Cyber Essentials vs Cyber Essentials Plus: What’s the Difference?
Cyber Essentials and Cyber Essentials Plus are UK Government-backed cyber security certifications that help organisations protect against common attacks. The key difference is simple: Cyber Essentials is self-assessed, while Cyber Essentials Plus includes independent technical testing.
What is Cyber Essentials?
Cyber Essentials is the entry-level certification. You complete a questionnaire confirming your organisation meets the required controls, and an accredited certification body reviews your submission. It’s designed to prove you have the right cyber hygiene basics in place.
- Assessment type: Self-assessment questionnaire
- Focus: Baseline technical controls and good practice
- Best for: First-time certification, basic contract requirements, SMEs wanting a starting point
What is Cyber Essentials Plus?
Cyber Essentials Plus includes the same requirements as Cyber Essentials, but adds hands-on technical verification. An independent assessor performs checks on live systems (remotely or on-site) to confirm the controls are working in practice.
- Assessment type: Questionnaire + independent technical audit
- Testing: Validation of devices, settings, patching and protections
- Best for: Higher assurance needs, supply-chain requirements, sensitive data, public sector expectations
Cyber Essentials vs Cyber Essentials Plus (Quick Comparison)
| Feature | Cyber Essentials | Cyber Essentials Plus |
|---|---|---|
| How it’s assessed | Self-assessment questionnaire | Questionnaire + technical audit |
| Independent testing | No | Yes (live systems) |
| Assurance level | Baseline | Higher |
| Typical use | Entry-level compliance | Stronger customer/supply-chain confidence |
| Cost & effort | Lower | Higher (audit + evidence) |
| Certification fee (IASME, 2026, ex VAT) | £320 (0 to 9 staff), £440 (10 to 49), £500 (50 to 249), £600 (250+) | Quoted individually, based on devices, sites and cloud services in scope |
| Typical timescale | A few days to a couple of weeks if well prepared | Audit takes one or two days; must be completed within three months of achieving Cyber Essentials |
| Valid for | 12 months | 12 months |
Rule of thumb: If you need to prove controls are working (not just state they exist), choose Cyber Essentials Plus.
Which one should you choose?
Many organisations start with Cyber Essentials and move to Plus when they want greater assurance for customers, insurers, or supply-chain requirements. The right choice depends on your risk level, the sensitivity of data you handle, and what your contracts ask for.
What changed in April 2026?
The Cyber Essentials requirements are stricter from April 2026, including tighter rules on multi-factor authentication (MFA) and 14-day patching. Read the full guide: What changed in Cyber Essentials from April 2026?
How much does Cyber Essentials cost, and how long does it take?
IASME’s 2026 certification fee is £320 + VAT for 0 to 9 staff, £440 for 10 to 49, £500 for 50 to 249 and £600 for 250+. Cyber Essentials Plus is quoted individually. Cyber Essentials usually takes a few days to a couple of weeks if you are well prepared; the Plus audit takes one or two days and must be completed within three months of achieving Cyber Essentials. See also how much Cyber Essentials costs and how long it takes.
How ABCOM helps
ABCOM is an NCSC Assured Service Provider (Cyber Advisor, Cyber Essentials). We check you against the latest requirements, fix any gaps and guide you through assessment. ABCOM Core Secure includes Cyber Essentials-aligned controls, vulnerability monitoring and monthly security reporting.
Frequently asked questions
How much does Cyber Essentials cost?
IASME’s 2026 certification fee is £320 + VAT for 0 to 9 staff, £440 for 10 to 49, £500 for 50 to 249 and £600 for 250+. Cyber Essentials Plus is quoted individually. ABCOM passes the certification fee on at cost and quotes readiness work separately.
How long does certification take?
Cyber Essentials usually takes a few days to a couple of weeks for a well-prepared small organisation. The Plus audit takes one or two days and must be completed within three months of achieving Cyber Essentials.
What changed in Cyber Essentials from April 2026?
The requirements are stricter, including tighter rules on multi-factor authentication (MFA) and 14-day patching.
Can I move from Cyber Essentials to Cyber Essentials Plus?
Yes. Many organisations start with Cyber Essentials and then add Plus. The Plus audit must be completed within three months of achieving Cyber Essentials, so it helps to plan it in advance.
Which is better, Cyber Essentials or Cyber Essentials Plus?
Plus gives higher assurance but costs more and takes more effort. Choose it if customers, insurers or contracts need proof that your controls work. Otherwise Cyber Essentials is a sound starting point.
Do you cover my area?
We support businesses in Burgess Hill, Haywards Heath, Brighton & Hove, Crawley, Horsham, Worthing, Lewes, Eastbourne and London, with remote support across the UK.
Last updated: 17 October 2026. Written by Yann Davies, Managing Director, ABCOM, Burgess Hill since 1996.
Need help with Cyber Essentials or Cyber Essentials Plus?
ABCOM can guide you from readiness and remediation through to certification, with clear advice and minimal disruption.
Related pages
Want this looked after for you?
ABCOM has supported Sussex businesses and charities since 1996 and is an NCSC Assured Service Provider – Cyber Advisor (Cyber Essentials). Talk to a real person about your IT.
Also read
How ABCOM can help
Talk to a real person at our Burgess Hill office. We are an NCSC Assured Service Provider and have supported Sussex businesses since 1996.