Cyber Essentials Plus

Cyber Essentials Plus is a UK government-backed certification scheme that helps organisations demonstrate their operational security against common cyber attacks.
It’s an enhanced version of Cyber Essentials, which is a self-assessment option. Cyber Essentials Plus includes all the requirements of Cyber Essentials, plus additional verification steps, including a technical audit of your systems.

Book a free 30-minute call

What is Cyber Essentials Plus?

The same five controls as Cyber Essentials, but independently tested rather than self-declared.

Cyber Essentials Plus includes everything in Cyber Essentials, plus a hands-on technical audit of your systems. An assessor verifies that the controls are genuinely in place and working — giving your customers real confidence, not just a tick-box.

It is the right choice when there is a higher risk to manage, and it is increasingly required for public sector tenders and larger supply chains handling sensitive or personal data.

What the audit checks

Five practical tests, taken from the Cyber Essentials Plus specification. We help you prepare so nothing fails on the day.

Remote vulnerability assessment

Checks whether an internet-based opportunist could break in using typical low-skill methods.

Patching

Identifies missing security fixes that could be exploited, so they can be patched or updated.

Malware protection

Confirms every in-scope machine has a working, basic level of malware protection.

Multi-factor authentication

Checks that your cloud services are configured to require multi-factor authentication.

Account separation

Confirms that everyday user accounts are not running with administrator privileges.

Why it’s worth having

Independent validation carries weight — with customers, insurers and procurement teams.

  • Independent proof that your Cyber Essentials controls actually work
  • Required for many public sector contracts and larger supply chains
  • Shows a stronger, demonstrable commitment to security
  • A genuine commercial advantage when bidding for work

Frequently asked questions

Straight answers to the things people ask us most.

What is the difference between Cyber Essentials and Cyber Essentials Plus?
Cyber Essentials is self-assessed. Cyber Essentials Plus adds a hands-on, independent technical audit that verifies your controls actually work in practice, rather than being self-declared.
What does the Plus audit involve?
An assessor tests a sample of your devices and systems — checking patching, malware protection and configuration — usually remotely, sometimes on-site. We help you prepare so nothing fails on the day.
Do we need Cyber Essentials first?
You need to meet the same five controls. Cyber Essentials Plus must be certified within three months of your Cyber Essentials assessment.
Who needs Cyber Essentials Plus?
Many public sector and larger enterprise contracts require it, and some cyber insurers ask for it too. If a contract specifies Plus, that is the one you need.
How much does Cyber Essentials Plus cost?
It depends on the number of devices and users involved. Get in touch for a quote — no obligation.

Ready for Cyber Essentials Plus?

Book a free 30-minute call