Cyber Essentials vs Cyber Essentials Plus: what’s actually different?

Most UK SMEs only need standard Cyber Essentials. Plus matters when a contract, tender, or insurer specifically asks for it.

Same five controls, different way of checking them

Both certifications assess the same five NCSC-defined control areas: firewalls, secure configuration, security update management, user access control, and malware protection. Nothing about what’s being checked changes between the two, only how.

Applications started from 27 April 2026 use Cyber Essentials requirements v3.3 and the Danzell question set. That includes the current multi-factor authentication wording for cloud services. The same version applies before the additional Plus verification work.

Cyber Essentials (standard): You complete a questionnaire about how each control is implemented across your systems. A Certification Body reviews your answers and issues the certificate if they meet the scheme’s requirements. It’s entirely self-reported. Nobody logs into your network to verify it.

Cyber Essentials Plus: Same five controls, but your self-assessment answers get independently verified. An assessor runs an external vulnerability scan against your public IP addresses, tests a representative sample of your actual devices (every operating system type in use has to be included: servers, desktops, laptops, tablets, phones), and observes real users doing everyday tasks on sampled machines to confirm the controls are actually operating as described.

In short: standard Cyber Essentials checks what you say is true. Plus checks whether it’s actually true.

What that difference costs you

The price gap isn’t arbitrary. It reflects real assessor time. A questionnaire review takes hours; scanning your infrastructure and testing a representative device sample takes days, and someone has to actually do it.

Do you need Plus, or is standard enough?

For most UK small businesses, standard Cyber Essentials is the right starting point and often the only requirement that ever comes up. Cyber Essentials Plus tends to matter specifically when:

• A contract, tender, or framework explicitly requires Plus by name (common in central government and NHS-adjacent supply chains)
• An insurer or a larger client’s due-diligence process asks for independently verified controls, not self-reported ones
• You handle sensitive data at a scale where “we said we’re compliant” isn’t a strong enough answer for whoever’s asking

If nobody’s specifically asked you for Plus, you almost certainly don’t need it yet. Since Plus requires a current standard certificate first regardless, getting Cyber Essentials sorted is the right next step either way.

Where BrightCert fits

BrightCert prepares you for standard Cyber Essentials, a free readiness assessment across the same five control areas, with a scored gap report for £99 including VAT using code FOUNDING10 — a £100 founding discount from the standard £199 price, for the first 10 customers — that tells you what to fix before you apply. It’s built for the self-assessment route, not the Plus technical audit, since Plus is inherently something only an accredited assessor can carry out on your live systems.

If you’re aiming for Plus eventually, using BrightCert to get standard Cyber Essentials genuinely solid first is still the right order of operations. Plus builds on the same five controls, so gaps caught early tend to be the same ones an external audit would otherwise flag.