Cyber Essentials vs Cyber Essentials Plus

Both options focus on the Cyber Essentials technical controls. The key difference is how those controls are verified. Choose the route that fits the assurance requirement you need to meet.

PUBLISHED 22 OCTOBER 2026 / CYBERXPERT WEBSITE RESOURCE

Start with the requirement

Before choosing a certification route, ask the customer, tender owner or insurer what evidence they require. Some requirements name Cyber Essentials; others specify Plus or a particular scope. Confirm the exact wording and deadline rather than assuming that either certificate will satisfy it.

What Cyber Essentials establishes

Cyber Essentials addresses five areas of technical protection: firewalls, secure configuration, security update management, user access control and malware protection. The assessment uses a verified self-assessment approach. Your answers need to reflect the actual in-scope environment, including relevant cloud services and devices.

What Plus adds

Cyber Essentials Plus adds hands-on technical verification of the controls. Preparation therefore needs to cover what devices and users actually do, alongside the questionnaire. A policy that says a control exists is different from evidence that it operates consistently. Check the current scheme guidance and certification-body process before booking.

Scope is a business decision

An accurate scope establishes what the assessment covers and what it does not. Identify the organisation or part of it being certified, its systems, devices, people and relevant services. Be cautious about excluding difficult systems without understanding whether the resulting scope meets the buyer’s requirement.

Prepare the estate, not just the answers

Create an inventory of supported devices and software. Review access permissions, administrator accounts, update arrangements and malware protection. Assign owners to gaps and keep a record of remediation. Cloud services and remote working need attention alongside office infrastructure.

Separate consultancy from certification

Readiness consultancy can help define scope, identify gaps and implement improvements. An authorised certification body assesses the application and makes the certification decision. CyberXpert offers readiness and remediation support and does not claim to issue independent certificates.

Questions to ask before committing

What scope does the buyer require? Which route is specified? What evidence and technical checks will the certification body need? Are consultancy and certification fees separate? Which gaps need fixing first? Use the answers to plan the work and allow time for remediation.

Keep the controls working

Certification does not remove the need to maintain controls. New devices, changes in cloud services and unsupported software can alter the position. Give the controls an owner and review the current requirements when planning renewal.