Cyber Essentials vs Plus: cost, renewal and requirements
Key takeaways
- Cyber Essentials and Cyber Essentials Plus assess exactly the same five technical controls; Plus adds independent testing to verify they work in practice
- Cyber Essentials costs from £320 plus VAT for organisations with up to 9 employees, rising to £600 plus VAT for 250 or more
- Cyber Essentials Plus is quoted individually and depends on the size and complexity of your network
- Both certificates expire after 12 months, and you re-enter all your answers each year
- Cyber Essentials is required in many central government contracts, and for Ministry of Defence suppliers handling defence information
Cyber Essentials and Cyber Essentials Plus are two levels of the same scheme developed by the NCSC and aligned to the UK Government's minimum standard. Both check the same five technical controls. The difference is assurance: Cyber Essentials is a self-assessment that an assessor marks, while Cyber Essentials Plus adds an independent technical audit of your systems. This guide covers what each involves, what they cost and how renewal works.
What is Cyber Essentials?
The NCSC describes Cyber Essentials as the minimum standard of cyber security recommended by the government for organisations of all sizes. It was developed by the NCSC and is aligned to five technical controls designed to prevent the most common internet-based threats. IASME is the NCSC's official Cyber Essentials Delivery Partner.
In the NCSC's words, the five controls:
- create a security filter between the internet and your network
- set up computers securely to minimise the ways a cyber criminal can get in
- stop criminals using vulnerabilities in software as an access point to your systems
- control who can access your data and services, and at what level
- identify and immobilise viruses and other malicious software before they cause harm
Cyber Essentials vs Cyber Essentials Plus: the differences
The NCSC says both levels assess the same five key technical controls, but Cyber Essentials Plus goes a step further by independently testing your systems to verify that those controls work in practice. IASME puts it this way: the controls are exactly the same, but the level of assurance is different.
| Cyber Essentials | Cyber Essentials Plus | |
|---|---|---|
| Controls assessed | The five technical controls | The same five controls |
| How it is checked | Verified self-assessment, signed off by a board member and marked by an assessor | The self-assessment plus a technical audit by a Certification Body |
| Testing | No additional test or vulnerability scan | Internal and external vulnerability scans and tests on a sample of systems |
| Cost | £320 to £600 plus VAT, by organisation size | Quoted individually, by size and complexity of network |
| How to apply | Self-led through IASME, or supported by a Certification Body | Contact a Certification Body directly |
| Validity | 12 months | 12 months |
What the Cyber Essentials Plus audit covers
IASME says Cyber Essentials Plus starts with the Cyber Essentials verified self-assessment questionnaire, then adds a technical audit of the systems in scope. The audit includes an internal and external vulnerability scan and covers a representative set of user devices, all internet gateways, and all servers with services accessible to unauthenticated internet users.
The assessor tests a random sample of these systems, typically around 10 per cent, and then decides whether further testing is needed. The audits can be run remotely or in person.
How much does Cyber Essentials cost?
IASME prices the verified self-assessment by organisation size, using the UK government's employee bands:
| Organisation size | Employees | Price |
|---|---|---|
| Micro | 0 to 9 | £320 plus VAT |
| Small | 10 to 49 | £440 plus VAT |
| Medium | 50 to 249 | £500 plus VAT |
| Large | 250 or more | £600 plus VAT |
Any UK organisation with a turnover under £20 million that certifies its whole organisation is automatically entitled to cyber liability insurance arranged by IASME, according to the NCSC, including 24/7 incident response support.
How much does Cyber Essentials Plus cost?
There is no published fixed price. IASME says Cyber Essentials Plus has to be quoted for individually, and that the cost depends on the size and complexity of the network. It is more expensive than the self-assessment because it needs more dedicated time from technical experts. You can submit your details to IASME and receive quotes from three different Certification Bodies, or contact a Certification Body directly.
How do you get certified?
For Cyber Essentials, the NCSC describes two routes:
- Self-led. Register with IASME, pay, then complete the verified self-assessment. A board member or equivalent signs off your answers and an assessor marks them.
- Supported. Hire a Certification Body, licensed by IASME, to help you understand the questions and how they apply to your organisation.
IASME advises downloading the free question set first and preparing your answers before applying. Once you pay, you have six months to complete the assessment. If your answers are ready, IASME says the self-assessment might take only about an hour, and most assessors aim to return results within three days.
For Cyber Essentials Plus, the verified self-assessment is a prerequisite. If you achieved Cyber Essentials less than three months before certifying to Plus, IASME says you will not need to repeat the self-assessment questions stage.
What makes you fail?
IASME says you need to be compliant in nearly all the questions to pass. In particular, any organisation using unsupported software within the scope of the assessment will fail.
If you fail, IASME gives you two working days to review the assessor's feedback, fix simple issues and update your answers, and the assessor will look again at no extra charge. If you still fail after those two days, you have to reapply and pay the fee again.
How often do you renew Cyber Essentials?
Every year. IASME says Cyber Essentials and Cyber Essentials Plus certificates expire after 12 months, and it removes organisations from its certified list if they have not been certified in the past year. It emails a reminder roughly a month before you need to recertify.
You have to enter all the information again each time, which IASME describes as an annual review of your cyber security. Some questions may have changed, so keep a copy of your answers when you submit.
Which one do you need?
Start with the contract or customer asking for it. IASME says Cyber Essentials is now required in a large number of central government contracts and an increasing number of local government contracts, and is required for Ministry of Defence suppliers throughout their supply chain where defence information is handled.
Check which level the contract names. In our view, Cyber Essentials Plus is worth the extra cost when a customer asks for independent evidence, or when you want an outside check that the controls really are in place.
Neither level covers backup and recovery. Our guides to immutable vs air-gapped backups and the 3-2-1 backup rule cover that side.
Frequently asked questions
What is the difference between Cyber Essentials and Cyber Essentials Plus?
They assess the same five technical controls. Cyber Essentials is a verified self-assessment signed off by a board member and marked by an assessor. Cyber Essentials Plus adds a technical audit, including internal and external vulnerability scans, to verify the controls are in place.
How much does Cyber Essentials cost?
IASME prices it by organisation size: £320 plus VAT for 0 to 9 employees, £440 for 10 to 49, £500 for 50 to 249 and £600 for 250 or more, all plus VAT.
How much does Cyber Essentials Plus cost?
There is no fixed price. IASME says it has to be quoted individually and depends on the size and complexity of your network, and it is more expensive than the self-assessment because it needs more time from technical experts.
How often do you renew Cyber Essentials?
Every year. IASME says Cyber Essentials and Cyber Essentials Plus certificates expire after 12 months, and you need to enter all the information again each time you certify.
Do I need Cyber Essentials before Cyber Essentials Plus?
Yes. The verified self-assessment is a prerequisite for Plus. If you achieved Cyber Essentials less than three months before certifying to Plus, IASME says you will not need to repeat the self-assessment questions.
