Cyber Essentials vs Cyber Essentials Plus: which do you need?

Cyber Essentials and Cyber Essentials Plus assess the same five technical control areas. The difference is assurance: Cyber Essentials uses a verified self-assessment, while Plus adds independent technical testing.

Start with the requirement, not the product

If a tender, customer or supply-chain agreement explicitly says Cyber Essentials Plus, standard Cyber Essentials is not a substitute. If it asks only for Cyber Essentials, do not assume you need Plus unless there is another business reason for the additional assurance.

When standard Cyber Essentials is usually the starting point

• You need a recognised baseline certification.
• Your contract says Cyber Essentials without specifying Plus.
• You want the lower-cost route and are comfortable completing a verified self-assessment.

When Plus becomes relevant

• Your buyer expressly requires CE+.
• You want independent technical testing of the same controls.
• Your procurement environment places greater value on independently tested assurance.

Cyber Essentials Plus requires a valid Cyber Essentials certificate first. Some providers sell them as a combined package, so compare package scope rather than mechanically adding two headline prices.

Official references: NCSC Cyber Essentials overview and NCSC requirements/resources.