the controls are tested rather than described, Plus gives customers and insurers a higher level of assurance. If something fails, it needs fixing before you can be certified, and the three-month window keeps running.

What changed in 2026

Assessments started from late April 2026 use version 3.3 of the requirements, with an updated question set known as Danzell. Three changes catch businesses out most often:

MFA on every cloud service that offers it. This includes Microsoft 365 and other online tools, even where MFA is a paid extra. If a service offers MFA and it is not switched on, that is an automatic fail.
14-day patching. Critical and high-risk security updates must be installed within 14 days of release, for operating systems, applications and router or firewall firmware.
Cloud services are always in scope. You cannot exclude them, so every online service holding business data needs to meet the controls.

Multi-factor authentication (MFA) means signing in with something extra as well as your password, usually a code or an approval prompt on your phone. Even if a password is stolen in a phishing email, an attacker cannot get in without that second step.

Cyber Essentials or Cyber Essentials Plus: which should you choose?

Choose Cyber Essentials if a customer or contract simply asks for it, or you want a solid baseline with the least effort.
Choose Cyber Essentials Plus if a contract specifies it, you handle sensitive data, or you want customers to see that your security has been independently tested.

Many businesses start with Cyber Essentials and move to Plus once their setup is in good shape. Either way, the work is the same: get the five controls right first.

What it looks like in practice

Imagine a hypothetical ten-person office that has been asked by a new client to hold Cyber Essentials Plus before work starts. It has three months from its basic certificate to pass the audit.

In an office like this, the usual gaps are an old laptop that can no longer be updated, a shared administrator login and a file-sharing tool without MFA. Fixing those before submitting means the questionnaire answers are true and the Plus tests hold no surprises.

How to prepare for Cyber Essentials certification

Confirm the level you need from the exact wording in the contract, tender or insurance form.
List everything in scope: every computer, laptop, tablet, phone, server, router and cloud service used for business data.
Remove or replace unsupported software. Anything that no longer receives security updates will fail.
Switch on automatic updates and check that router and firewall firmware is current.
Turn on MFA for Microsoft 365 and every other cloud service that offers it.
Tidy up accounts. Remove old users, change default passwords and keep admin accounts for admin tasks only.
Check malware protection is installed, up to date and active on every device, then have someone review your answers before you submit.

Common mistakes to avoid

Forgetting cloud services. Email, file-sharing and accounting tools all count, and they need MFA if they offer it.
Describing how things should be, not how they are. At Plus level, the tests will show the difference.
Treating certification as a one-off. Your setup changes all year, and you must recertify every 12 months.

Questions to ask before you start

Which level does our contract or customer actually require?
Which devices, accounts and cloud services fall within our scope?
Who will fix the gaps the assessment finds, and how long will that take?
How will we stay compliant until next year's recertification?

How we help

Our Cyber Essentials service helps businesses across Stoke-on-Trent and Staffordshire prepare for both levels. We review your current setup, fix the gaps and guide you through certification, whether that means firewall and router settings, business anti-virus or switching on MFA in Microsoft 365.

Staying compliant is an all-year job. With managed IT support and active monitoring, we keep updates, accounts and protection in line with the controls, so next year's recertification is not a scramble.

Frequently asked questions

How long does Cyber Essentials certification last?

Cyber Essentials and Cyber Essentials Plus certificates are both valid for 12 months. To stay certified, you need to recertify every year, and the requirements may have changed in the meantime. For example, assessments from late April 2026 use version 3.3, which requires MFA on every cloud service that offers it and critical updates within 14 days.

Is Cyber Essentials a legal requirement?

No, Cyber Essentials is not a legal requirement for UK businesses. However, it is required for many central government contracts, and it is increasingly asked for by customers, insurers and larger organisations checking the security of their supply chains. For many small businesses, holding a certificate is becoming a practical requirement for winning and keeping work.

Can we go straight to Cyber Essentials Plus?

No. You need to hold the basic Cyber Essentials certification first, because Plus tests the same controls you described in your self-assessment. The Plus audit then has to be completed within three months of your basic certification, so most businesses plan the two together and fix any gaps before submitting the questionnaire.

What is the difference between Cyber Essentials and Cyber Essentials Plus?

Both levels cover the same five controls: firewalls, secure configuration, security update management, user access control and malware protection. Cyber Essentials is a self-assessment questionnaire verified by an assessor. Cyber Essentials Plus adds independent technical testing, including vulnerability scans and hands-on checks of a sample of your devices, so it gives customers stronger assurance.

What causes an automatic fail under the 2026 rules?

Under requirements version 3.3, used for assessments from late April 2026, not enabling multi-factor authentication on a cloud service that offers it is an automatic fail, even if MFA is a paid extra. Unsupported software is also not allowed, and critical or high-risk security updates must be installed within 14 days of release.

Not sure which level you need? Get in touch with our Stoke-on-Trent team and we will talk you through it.

Cyber Essentials vs Cyber Essentials Plus: Which Does Your Business Need?