February is the month when many small businesses in Sussex and Kent have already finished their Cyber Essentials self-assessment and are now asking a different question: should they have gone for Cyber Essentials Plus instead? Or, for those preparing their applications, whether the extra audit is worth the investment.

The short answer is that both certifications protect against the same five technical controls. The difference lies in how those controls are verified — and whether your contracts or client requirements demand the higher assurance that only Cyber Essentials Plus provides.

This article compares the two routes side by side, explains the practical implications for owner-managed SMEs, and sets out how to decide which level matches your business needs.

What Both Certifications Assess

Cyber Essentials and Cyber Essentials Plus assess the same five technical controls. Neither is a weaker version of the other — they share identical requirements:

1. Firewalls — properly configured boundary devices that restrict internet-facing access

2. Secure configuration — devices set up to minimise exploitable attack surfaces

3. Security update management — software kept up to date with patches

4. User access control — administered accounts, password policies, privilege management

5. Malware protection — actively defended endpoints

These controls were designed to address the most common internet-based cyber attacks — the techniques that account for the majority of intrusions targeting small businesses. GOV.UK's Cyber Essentials scheme overview confirms that implementing these controls results in 92% fewer insurance claims by organisations that have them in place.

How the Assessment Routes Differ

Both routes are independently verified — you do not simply declare compliance and receive a certificate. The difference is in what the verifier examines.

Cyber Essentials (self-assessment route)

The self-assessment route — formally known as "Cyber Essentials Verified" — requires you to complete a questionnaire on the IASME assessment portal. Your answers are then marked by a qualified Assessor against the five technical controls. A director or senior board member must electronically sign off that your answers are accurate.

Assessors have six months from the date of application to return results. Most return answers within three working days. If you pass, you receive a certificate valid for 12 months. If you do not pass, you receive a report identifying non-compliant answers and have two working days to correct the issues and resubmit at no additional cost.

The small-business fee is £440 + VAT (or £500 + VAT for 20–49 employees), set by IASME.

One point often overlooked: it is possible to pass the Cyber Essentials self-assessment with one or two non-compliant answers. The scheme recognises that a small business may be largely compliant without being perfect.

Cyber Essentials Plus

Cyber Essentials Plus starts with the same Cyber Essentials verified self-assessment questionnaire. But after your questionnaire is completed, it adds a technical audit of your actual IT systems.

An accredited Certification Body carries out independent vulnerability scans against your public-facing IP addresses and tests a representative sample of your devices — typically around 10% of your scoped infrastructure, covering servers, desktops, laptops, and mobile devices. Each type of operating system present in your environment must be represented in that sample.

The audit includes checks for:

• Patch levels on sampled devices (patches for high and critical vulnerabilities must have been applied within 14 days)

• Malware protection configuration and effectiveness

• Account separation — confirming that standard user accounts cannot perform administrator functions

• Multi-factor authentication on all cloud services used by sampled devices

Where non-compliances are found during the technical audit, the organisation has 30 days to remediate. However, Cyber Essentials Plus will not be awarded until all issues are fully resolved — there is no passing with outstanding non-compliances, unlike the standard route.

The audit can be carried out on-site or remotely. Certification Bodies quote individually for this service, as the time and expertise required vary depending on the size and complexity of your network. Multiple quotes are typically obtained to find the best value.

It is also worth noting that Cyber Essentials Plus can only be conducted within three months of your most recent Cyber Essentials certification. If your standard certificate has expired beyond that window, you cannot retroactively upgrade to Plus — you would need to complete a fresh full assessment.

How to Decide Which Route Is Right for Your Business

The decision between Cyber Essentials and Cyber Essentials Plus usually comes down to three questions.

Do your contracts require it?

Cyber Essentials is the minimum standard recommended by the UK Government. Many government contracts — particularly those involving the handling of financial or personal data — require at least basic Cyber Essentials certification. PPN 014, the government's procurement notice, references Cyber Essentials in this context.

Some larger organisations and certain government departments go further, requiring Cyber Essentials Plus from their suppliers. If your existing or prospective clients include organisations in sectors such as defence, critical national infrastructure, or government services, check whether they specifically require CE Plus before you commit to the standard route.

Are you handling sensitive client data?

If your business stores, processes, or transmits sensitive data — financial records, health information, legal documents, or personal data under GDPR — the technical audit component of Cyber Essentials Plus provides a higher level of independent verification that your controls are actually working.

The self-assessment route relies on you answering honestly about your controls. The Plus audit checks that those controls are genuinely in place. For organisations handling sensitive data, that distinction matters.

Are you an IT or technology service provider?

