Cyber Essentials Plus explained
Plus covers the same five controls as basic Cyber Essentials. The difference is that an independent assessor tests your systems, instead of taking your answers on trust.
Basic vs Plus at a glance
| Cyber Essentials | Cyber Essentials Plus | |
|---|---|---|
| How it's checked | Online questionnaire, reviewed by an assessor | Questionnaire plus a hands-on technical audit |
| Vulnerability scans | No | Yes: external and internal |
| Device testing | No | Yes, on a sample of your devices |
| Typical cost (small business) | £320–£500 + VAT | Around £1,500–£3,000 + VAT |
| Valid for | 12 months | 12 months |
What the Plus audit checks
- External scan: every internet-facing address you use (office connection, servers, VPN) is scanned for weaknesses.
- Device sample: the assessor tests a sample of your laptops, desktops and phones, typically around 10% of devices, from a minimum of 1 to a maximum of 30. They check for missing updates and high-risk vulnerabilities.
- Malware protection: checks that it's switched on and actually works.
- Multi-factor login: checks that it's enforced on your cloud services, such as Microsoft 365 or Google Workspace.
Most audits are done remotely, using screen-sharing, and take one to three days of testing.
The three-month rule
You must pass basic Cyber Essentials first. The Plus audit then has to be completed within three months of the date on your basic certificate. If you miss that window, you have to redo the basic certificate before you can go for Plus.
What changed in 2026
Since 27 April 2026 the rules are stricter. If you fail and are retested, the assessor checks your original sample devices plus a new random selection. That stops firms from fixing only the devices that were tested. Read our guide to the April 2026 changes.
Who needs Plus?
Usually it's a customer or contract that asks for it. Plus gives a buyer independent proof that your controls have been tested. It's more common among larger firms and suppliers that handle sensitive information. About a quarter of all certificates issued are at Plus level (15,185 of 61,430 in the year to June 2026). If nobody has asked you for Plus, start with basic Cyber Essentials.
How to prepare
- Get basic Cyber Essentials and book the Plus audit straight away, so the three-month window doesn't run out.
- Update every device, not just a few. The sample is chosen by the assessor.
- Turn on multi-factor login on every cloud account.
- Have someone who looks after your IT available on audit day, so problems can be fixed on the spot.
Ready to get certified?
Tell us about your business and we'll introduce you to accredited certification bodies — free, no obligation.
Get matched