Cyber Essentials or Cyber Essentials Plus? Picking the Level That Fits

Two certificates, almost identical names, and a tender that says only "Cyber Essentials required." Which one does it mean? The confusion is common, and it can cost real money when a business pays for the wrong level. Anyone about to buy cyber essentials should know how the two tiers differ, who asks for each and how they fit together. The decision turns out to be easier than the naming suggests.

Same controls, different evidence

Both levels examine the same five technical areas. What changes is how the proof is gathered.

The standard certificate rests on a self-assessment questionnaire. The business describes how it meets each control, a senior person signs a declaration, and an assessor reviews the answers. Nobody visits the office or touches a machine. It is quick, fairly inexpensive and right for most small and medium-sized firms.

The order matters

Plus builds on the standard certificate. Most firms complete the basic level first, and the technical audit has to follow within a window the scheme sets at three months. Skipping the groundwork and heading straight for Plus tends to produce failed tests and retests.

Who needs what

Sole traders, small agencies, local professional firms and shops usually land on the standard level. Their customers want reassurance that the basics are covered, and nothing more. If no client has asked for hands-on testing, paying for it is hard to justify. A business can always move up later.

Larger buyers, defence suppliers and some public sector bodies lean toward Plus. They want independent verification, because the supplier sits close to sensitive systems. Tender documents normally say which level applies, so read the requirement line by line. If a contract names Plus, the basic certificate will not satisfy it, no matter how well the questionnaire went.

Ask the customer

Guessing wastes weeks. A short email to a key client asking which level their supplier policy requires usually gets an answer within a day. Procurement teams tend to appreciate the question. The reply may also reveal plans, such as a tighter policy next year, which helps with budgeting.

What a Plus assessment day looks like

The assessor starts with the scope, then picks a sample of devices. On those machines they check that updates are installed, settings match the questionnaire and protection against malware works. An internet-facing scan looks at what an outsider can reach, such as open ports on the office router. Some versions of the process include checks on how email and web browsing are handled, for example whether a harmless test file gets blocked.

A common misunderstanding

Plus does not mean "better security" in the sense of extra controls. The controls are identical. A company that fixes everything and holds the standard certificate is in the same technical shape as one with Plus, and what differs is the amount of checking behind the claim. That distinction is worth explaining to anyone who sees only the label.

Time, effort and cost

The standard version can often be finished in days. Plus takes longer, because it needs scheduling, access to devices and time for the assessor to complete testing. Costs rise as well, since skilled technical staff do the checking. Budget internal hours too. Someone has to gather the machines and deal with whatever the scan turns up.

Plus assessments sometimes find problems the paperwork missed. A forgotten laptop lacks a patch, or a setting differs from the questionnaire answer. The assessor reports it, the business fixes it, and a retest follows. Irritating? Yes. Also the whole point. A weakness found during a test is far cheaper than one found by an attacker.

A quick way to choose

Three questions help. Does any current or likely customer require hands-on verification? Does the business handle sensitive data on behalf of others? Would independent testing give the sales team a clear advantage in bids? Three no answers point to the standard level. Any yes means planning for Plus, and still starting with the basic certificate.

Keeping the certificate alive

Both last twelve months. Renewal repeats the assessment, and for Plus that includes fresh testing. Calendar reminders should go in well ahead, and the evidence from the previous round should be kept. Changes such as a new office, new cloud tools or more remote staff alter the answers, so refresh the device list before each renewal.

Which to pick

Neither level beats the other in every situation. The right one is whatever customers and risk call for. For most firms the sensible first move is to buy cyber essentials at the standard tier, get the certificate and revisit Plus when a contract demands it. Costs stay sensible, something useful arrives quickly, and the door to deeper testing remains open.