Businesses that provide managed IT services, cloud hosting, or technology consulting typically face stricter supplier requirements from their own clients. Many larger technology procurement frameworks explicitly require Cyber Essentials Plus. If you sell security, infrastructure, or digital services, CE Plus is often the minimum entry point rather than an optional upgrade.

What Do You Gain from the Higher Assurance?

Beyond the certification fees themselves, there are practical considerations that affect both routes.

Preparation time is not trivial

IASME notes that a prepared organisation can complete the self-assessment questionnaire in about an hour. That figure assumes you already know what each question means and have the supporting evidence ready. For a business that has never audited its security posture, the preparation — understanding each question, locating configuration evidence, and testing controls — typically takes considerably longer.

The technical audit for Cyber Essentials Plus requires a full inventory of your scoped devices, clean accounts for the auditor to test, and all devices reachable and configured for remote or on-site testing. Organisations that are unprepared for this tend to delay the audit indefinitely.

Staff time investment

For a 10–25 person business, the self-assessment preparation typically requires between half a day and two full days of one person's time, depending on how far behind the starting point is. The Plus audit requires additional time: coordinating device access, ensuring remote connectivity for the auditor, and potentially making remediation changes between the questionnaire and the technical test.

If you do not have an IT provider managing these controls, that time comes directly from the owner or a senior team member.

Ongoing annual cost

Both certifications require annual renewal. The re-certification fee for the self-assessment route is the same as the initial fee (£440 + VAT for a small business). Cyber Essentials Plus re-certification depends on your Certification Body's current pricing, which may change year to year.

The Certification Process Itself

Both routes are administered through IASME, the NCSC's official delivery partner. IASME maintains a network of licence Certification Bodies — currently over 400 organisations across the UK — that are authorised to assess compliance.

For the self-assessment route, you register directly via the IASME portal. For Cyber Essentials Plus, you contact a Certification Body directly or through IASME to obtain a quote and schedule the technical audit.

After certification, both awards appear on the public certificate search maintained by IASME. This can be useful for demonstrating your status to clients and prospects.

A practical point often missed: if you complete a Cyber Essentials self-assessment and pass, you still have the option to upgrade to Cyber Essentials Plus later — provided you do so within three months of your certification date and arrange a technical audit through a Certification Body. There is no value lost in starting with the standard route if you are uncertain about Plus.

Get Clarity on Your Route

Deciding between Cyber Essentials and Cyber Essentials Plus is not a technical decision — it is a business one. The five controls are the same regardless of which route you choose. What changes is the depth of independent verification, the cost, and the assurance level your clients or contracts may require.

The best starting point is understanding your current position: which controls are already in place, whether any of your contracts or supplier relationships specifically require a higher certification level, and how much time your team can reasonably dedicate to preparation.

A Security Triage Call gives you a clear picture of your current security posture against the five Cyber Essentials controls, and practical guidance on whether the self-assessment or Plus route is the right call for your organisation.

Book a Security Triage Call

Frequently Asked Questions

Can I upgrade from Cyber Essentials to Cyber Essentials Plus later?

Yes. If you pass the Cyber Essentials self-assessment, you can arrange a Cyber Essentials Plus technical audit within three months of your certification date. You need to contact a Certification Body directly to obtain a quote and schedule the audit. If your standard certificate has expired beyond that three-month window, you cannot upgrade retroactively.

Is Cyber Essentials Plus significantly more expensive?

Cyber Essentials Plus is more expensive than the standard self-assessment route because it requires technical experts from a Certification Body to conduct an independent audit of your systems. The exact cost varies depending on the size and complexity of your network. There is no published price table — Certification Bodies quote individually. Most businesses obtain multiple quotes to find competitive pricing.

Do all businesses need Cyber Essentials Plus?

No. Cyber Essentials Plus is a higher assurance level, not a universal requirement. Most SMEs that need certification for general business purposes — supplier questionnaires, basic compliance, insurance requirements — can meet their needs with standard Cyber Essentials. CE Plus is typically needed when specific clients, contracts, or regulatory frameworks require the independent technical verification that only this route provides.

How long does Cyber Essentials Plus take to complete?

The self-assessment questionnaire component takes roughly the same time as the standard route — about an hour for a prepared organisation, though preparation typically takes longer. The technical audit itself usually takes one to two days depending on the size of your scoped environment. You should allow a few weeks total for the entire process, including any remediation needed between the questionnaire and the audit.

Are the five controls the same at both levels?

Yes. Both Cyber Essentials and Cyber Essentials Plus assess compliance against the same five technical controls: firewalls, secure configuration, security update management, user access control, and malware protection. The difference lies entirely in how those controls are verified — self-assessment question marking versus independent technical testing.