Cyber Essentials vs Cyber Essentials Plus: Understanding the Real Difference
On paper, Cyber Essentials and Cyber Essentials Plus look like a minor naming variation. In practice, the gap between them is significant — and understanding it properly will save you from either over-investing too early or under-preparing for a contract that actually needs the higher tier.
Self-Assessment Has Its Place — And Its Limits
Base Cyber Essentials is completed via a self-assessment questionnaire, verified by a qualified assessor reviewing your answers. It's a genuinely useful baseline, fast to achieve, and sufficient for a large share of contracts. But it relies on your own representation of your controls being accurate.
What Independent Testing Actually Adds
Cyber Essentials Plus involves an assessor actually testing your systems — vulnerability scanning, configuration checks, verification that patches are genuinely applied rather than just claimed. It's the difference between saying your controls work and proving it.
Which One Your Contracts Actually Require
Higher-sensitivity engagements — government, critical infrastructure, financial services, anything handling particularly sensitive personal data — increasingly specify Plus as the minimum. For most standard commercial security contracts, base Cyber Essentials remains sufficient.
Don't assume you need Plus by default, but don't assume base-level is always enough either. Check what your specific target contracts actually specify before committing the additional time and cost.
Need Help With This?
Our compliance team can walk you through exactly what your business needs.
Book Free ConsultationKeep Reading
More Articles
5 Signs Your Security Company Needs SIA ACS Accreditation
If you're noticing any of these patterns in your tender results, ACS accreditation might be the missing piece.
ISO 9001 vs ISO 45001: What's the Difference and Do You Need Both?
Two of the most commonly confused ISO standards, explained in plain English for security businesses.
How to Pass Your CHAS Assessment First Time
Common reasons CHAS applications get rejected — and how to avoid them.