Cyber Essentials guide

Cyber Essentials or Cyber Essentials Plus?

Both certifications test the same five controls against the same NCSC requirements. The difference is who checks. Cyber Essentials is a self-assessment that an assessor marks; Cyber Essentials Plus adds a technical audit in which an assessor tests your devices and services to see that the controls really work. This guide sets out what each costs, what the Plus audit does, who is asked for which, and how renewal works.

Last checked 9 November 2026 against IASME's Cyber Essentials pages, the NCSC's Cyber Essentials Plus Test Specification v3.2, Procurement Policy Note 014, Defence Standard 05-138 Issue 4 and NHS England's guidance on cyber security for health and care services. This is general information. Tagnator is not part of, approved by or endorsed by the NCSC or IASME.

1. The short answer

QuestionCyber EssentialsCyber Essentials Plus
How it is assessedYou answer the question set; a board member signs; an assessor marks the answersThe same, then an assessor tests sampled devices, every internet gateway, internet-facing servers and every cloud service
Price£320 to £600 plus VAT by size, set by IASME; 75% off a first certificate for SMEs until 31 March 2027Quoted by the certification body on the size and complexity of your network, on top of the basic fee
Who asks for itMost public-sector contracts that handle personal or OFFICIAL data; MOD suppliers at every risk level; many commercial customersMOD contracts at risk levels 2 and 3; some NHS and central government contracts; customers who want tested controls
Lasts12 months12 months, and it needs a current Cyber Essentials certificate first

2. What each costs

Cyber Essentials has fixed prices set by IASME, the NCSC's delivery partner, by number of employees:

OrganisationEmployeesPrice
Micro0 to 9£320 + VAT
Small10 to 49£440 + VAT
Medium50 to 249£500 + VAT
Large250 or more£600 + VAT

On 3 November 2026 the government launched a Cyber Essentials First Step Fund: a 75% discount on a first certificate for small and medium-sized organisations, bringing the fee to between £80 and £125 plus VAT. IASME applies it to a UK micro or SME organisation that has not held Cyber Essentials in the last four years, "subject to eligibility and available funding", for assessments registered and bought by 31 March 2027. A second scheme, the Cyber Resilience Pledge grant, pays the whole fee and provides a Cyber Advisor for selected suppliers referred by large organisations that have signed the pledge.

The fee buys the assessment. If you want help answering, a certification body or an NCSC assured Cyber Advisor charges for its time on top; IASME offers 30 minutes with a Cyber Advisor free.

Cyber Essentials Plus has no list price. IASME says it is "priced according to the size and complexity of your network", and you get a quote from a certification body. The audit takes assessor time, so expect four figures for even a small firm, and more if you have many device types or several sites. You must hold a current Cyber Essentials certificate first, so the basic fee is paid as well.

3. What Cyber Essentials checks

The self-assessment covers the five technical controls in the NCSC's Requirements for IT Infrastructure: firewalls, secure configuration, security update management, user access control and malware protection. The questions are published, you can prepare them in advance, and the assessor marks what you wrote. Five answers fail the assessment on their own: the 14-day update rule for operating systems and firmware and for applications, and MFA on cloud services for all administrators and all users. Our guide to the question set goes through each section.

Nobody connects to your network at this level. The assurance a customer gets is that you have answered honestly and that an assessor found the answers consistent with the requirements. Procurement Policy Note 014 describes it as offering "a basic level of assurance".

4. What the Plus audit tests

Cyber Essentials Plus uses the same requirements and the same scope as your self-assessment, which must be current. Before testing starts the assessor checks that the scope matches the certificate and, where the scope is not the whole organisation, verifies by technical means that the sub-set is properly separated. Testing then follows the NCSC's test specification, currently v3.2 (April 2025), with five test cases:

  1. Remote vulnerability assessment. The assessor identifies every IP address you use, including cloud infrastructure, and scans them from the internet on a set list of ports to see whether "an Internet-based opportunist attacker can hack into the Applicant's system with typical low-skill methods". Each internet-facing service found is passed or failed against a flow chart.
  2. Patching, by authenticated vulnerability scan. An approved scanning tool is run with credentials on a representative sample of user devices, servers and cloud instances. Any missing fix that the vendor calls critical or high risk, that has a CVSS v3 score of 7 or more, or whose severity the vendor did not state, and that has been available for more than 14 days, is a fail.
  3. Malware protection. For devices with anti-malware software, the assessor emails test files to an account you operate and has a user download test files from a website through the browser, to check that they are blocked; for devices protected by application allow-listing, the assessor checks that unapproved applications cannot be installed or run.
  4. Multi-factor authentication. Users of sampled devices log in to every cloud service you declared, with at least one normal user and one administrator per service, to show that MFA is enforced for both.
  5. Account separation. The assessor checks that everyday accounts on the sampled devices do not have administrator rights.

