Cyber Essentials or Cyber Essentials Plus: which do you need?

"We need Cyber Essentials" is one of the most common things we hear, usually because a customer, a tender or an insurer has asked for it. The next question is often whether that means Cyber Essentials or Cyber Essentials Plus. They share a name and the same five controls, but they prove different things.

What both cover

Cyber Essentials is the UK government-backed scheme, run by IASME on behalf of the National Cyber Security Centre. It checks five technical controls that stop the most common internet-based attacks:

• Firewalls: boundaries between your devices and the internet are properly configured.
• Secure configuration: default passwords changed and unnecessary software and accounts removed.
• Security update management: operating systems, firmware and applications kept up to date.
• User access control: people only have the access they need, with multi-factor authentication where it's available.
• Malware protection: devices are protected against malicious software.

Cyber Essentials: verified self-assessment

For Cyber Essentials, you answer an online questionnaire describing how you meet each control. A director signs a declaration that the answers are accurate, and a licensed certification body marks the submission. If anything falls short, the assessor explains what needs fixing.

It's quick and affordable, and for many organisations it's all that's asked for. Its limitation is that it relies on what you've told the assessor. Nobody tests your systems.

Cyber Essentials Plus: independently tested

Cyber Essentials Plus uses the same controls, but an assessor tests them. Typically, that means:

• vulnerability scans of your internal network and internet-facing systems
• checking a sample of devices for missing updates and secure settings
• testing whether malicious files and email attachments would be blocked
• confirming multi-factor authentication is enforced on cloud services

You must hold Cyber Essentials first, and complete the Plus audit within three months of it. Because Plus confirms the controls actually work, it carries more weight with larger customers and public bodies.

Who asks for which

• Many central government contracts require Cyber Essentials as a minimum, particularly where suppliers handle personal data or provide IT services. Some specify Plus.
• Defence suppliers need Cyber Essentials for every level of Defence Cyber Certification, and Cyber Essentials Plus for Levels 2 and 3.
• Larger companies often include it in supplier questionnaires, and increasingly ask for Plus.
• Insurers may ask about it, and certification can help when arranging cyber cover. Eligible UK organisations with a turnover under £20 million that certify their whole organisation also receive cyber liability insurance with Cyber Essentials.

If you're unsure, ask whoever requested it which one they need and what scope it should cover. It's a quick question that can save a second assessment.

What changed in April 2026

The scheme is updated each year, and the April 2026 update, known as the Danzell question set, made several changes that are catching organisations out at renewal:

• Multi-factor authentication is an automatic fail. If a cloud service offers it, including as a paid option, and you haven't turned it on, the assessment fails.
• Critical updates within 14 days is an automatic fail. High-risk and critical updates to operating systems, firewall and router firmware, and applications must be installed within 14 days of release.
• Cloud services can't be excluded. Any cloud service that stores or processes your organisation's data is in scope.
• Plus testing is stricter. If devices fail, the assessor tests a fresh random sample after you've fixed them, so you can't just patch the devices that were checked. A second failure revokes the Cyber Essentials certificate. Your self-assessment answers are also locked once Plus testing begins.
• The director's declaration covers the whole year. It now commits the organisation to keeping the controls in place throughout the certification period, not just on the day of assessment.

So which do you need?

If a contract or customer specifies one, that answers it. If not:

• Choose Cyber Essentials if you need a recognised baseline quickly and your IT is straightforward.
• Choose Cyber Essentials Plus if you're bidding for larger or public sector work, handling sensitive data, or want independent confirmation that your controls work.

Many organisations start with Cyber Essentials and move to Plus once they're confident their updates and multi-factor authentication are under control.

What if you fail?

It's more common than people think, particularly for Plus and particularly since the 2026 changes. A good assessor will explain exactly why and what will fix it. Preparation is the best way to avoid it, which is why we review your setup before you submit if you choose our Guided option.

How CSIQ can help

CSIQ is a licensed certification body for Cyber Essentials and Cyber Essentials Plus. Our Compliance & Governance page sets out our fixed prices for Cyber Essentials, and our Guided option for organisations that would like help preparing. Get in touch if you'd like to talk through which one you need.