Cyber Essentials or Cyber Essentials Plus: Who Needs Which?

Cyber Essentials and Cyber Essentials Plus: the difference

Both levels check the same five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. What differs is how they are checked.

Cyber Essentials is a verified self-assessment. You answer an online question set, a board member or equivalent signs it off, and an assessor marks it. IASME, the NCSC's delivery partner, prices it by staff numbers, starting at £320 plus VAT. Our Cyber Essentials cost guide covers the full picture.

Cyber Essentials Plus adds a technical audit. An assessor tests your systems to confirm the controls work in practice. The NCSC says it is quoted, because the price depends on the size and complexity of your network.

A few practical rules:

• Cyber Essentials comes first. IASME says it is a prerequisite to Plus.
• Timing matters. IASME's guide to certifying to Plus says the audit must be completed within 3 months of your most recent Cyber Essentials certification.
• Both certificates expire after 12 months, so Plus means a fresh audit every year.
• Audits can run remotely or in person.

Version 3.3 of the requirements has applied since 27 April 2026. It says authentication to cloud services must always use MFA. Our guide to Cyber Essentials requirements walks through them.

What the Cyber Essentials Plus audit tests

The NCSC's Cyber Essentials Plus Test Specification, version 3.2, sets out five tests. IASME builds the detailed tests its certification bodies use from it.

1. Remote vulnerability scan. The assessor scans every internet IP address you use for weaknesses a low-skilled attacker could exploit.
2. Patching check. An authenticated scan of sampled devices. A critical or high-risk flaw is a fail if the vendor's fix has been out for more than 14 days.
3. Malware protection. The assessor emails test files to sampled users and has them download others in a browser. Malware samples must be blocked, and test programs must at least trigger a warning.
4. Multi-factor authentication. Users and administrators sign in to your cloud services from an incognito browser or untrusted device. The test passes only if MFA is requested. Services that share one sign-in system are tested once.
5. Account separation. A standard user tries to run an administrative task. The device must ask for a separate administrator login.

Sampling. IASME says assessors test a random sample, typically around 10 per cent, then decide whether more testing is needed. Each cloud service is tested with at least one normal user and one administrator.

Pass mark. Under the specification, any single failed test fails the whole audit. IASME gives you 30 days to fix any non-compliance found, but you cannot pass until it is fixed.

This is what a questionnaire cannot show: one laptop with an unpatched browser, or one admin account without MFA.

Who asks for which: the summary table

Most certificates are not forced by a rule. In government data for July 2025 to June 2026, about 40% of Cyber Essentials certificates were sought "to give confidence to our Customers". About 24% were for a contract. Of 46,245 certificates issued, 15,185 also came with Plus, about one in three.

What the rules say, sector by sector

Central government contracts

PPN 014 covers central government departments, their executive agencies and non-departmental public bodies, and NHS bodies. It applies to procurements started on or after 24 February 2025.

It does not cover every contract, and buyers "must not take a blanket approach". It applies where a supplier handles citizens' or government staff's personal data, supplies ICT for OFFICIAL data, or handles government business information.

You must show Cyber Essentials or Plus, or equivalent controls, before award. The certificate must be renewed every year of the contract. The note says Plus "should be used when there is a higher risk".

Ministry of Defence suppliers

MoD contracts covered by DEFCON 658 are risk assessed and given a Cyber Risk Profile from Level 0 to Level 3. DEF STAN 05-138 Issue 4 requires Cyber Essentials at every level and Plus at Levels 2 and 3. The levels carry 3, 101, 139 and 144 controls.

Defence Cyber Certification (DCC) certifies a supplier against these levels. The MoD has asked all industry partners to reach DCC Level 0 by 31 December 2026. Your own contract sets what is required. Our DCC guide covers the detail.

NHS, health and care suppliers

NHS bodies follow PPN 014, so either level can be asked for on higher-risk contracts.

The Data Security and Protection Toolkit is required for organisations with access to NHS patient information. It says Plus is not mandatory, but holding it exempts some questions. Outside NHS trusts and similar bodies, Standards Met plus a current Plus certificate recorded in your profile displays as Standards Exceeded. For IT suppliers, Plus also narrows the required DSPT audit.

The DTAC form, updated in February 2026, assesses digital health products. It says the manufacturer "must have a valid Cyber Essentials certificate" to pass.

Local government and the wider public sector

PPN 014 says other public bodies "may wish to apply" its approach, so councils decide tender by tender. In Scotland, government guidance says the need for certification "should be judged on a case-by-case-basis".

Schools, colleges and education suppliers

Colleges and special post-16 institutions in England must hold Cyber Essentials. The DfE made this a requirement from the 2024 to 2025 funding year.

Schools are not required to certify. The DfE's cyber security standards suggest schools ask outsourced IT support whether they hold Cyber Essentials or Plus. So an education supplier may meet it as a due diligence question.

