Cyber Essentials vs Cyber Essentials Plus

What is the difference in one table?

Which should you choose?

What does Cyber Essentials actually check?

Cyber Essentials is a declaration. You answer the 2026 Danzell question set, which runs from organisation details (A1) and scope (A2) through insurance eligibility (A3) and the five technical controls: firewalls (A4), secure configuration (A5), security update management (A6), user access control (A7) and malware protection (A8). An assessor at a Certification Body reads the answers, checks that the notes fields describe compliant processes and either passes the submission or sends it back for clarification.

Nobody logs into your systems. The strength of the certificate rests on the accuracy of your answers, which is why the question set asks for specifics such as operating system versions, browser versions and the process behind each control. Four questions fail automatically on a No answer: A6.4AUTO-FAIL, A6.5AUTO-FAIL, A7.16AUTO-FAIL and A7.17AUTO-FAIL. A7.15AUTO-FAIL fails automatically if a cloud service listed there does offer MFA. Get any of them wrong and the submission fails regardless of everything else.

The NCSC Annual Review 2025 cites a 1.1% fail rate from IASME's review of Cyber Essentials in 2024-25, falling for the fourth year running, and counts 39,790 Cyber Essentials and 12,850 Cyber Essentials Plus certifications awarded. It does not say how many passes came after a resubmission, so treat the fail rate as a scheme-wide outcome rather than evidence that the bar is low.

What does Cyber Essentials Plus add?

Plus takes the same requirements and tests them. The CE Plus Test Specification v3.2 defines five test cases, each with a pass or fail result:

1. A remote vulnerability scan of every public IP address you use, including IaaS, on a recommended port set.
2. An authenticated vulnerability scan of sampled end user devices, servers and IaaS instances. Any vulnerability rated critical or high risk, scoring CVSS v3 7.0 or above, or with no vendor severity, with a fix available for more than 14 days, is a fail.
3. Malware protection tests: test files sent by email and downloaded through the browser, or manual log checks, or allow-listing checks for devices that use certificate-based application control.
4. Multi-factor authentication observed on every cloud authentication service, for a user and an administrator, from an untrusted device or incognito session.
5. Account separation: a standard user attempts an administrative process and must be prompted for separate credentials.

Which one do you need?

Start from the reason you are certifying. Question A1.10 asks for it directly, and the answer usually settles the level.

If a contract clause says "Cyber Essentials" with no level, the self-assessment satisfies it. If the clause names Plus, or the buyer handles sensitive personal data, defence information or provides access to their own systems, they will normally specify Plus and may also specify whole-organisation scope.

If nobody is asking yet, the self-assessment is the right first step. It forces an inventory, surfaces unsupported software and MFA gaps, and can be upgraded to Plus later in the same year provided the audit falls within 3 months of your Cyber Essentials certification.

If you want to demonstrate the controls rather than declare them, choose Plus. The audit checks real devices and real sign-ins, so a buyer reading the certificate knows the controls were seen working.

How do the costs compare?

The scheme fee is fixed by IASME and depends on headcount: £320 for 0 to 9 staff, £440 for 10 to 49, £500 for 50 to 249 and £600 for 250 or more, all ex VAT and unchanged in 2026. That is the whole cost of a self-assessment if you complete it without help.

With Precursor, Cyber Essentials is from £1,500 + VAT with the IASME fee included, and Cyber Essentials Plus is from £3,000 + VAT with Cyber Essentials and the IASME fee included, a free re-test within 90 days at every tier and a gap analysis included in the 50 to 250 device tier. Plus pricing rises with device count because the test specification samples by device and the audit takes longer on a varied estate.

Can you fail Plus after passing Cyber Essentials?

Yes, and it is a common surprise. The self-assessment is marked on what you describe; the audit is marked on what the scanner and the assessor find. A device that was patched "within 14 days" in the answer but has a critical update missing for 20 days fails test 2. A cloud service that prompts for MFA on the desktop but not in an incognito session fails test 4.

Since the April 2026 changes, a failed update management test (test 2) is retested on the original devices plus a new random sample, so updating only the sampled devices no longer works. Jisc's summary of the IASME guidance says that if the second sample shows the same vulnerabilities as the first, the Plus assessment fails and the Cyber Essentials certificate is revoked as well. Patch the whole estate before the audit, not just the sample. See pass and fail rules.

Does the Plus scope have to match the self-assessment?

Yes. The CE Plus Test Specification v3.2 has the assessor confirm, before any testing, that the Plus scope matches the scope described by the valid Cyber Essentials self-assessment certificate. If you change the scope, add a site or migrate a cloud service between the two, tell the Certification Body before the audit day so the sample and the report line up. Before the audit lists what the assessor verifies first.