Cyber Essentials is the UK government-backed certification for the basic controls that guard against the most common cyber threats, and it shows clients, partners and regulators you take cyber security seriously. Organisations that hold it are 92% less likely to make a claim on their cyber insurance. Cyber Essentials and Cyber Essentials Plus cover the same five controls. The standard certificate is a self-assessment that an assessor marks, and Plus adds an assessor who tests a sample of your devices to check those answers hold up on real machines.
Our view is simple: start with Cyber Essentials, whatever your size, and move up to Plus when you want the extra assurance. That means someone independently testing that your controls work, evidence you can hand to a client, an insurer or your own board, and support with the technical side. There’s no deadline to move up. When you do, the Plus audit needs to happen within three months of a standard certificate, so the simplest route is to line it up with your annual renewal.
What is the real difference between Cyber Essentials and Cyber Essentials Plus?
The same five controls, two levels of proof
Both certificates are built on the NCSC’s Requirements for IT Infrastructure: firewalls, secure configuration, security update management, user access control and malware protection. For the standard certificate, you answer a question set, a director signs it off, and an assessor marks it. That’s the verified self-assessment.
Plus keeps all of that and adds a technical audit. An assessor scans your systems and tests a random sample of devices to see whether what you wrote down is true on the machines your people actually use.
Standard first, then Plus within three months
You can’t go straight to Plus. You need the standard certificate first, and IASME expects the Plus audit to be finished within three months of it being issued. Let that window run out, and you’re back to the self-assessment.
Since the April 2026 update, you also can’t go back and adjust your self-assessment answers once Plus testing starts. We covered the rest of the v3.3 changes in our Danzell update article, so we’ll leave them there.
| Features | Cyber Essentials | Cyber Essentials Plus |
|---|---|---|
| How it's assessed | Verified self-assessment, marked by an assessor | Self-assessment plus a hands-on technical audit |
| Controls covered | The five NCSC controls | The same five controls |
| Before you start | Nothing | Standard certificate issued within the last three months |
| Devices tested | None directly | A random sample, plus a fresh sample if a retest is needed |
| Valid for | 12 months | 12 months |
| Cost | Size-tiered IASME fee | Higher, because an assessor's time is involved; quoted per job |
| What it gives you | A recognised certificate and a clear view of where you stand | Tested evidence that the controls work on your actual devices |
Why start with Cyber Essentials?
It’s the foundation Plus is built on
You can’t take Plus without the standard certificate, and the self-assessment shows you where you stand. It usually turns up a few things to fix, such as a shared admin login or a cloud tool nobody set MFA up on. Sorting those first is what makes Plus straightforward later.
It’s the certificate clients recognise
Plenty of clients and suppliers look for Cyber Essentials as a minimum. It also comes with insurance: eligible businesses certifying their whole organisation get cyber liability cover capped at £25,000; you have to opt in to it, and incident support is a separate service.
When it is worth moving up to Plus?
Plus is worth it once you want more than the certificate itself, which usually comes down to three things.
You want proof the controls work on real devices
A self-assessment records what you believe is true across your fleet. Plus tests it. Any gaps get found by an assessor on a timetable you’ve chosen, which is a far better moment than when a client’s auditor finds them.
You want evidence ready before anyone asks
We see clients in financial services and legal pass their own supplier checks down to their agencies, and insurers ask whether controls have been “independently verified”. With Plus in hand, your answer to the next security questionnaire is already backed by tested evidence.
You want support through the technical side
Plus involves external scans, a device sample and sometimes a retest. For a team without a dedicated security person, having someone prepare the fleet and handle the fixes is a good part of the value, and we can take you through both stages.
Think of it as the difference between telling your insurer the brakes work and letting someone test them.
What does moving to Plus change for a Mac-first team?
What the assessor looks at on Macs and iPhones
The assessor tests a sample of devices for missing updates, working malware protection, firewall state on Macs and separate admin accounts, then checks MFA across your cloud services.
Your DMS already holds most of the evidence
If your Macs and iPhones are enrolled through Apple Business and managed in a DMS (formerly MDM) such as Addigy, most of the proof already exists: OS versions, pending updates, firewall state and who has admin rights. The real work is making sure every in-scope device is enrolled, including any personal iPhone that opens work email or Slack.
One unpatched device can fail the audit
Critical and high-risk updates have to be installed within 14 days of release, and missing that window is now an automatic fail. On Plus it gets tested. If the sampled devices fail, you fix them and the assessor retests the originals plus a fresh random sample, so updating only the machines they looked at won’t get you through. A second failure costs you the standard certificate as well.
The audits we’ve helped clients through rarely trip on anything exotic. More often it’s one MacBook that’s been sitting in a drawer since its owner went on parental leave, eight macOS updates behind.
The next step
Start your standard self-assessment this month. As you go, mark any answer you’d struggle to prove on every device, whether that’s a Mac nobody has checked in a while or a tool you’re not sure has MFA. Those are exactly the answers Plus would test, so the list shows you how much work moving up involves, and whether to book Plus straight after this certificate or at your next renewal.
Share it with your IT provider alongside your device list, and you’ll have a plan for both stages.
Related articles
- Cyber security fundamentals: where to actually start
- Cyber Essentials has changed: the April 2026 Danzell update
- What Cyber Essentials certification looks like for an all-Mac office
- Responding to a client’s security questionnaire
FAQs
Can we go straight to Cyber Essentials Plus?
No. You need the standard certificate first, and IASME expects the Plus audit to be finished within three months of it being issued. We’d plan both together: complete the self-assessment, fix anything it shows up, then book the assessor while there’s still plenty of the window left.
Is Cyber Essentials Plus harder to pass?
The controls are identical, so a business genuinely meeting them should pass both. Plus simply checks. Gaps that slip through a self-assessment, like a Mac that hasn’t updated in a month or a cloud tool without MFA, come to light when an assessor tests real devices.
How long do the certificates last?
Both are valid for 12 months, so you’ll renew every year. Renewals now run under the v3.3 requirements, which made MFA on cloud services and the 14-day update window automatic-fail questions. If your last certificate came before April 2026, expect the next one to feel stricter.
Do personal iPhones count towards Cyber Essentials?
They do if they access work data or services, such as email, Slack or shared files. A phone used only for calls, texts and an authenticator app sits outside scope. Most agencies we support find enrolling work-used phones in their DMS simpler than debating which ones count.
