Skip to content
Made in the UK

Cyber Essentials

What is the difference between Cyber Essentials and Cyber Essentials Plus?

By , CEO, CybaVerse. Last reviewed

Cyber Essentials and Cyber Essentials Plus cover the same five technical controls. Cyber Essentials is a self-assessment questionnaire checked by a certification body. Cyber Essentials Plus adds hands-on technical testing, including vulnerability scans and checks on sampled devices, and must be completed within three months of Cyber Essentials certification.

This page is part of our Cyber Essentials guide.

What do both levels have in common?

Both levels are part of the UK government-backed Cyber Essentials scheme, run by the NCSC with IASME as the delivery partner. They cover the same five technical controls: firewalls, secure configuration, security update management, user access control and malware protection, as set out in the requirements document.

Both are also annual. A certificate shows the controls were in place when assessed, not that they stay in place all year. That is why MSPs increasingly treat certification as part of an ongoing service rather than a yearly exam.

How do the two levels differ?

The main difference is how the controls are checked. Cyber Essentials relies on answers to a questionnaire, verified by a certification body. Cyber Essentials Plus has an assessor test the controls directly on a sample of devices and services, so mistakes that a questionnaire might miss are found during the assessment.

Cyber EssentialsCyber Essentials Plus
MethodSelf-assessment questionnaireQuestionnaire plus technical testing
Checked byCertification body reviews answersAssessor tests sampled devices
Vulnerability scanningNoYes, external and authenticated
Malware and MFA checksDeclaredTested
TimingAny timeWithin three months of Cyber Essentials
One failed testNot applicableFails the assessment

What does Cyber Essentials Plus test?

The test specification defines the test cases: a remote vulnerability assessment of internet-facing systems, a check of software updates through authenticated vulnerability scans, malware protection tests, multi-factor authentication configuration and account separation. Any single failed test case means the whole assessment fails, which is why preparation matters.

Which level does a client need?

The right level depends on what the client's customers, contracts and insurers ask for. Many organisations start with Cyber Essentials and move to Plus when a contract or supply chain requires it. The steps below help MSPs decide with each client and plan certification ahead of the deadline.

  1. Step 1: Check contract requirements

    Ask which level customers, contracts or insurers require.

  2. Step 2: Agree the scope

    Decide which devices, users and cloud services are in scope.

  3. Step 3: Close the gaps

    Fix unsupported software, missing updates and MFA gaps.

  4. Step 4: Certify Cyber Essentials

    Complete the questionnaire with a certification body.

  5. Step 5: Book Cyber Essentials Plus testing

    Book testing within three months, after a full scan and fix cycle.

How does CybaVerse help?

CybaVerse delivers Cyber Essentials and Cyber Essentials Plus certification through MSPs as a service, and CybaOps vulnerability scanning helps clients find and fix failures before testing. We hold both certifications ourselves, so we know first hand what the assessment involves for an organisation.

  • CybaVerse delivers Cyber Essentials and Cyber Essentials Plus certification, run through the CybaOps platform.
  • Cyber Essentials Plus works best as part of an ongoing security service, not a once-a-year exam.
  • CybaOps vulnerability scanning helps you find and fix CE+ failures before the assessment.
  • CybaVerse holds Cyber Essentials and Cyber Essentials Plus itself.

CE vs CE+

Cyber Essentials vs Cyber Essentials Plus

Cyber Essentials and Cyber Essentials Plus cover the same five technical controls.

01 Readiness checks

Multi-tenantPartner / MSP CustomerCustomerCustomer+
CybaOps by CybaVerse

CE vs CE+

02 The 5-step path

  • Role-based access
  • UK-based analysts
  • ISO 27001

03 Outcomes

Explore

Hover or tap any part of the diagram to see what it does.

  • Delivered with
  • Cyber Essentials & CE+
  • CybaVM

What else do MSPs ask about the two levels?

These are the follow-up questions we hear most from MSPs and their clients.

Can a client go straight to Cyber Essentials Plus?

No. A client needs Cyber Essentials first, and the Cyber Essentials Plus assessment must be completed within three months of that certification. Plan both together so the testing window is not missed.

Is Cyber Essentials Plus much harder?

It is stricter, because controls are tested rather than declared. Clients that keep devices patched, remove unsupported software and enforce MFA usually pass. The common failures are predictable and fixable with preparation.

How long does each certificate last?

A certificate is generally treated as current for 12 months, and most contracts expect yearly renewal. Treating the controls as an ongoing service makes each renewal far easier.

What should you do next?

See how CybaVerse delivers Cyber Essentials Plus on the CybaOps platform page. MSPs can read about the CybaVerse partner model for MSPs.

Related: Why do clients fail Cyber Essentials Plus on software updates? and How do you stay Cyber Essentials compliant all year?

See how CE+ preparation works.

Book a CybaOps demo