Cyber Essentials or Cyber Essentials Plus: which do you need?

There are two levels of Cyber Essentials, and the choice between them often comes down to who is asking and how much assurance they want. This article sets out how the two differ, using the NCSC’s own descriptions, so you can decide which suits your business.

The short version

The NCSC overview says both levels assess the same five technical controls. Cyber Essentials Plus goes a step further by independently testing your systems to verify that those controls are working in practice.

Its comparison looks like this:

	Cyber Essentials	Cyber Essentials Plus
Same five technical controls	Yes	Yes
Independently verified	Yes	Yes
Technical audit and testing	No	Yes
Higher assurance	Baseline	Yes
Pricing approach	Tiered, from £320 plus VAT	Quoted

The NCSC says Cyber Essentials is priced by the size of your organisation, and Plus by the size and complexity of your network.

How Cyber Essentials works

For the standard level, you answer an online self-assessment about your organisation. A board member or equivalent signs off the answers, and an assessor marks them. The PPN 014 policy note describes this as self-assessment with a questionnaire, verified by an independent certification body, offering a basic level of assurance.

How Cyber Essentials Plus works

Plus adds hands-on testing. The NCSC publishes a Test Specification so that, in its words, applicants should be able to expect the same outcome whichever certification body they use. It describes five test cases:

1. Remote vulnerability assessment. The assessor scans your internet-facing addresses to test whether an opportunist attacker could get in with typical low-skill methods.
2. Patching check. An authenticated vulnerability scan of sampled devices looks for serious flaws whose fixes have been available for more than 14 days.
3. Malware protection check. Tests of defences against malware delivered by email and by browser, with manual checks on sampled devices.
4. Multi-factor authentication check. The assessor observes users signing in to your cloud services and looks for a prompt for MFA before access is granted.
5. Account separation check. The assessor observes a user on a standard account trying to run an administrative process, and looks for a request for an additional login.

On a typical network the assessor tests a representative sample of devices rather than all of them, and checks that the sample is representative.

What needs to be in place first

Before testing begins, the assessor verifies that the scope matches the scope described on your valid Cyber Essentials self-assessment certificate. They also check by technical means that the scope matches the networks and systems being tested, and that any sub-sets are segregated effectively. In practice, you work from a Cyber Essentials self-assessment that has passed first.

How Plus is marked

Every test case must pass for the assessment to pass. The specification says any single fail means a fail for the whole assessment, unless it states a special exception. Assessors can add advisory notes with easy improvements, even on a pass.

How to decide

Ask what your customer wants

The government procurement note says higher risk contracts may require either Cyber Essentials or Cyber Essentials Plus, so read tender wording closely. In the NCSC’s supply chain case study, a large financial firm asked its partner businesses to certify to Plus.

Ask how much assurance you need

If you want evidence that the controls work in practice, rather than only that you have described them correctly, Plus provides it. The NCSC lists higher assurance as a feature of Plus.

Ask how complex your network is

Because Plus is priced by size and complexity, and because the assessor tests samples across your devices and services, a simple setup is easier to test. That reinforces the value of a tidy, well-documented environment.

Consider your timing

You need a valid Cyber Essentials self-assessment certificate whose scope matches before Plus testing starts. If a tender needs Plus by a certain date, work back from there.

Can you start with the standard level?

You can start with the standard level and add Plus later, because Plus testing is checked against a valid self-assessment certificate. The work is cumulative: the controls you put in place for the self-assessment are the same ones the Plus audit tests. The difference is that Plus finds out whether those controls behave as you described.

A word on cost and effort

The NCSC says the standard level starts at £320 plus VAT and varies by organisation size, while Plus is quoted according to the size and complexity of your network. Plus also takes more of your time on the day, because users and administrators need to be available while the assessor watches sign-ins and runs tests, and because you may need to arrange access to the assessor’s test files. The specification notes that the Applicant may need to add the assessor’s test website to an allow list.

Where to get help

The NCSC resources page points to a free Readiness Tool, a free question set booklet and a free 30-minute consultation with an NCSC-assured Cyber Advisor for small and medium-sized businesses. The overview also describes a supported route where a certification body licensed by IASME helps you through the assessment.

In short

Cyber Essentials and Cyber Essentials Plus assess the same five controls. The standard level relies on a verified self-assessment, while Plus adds an independent technical audit with five test cases, and one failure fails the whole assessment. Choose the level your customers ask for, and get the standard level right first.

How Vigil CE helps

Vigil CE helps you get the foundations right for either level, by working through each of the five controls and showing you what a technical test would look for, such as MFA on cloud services and separate administrator accounts. You arrive at your assessment with your settings checked and your records in order.