What is Cyber Essentials Plus?

Cyber Essentials Plus costs significantly more than the base certification because it involves assessor time on site or remotely, technical testing and reporting. Where the self-assessment fee typically sits in the hundreds of pounds, Plus commonly runs into low four figures for a small organisation, and scales with the number and diversity of devices in scope, the number of sites and whether remote workers must be tested. The base certification fee is also payable, since Plus can only be taken after passing it. Remediation work identified during preparation is a separate cost.

A failure does not automatically end the process. Assessors typically report the issue and allow a remediation period — commonly up to 30 days — for the organisation to correct it and provide evidence or allow retesting. The most frequent failures are missing patches on third-party software such as browsers, PDF readers and conferencing clients; unsupported operating system versions; and administrative accounts used for everyday work. If problems are extensive, the assessment may need to be restarted, which is why a pre-audit readiness check is worthwhile before booking the formal audit.

Assessors test a representative sample rather than every device. The sample size is determined by IASME's sampling rules and reflects the total number of devices and the number of distinct build types — for example, Windows laptops, macOS laptops, Android phones and iPhones each count as a separate group. A small organisation with a uniform Windows estate may see only a handful of devices tested. A mixed estate with several operating systems and multiple sites will see more, because the assessor must cover each group. Remote workers' devices are included where they hold organisational data.

Yes, in most cases. Remote auditing has become standard practice: the assessor connects to sampled devices via screen sharing or a remote access session, runs the vulnerability scan against them, and observes the malware and email tests being carried out. This suits organisations with distributed or home-based staff. Some assessors still offer on-site audits, and certain environments — isolated networks, or estates where remote access is restricted by policy — are easier to test in person. The testing requirements and the resulting certificate are identical either way.

Mobile devices that access organisational data — company email, files or business applications — are in scope, including staff-owned phones used for work. In practice this means they must be running a supported operating system version, receive security updates, have a passcode or biometric lock, and be covered by the organisation's access controls. Devices used only for voice calls and text messages, with no access to business data, fall outside scope. Because personal phones are common in SMEs, clarifying which devices touch business data is one of the first steps in defining scope.

If no contract or insurer requires it, the base certification satisfies the immediate need at a much lower cost. The argument for Plus is assurance rather than compliance: the audit independently verifies that patching, malware protection and account controls genuinely work across real devices, and it routinely finds gaps that a self-assessment does not. Organisations bidding for larger contracts often certify to Plus pre-emptively, because buyers increasingly specify it and the lead time to achieve it can exceed a tender deadline.