On all but the smallest networks the assessor tests a sample. The sample must be representative of all the devices in scope and its size is calculated by a method set by IASME, with the calculation kept on file. The success rule is strict: "any single Fail means a Fail for the assessment as a whole" unless the specification allows an exception. Advisory notes can be added to any result, so even a pass may come with a list of improvements.

The practical difference from the self-assessment is that Plus finds the laptop that has not updated in three months, the mailbox without MFA and the open port nobody remembered. If those things exist, the audit will not pass until they are fixed.

5. Government contracts: PPN 014

Since 2014 the government has required suppliers bidding for certain contracts to hold Cyber Essentials or Cyber Essentials Plus, or to show equivalent controls. The current rule is Procurement Policy Note 014, updated in February 2025 for the Procurement Act 2023. It applies to all central government departments, their executive agencies and non-departmental public bodies, and NHS bodies.

Those bodies must require suppliers to meet technical requirements for contracts with certain characteristics: where a supplier handles citizens' personal information such as addresses, bank or payment details; where it handles personal information of government employees, ministers and special advisers, such as payroll or travel data; where it supplies ICT systems or services designed to store or process data at the OFFICIAL level; or where the contract deals with information about the day-to-day business of government. For those contracts, "the quickest and most effective means" of mitigating the risk is for the technical requirements to include "either Cyber Essentials or Cyber Essentials Plus certification", renewed annually for the duration of the contract. A supplier without either "must be able to demonstrate equivalent controls are in place through other means", and the certificate is essential "at the point when data is to be passed to the supplier".

The PPN leaves the choice between the two levels to the buying body and warns against a blanket approach: "Not all contracts will require suppliers to be certified", and requirements must be "relevant and proportionate" so as not to deter SMEs. In practice, tenders for routine services ask for Cyber Essentials, and tenders involving sensitive data or systems ask for Plus. G-Cloud suppliers are encouraged to state their certification but are not required to hold it.

6. Ministry of Defence: Def Stan 05-138

Defence contracts use the MOD's Cyber Security Model. The contracting authority assigns each contract a Cyber Risk Profile and the supplier must meet the controls in Defence Standard 05-138, Issue 4 (14 May 2024), which replaced the old profiles of "N/A, Very Low, Low, Moderate and High" with four levels:

Control 0001, Cyber Essentials, applies at all four levels: "The Supplier shall have Cyber Essentials certification that covers the scope required for all aspects of the contract and commit to maintaining this for the duration of the contract." Control 0002, Cyber Essentials Plus, applies at Levels 2 and 3 only. So any MOD supplier needs Cyber Essentials, and Plus becomes a contractual requirement when the risk profile is Advanced or Expert. The standard is applied through the contract condition DEFCON 658 and, where issued, the Security Aspects Letter.

7. NHS: the Data Security and Protection Toolkit

Organisations with access to NHS patient data and systems complete the Data Security and Protection Toolkit (DSPT), NHS England's online self-assessment, every year. NHS England's guidance for suppliers of digital health technologies and for health and care providers says that Cyber Essentials Plus is not required to complete the DSPT, but that "organisations with Cyber Essentials Plus certification do not have to respond to some DSPT questions". NHS bodies are also in scope of PPN 014, so an NHS contract that handles patient data may ask for Cyber Essentials or Plus in its own right, and some NHS buyers specify Plus for suppliers of IT and digital services.

Cyber Essentials does not replace the DSPT, and the DSPT does not replace Cyber Essentials. A supplier to the NHS usually needs both, with Plus reducing the DSPT work.

8. Renewal and timing

Both certificates last 12 months. IASME describes Cyber Essentials as "an annually renewable certification scheme", and PPN 014 requires it to be "renewed annually by the supplier for the duration of the contract". The portal lets you recertify, and your previous answers are kept so you update rather than start again.

Plus needs a current Cyber Essentials certificate with the same scope: the test specification requires the assessor to verify "that the scope of the Cyber Essentials Plus assessment matches the scope described by the valid Cyber Essentials self-assessment certificate". Book the Plus audit soon after the basic certificate is issued so that both run on roughly the same cycle, and so that the question set version the audit uses matches your answers. IASME publishes a new question set and requirements version each spring (Danzell and v3.3 in April 2026), and which version applies depends on when you bought the assessment.

9. Which one you need

Whichever you choose, the work is the same: the five controls in place on every device and cloud service, with the evidence to show it. Our Cyber Essentials Preparation Kit covers the self-assessment: the asset register, a walkthrough of every question number, and the policies and forms behind the processes the questions ask about. It does not prepare you for the Plus audit itself, which only a certification body can run.

Related guides: The Cyber Essentials question set, section by section · Cyber Essentials for small UK businesses

10. Sources