What comes after Cyber Essentials?

Cyber Essentials is the baseline. Once you have it, customers, tenders or insurers may ask for more. Here's what each next step is, who needs it, and how we can help you find a provider.

Cyber Essentials Plus

The same five controls as Cyber Essentials, plus a hands-on technical audit of your devices and accounts by an assessor. It's often needed for higher-risk public sector, NHS and defence work. The audit must happen within three months of passing Cyber Essentials.

Read Cyber Essentials Plus explained.

Get matched for Plus

IASME Cyber Assurance

A step up from Cyber Essentials that covers how you run security across the business, not just your devices, and includes data protection (UK GDPR) requirements. It's designed for small and medium-sized businesses, especially those in supply chains.

• You need an up-to-date Cyber Essentials certificate first.
• Level One is a verified self-assessment, reviewed by an independent assessor and renewed every year. The number of requirements is scaled to your size.
• Level Two adds an on-site or remote audit once you've passed Level One, on a three-year cycle.
• Some sectors accept the audited level as an alternative to ISO 27001 for small companies, and it costs far less.

Ask about Cyber Assurance

Penetration testing

A penetration test (pen test) is when security specialists try to break into your systems, website or apps the way a real attacker would, then give you a report of what they found and how to fix it.

• It goes much deeper than the Cyber Essentials Plus audit, which checks a fixed set of basic controls.
• It's often asked for by larger customers, in tenders, by insurers, or if you build software or run an online service that handles customer data.
• Look for testers accredited by CREST or the NCSC's CHECK scheme, especially for public sector work.

Ask about a pen test

ISO 27001

The international standard for managing information security. It covers policies, risk management, suppliers, people and more, and it's audited every year. It's bigger and more expensive than Cyber Essentials, and usually needed when larger or international customers ask for it.

Read Cyber Essentials vs ISO 27001.

Ask about ISO 27001

Sector schemes

• NHS suppliers: the Data Security and Protection Toolkit (DSPT), a yearly self-assessment due by 30 June. See our NHS guide.
• Defence suppliers: Defence Cyber Certification, which the MOD wants all suppliers to reach at Level 0 by 31 December 2026. See our defence guide.

Ask about DSPT or Defence Cyber Certification

IT support to get you there (and keep you there)

Plenty of small businesses struggle with Cyber Essentials simply because nobody looks after their IT. A good IT support provider can set up updates, multi-factor login and device management for you, and keep you compliant all year. Ask any provider whether they hold Cyber Essentials Plus themselves. See what to expect from an IT provider.

Find IT support

Staff security training

Most attacks start with a person: a phishing email clicked, or a password reused. Short, regular training makes a real difference, and many insurers and customers ask whether you do it. The NCSC's free Top Tips for Staff course is a good start. Paid platforms add phishing simulations and tracking.

Ask about staff training