The two Cyber Essentials levels cover the same five technical controls. The difference is how rigorously you have to prove you've implemented them — and that has real implications for cost, time and which contracts you can win.
Cyber Essentials (the standard tier)
A verified self-assessment. You answer a structured question set about your firewalls, configuration, access control, malware protection and patching. An assessor reviews your answers and either certifies or comes back with clarifications.
- Evidence: your own answers, signed off by a director.
- Typical cost: £320–£600 + VAT depending on company size.
- Timeline: 2–6 weeks including remediation.
Cyber Essentials Plus
Same scope, but verified by an independent technical audit. An assessor connects to a sample of devices, runs vulnerability scans, tests email and web filtering and confirms MFA and patching are actually in place.
- Evidence: live technical testing of a representative sample of devices and cloud services.
- Typical cost: £1,500–£4,000+ depending on device count and complexity.
- Timeline: 4–10 weeks, with a fixed audit window once you're ready.
Which one do you need?
Pick the right level based on what's driving the certification, not what looks impressive on a website.
Go for Cyber Essentials if…
- You want a baseline credibility marker for marketing and procurement.
- Your customers ask about security but don't mandate Plus.
- Your cyber insurance renewal asks for it as a minimum.
Go for Cyber Essentials Plus if…
- You bid for UK central government contracts handling sensitive data.
- An enterprise client has it in their supplier requirements.
- You operate in regulated sectors (legal, finance, healthcare, defence supply chain).
- You want maximum reassurance that your controls actually work in practice, not just on paper.
The honest comparison
Cyber Essentials proves your intent. Cyber Essentials Plus proves your reality. Many SMEs start with the standard tier and move to Plus within 12 months as client demand grows.
Next step
Book a free 30-minute review and we'll tell you which level fits your situation, what you'd pass today, and what it would cost to close the gaps.