Legal, accountancy and financial services

Criminal legal aid firms must hold Cyber Essentials as a minimum under the Standard Crime Contract 2025. They must show the certificate to their contract manager on request. The LAA's data security requirements for these contracts also recommend Plus.

We found no SRA, ICAEW or FCA rule requiring certification for other firms. ICAEW Insights quotes an accountancy firm whose clients "will not engage with us unless we have an active Cyber Essentials Plus certification". The government says leading UK banks use Cyber Essentials in their supply chains.

Construction and facilities

Build UK's Common Assessment Standard is the construction industry's agreed prequalification question set. It says central government and wider public sector bodies should use it.

In Version 5, question 161 asks whether you hold Plus or ISO 27001. A yes means you skip questions 163 to 169, which cover your cyber security policy and data protection. Basic Cyber Essentials does not earn that shortcut. Question 161 is advisory, so Plus is not needed to pass.

Build UK says Version 6 will be published on 1 November 2026, so check these question numbers then.

Insurance

Insurance is rarely the trigger. Only about 2% of Cyber Essentials certificates in the year to June 2026 were sought because an insurer required it. The NCSC says some insurers offer discounts to certified organisations.

The scheme includes free cover. A UK organisation with turnover under £20m that certifies the whole organisation gets cyber liability insurance arranged by IASME. It includes a 24-hour helpline and incident response up to a £25,000 limit.

Charities

Certification is optional. The Charity Commission suggests Cyber Essentials for medium and large charities, and says all trustees remain responsible for protecting the charity. A charity can still face a requirement through a public contract or a funder. Across all sectors, 185 certificates in the year to June 2026 were sought for a grant. The NCSC's Funded Cyber Essentials Programme, which offered free Plus to small organisations in high-risk sectors, has closed.

Large private-sector supply chains

In October 2025, ministers asked leading UK businesses, including all FTSE 350 companies, to embed Cyber Essentials requirements across their supply chains. The Cyber Resilience Pledge that followed is voluntary. It asks signatories to take a risk-based approach to requiring Cyber Essentials from suppliers.

Private customers already rival government as a reason to certify. Commercial contracts were the reason for 5,736 certificates in the year to June 2026, against 5,291 for government contracts.

How to decide between Cyber Essentials and Plus

1. Read the exact wording. If a tender, contract or customer names Plus, you need Plus. If it says Cyber Essentials, the basic certificate meets it.
2. Defence work. Ask your prime contractor or MoD buyer for the Cyber Risk Profile. Level 2 or 3 means Plus.
3. Sector schemes. In construction prequalification, Version 5 lets Plus or ISO 27001 holders skip several cyber and data protection questions. In health technology, DTAC needs Cyber Essentials, and Plus helps with the DSPT.
4. Nobody is asking yet. Start with Cyber Essentials, the government's recommended minimum. Move to Plus when customers start asking, or when you want proof the controls work.

Before booking Plus, check three things. Are critical and high-risk updates installed within 14 days on every device? Does every cloud account, including admins, use MFA? Does anyone use an admin account for everyday work? Our Microsoft 365 security checklist covers the Microsoft 365 side.

Three illustrative examples

A 12-person IT consultancy bidding for central government work

Take a 12-person IT consultancy bidding to support a department's case management system. The system holds citizens' personal data, so PPN 014 is likely to apply.

If the tender says Cyber Essentials, the basic certificate is enough. If it names Plus, the firm certifies to Cyber Essentials now and completes the Plus audit within 3 months. Either way, it needs the certificate before award and must renew it every year of the contract.

If turnover is under £20m, certifying the whole organisation also brings the free IASME insurance.

A care-sector software supplier

Take a 25-person company selling a care planning app to care homes and NHS community services. DTAC requires a valid Cyber Essentials certificate. Because the app touches patient data, DTAC also asks for DSPT Standards Met.

Plus is optional, but it trims the DSPT work and turns Standards Met into Standards Exceeded. Unless the firm has signed the NHS Cyber Security Charter for Suppliers, DTAC also asks for a recent external penetration test of the app.

A precision engineering subcontractor in a defence supply chain

Take a 40-person machine shop making brackets for a defence prime. The MoD has asked all industry partners for DCC Level 0 by 31 December 2026, and that starts with Cyber Essentials.

Next, the shop asks the prime for the contract's Cyber Risk Profile. At Level 1, basic Cyber Essentials is still enough, as one of 101 controls. At Level 2, Plus becomes mandatory. The MoD has said higher levels lower in the supply chain should be scheduled after 31 December 2026.

Watch the shop floor. Unsupported software must be removed, or isolated in a separate network segment with no internet traffic. One old PC can fail a Plus audit.

How cloud365.io can help

We help businesses prepare for and submit Cyber Essentials and Cyber Essentials Plus. For Plus, we run a pre-audit check and coordinate the assessor. The certification body makes the decision. Our packages, including a Plus audit for firms that already hold Cyber Essentials, are in the Cyber Essentials section.