Cyber Essentials vs Cyber Essentials Plus: Which Do You Need?

Cyber Essentials Plus adds independent hands-on technical testing to the self-assessment questionnaire. An assessor performs external vulnerability scans, checks device configurations, and tests your defences against simulated attacks. This verification confirms that the five controls you declared in your self-assessment are genuinely implemented and working as intended.

Standard Cyber Essentials satisfies most government contract requirements, but certain MOD supply chain and defence-related contracts mandate Plus specifically. Cyber Essentials certified organisations are 92% less likely to claim on cyber insurance (IASME), and insurers increasingly favour Plus for its independent verification when setting premiums and coverage terms.

No. Cyber Essentials Plus requires a valid Cyber Essentials certificate as a prerequisite. You must complete the self-assessment first, then proceed to the independent technical testing within three months. The combined process typically takes two to four weeks when managed by an experienced assessor, compared to one to two weeks for standard alone.

Standard Cyber Essentials costs approximately £300 to £500. Cyber Essentials Plus adds £1,500 to £5,000 depending on business size and complexity, covering the independent assessor's testing time. However, with the average cost of a disruptive breach at £3,550 (DSIT 2025), the additional investment in verified controls typically pays for itself through reduced breach risk.