Skip to main content

Explainers

Cyber Essentials vs Cyber Essentials Plus: A Buyer's Guide

What separates the self-assessed Cyber Essentials questionnaire from the audited Plus test, and why the renewal date matters more than the badge.

Solomon AmosPublished 17 Oct 20269 min read

A vendor's security page says it holds Cyber Essentials. Another says it holds Cyber Essentials Plus. To a buyer skimming a questionnaire response, the two badges look interchangeable, and some vendors are happy to leave that impression. They are not the same evidence. One is a self-scored questionnaire checked for internal consistency by an assessor who never touches the vendor's systems. The other is a hands-on technical test of those systems by an independent assessor, repeated every year. The gap between them is the whole point of this article, and the detail that actually matters to a buyer is not which badge is on the page but the date next to it.

What Cyber Essentials actually checks

Cyber Essentials is a UK government backed scheme, delivered on behalf of the National Cyber Security Centre by IASME since April 2020. An organisation completes a written self-assessment questionnaire covering five technical control areas: firewalls and internet gateways, secure configuration, security update management, user access control, and malware protection. A certification body's assessor reviews the answers for plausibility and internal consistency and can ask follow-up questions, but the assessor does not log into the vendor's network, scan a device, or verify that a patch has actually been applied. The certificate confirms that the organisation has described its own controls in a way that meets the scheme's requirements, not that an outside party has tested them.

That is a legitimate and useful baseline. It forces an organisation to document basic hygiene it might otherwise take for granted, and UK public sector contracts have required it for years. The weakness, for a buyer, is that the evidence is declared rather than demonstrated. Our companion piece, Cyber Essentials explained for buyers, goes through what each of the five controls covers in plain terms if you need the detail before reading on.

What changes with Cyber Essentials Plus

Cyber Essentials Plus keeps the same five control areas but replaces the self-declared answers with an independent technical verification. A certified assessor runs internal and external vulnerability scans against a representative sample of the devices, servers and cloud services in scope, checks that patches have actually been installed within the scheme's timeframes, attempts to authenticate without valid credentials, and tests that malware protection is active rather than just configured on paper. Some of this is done remotely, some requires an assessor to be present or to direct testing on-site, depending on the organisation's infrastructure.

An organisation cannot go straight to Plus. It needs a current Cyber Essentials certificate, usually obtained at the same time or shortly before the Plus audit, because the Plus test verifies the same scope the basic questionnaire describes. If the technical audit finds a control is not actually in place as declared, the assessor will not issue the Plus certificate until it is fixed and retested, which is the main practical difference a buyer should care about: Plus has a mechanism for catching a wrong answer before it reaches the public record.

Cyber Essentials Plus includes everything covered by Cyber Essentials, but with an independent, hands-on technical verification of the controls in scope, carried out by a qualified assessor.

The five controls, compared side by side

The table below is the shortest way to see what changes between the two tracks. The control names are identical. The method of proof is not.

Control areaCyber Essentials (self-assessed)Cyber Essentials Plus (audited)
Firewalls and internet gatewaysDeclared in the questionnaire, reviewed for consistencyConfiguration checked by the assessor's external scan
Secure configurationDeclared, including removal of unnecessary accounts and softwareSampled devices checked directly for default settings and unused services
Security update managementDeclared patch timeframes and asset inventoryVerified against the actual patch level of sampled devices and services
User access controlDeclared access policy and admin account practicesTested through authentication attempts on sampled systems
Malware protectionDeclared antivirus or application allow-listing approachVerified as active and effective on sampled devices

Same five control areas, different standard of proof, under the Cyber Essentials and Cyber Essentials Plus tracks.

Diagram showing the Cyber Essentials self-assessment questionnaire path next to the Cyber Essentials Plus technical audit path
Two tracks, same five controls, different method of verification.

Where the public certificate lives, and what the record shows

Unlike SOC 2 reports, which are private documents a vendor chooses to share, or ISO 27001 certificates, which sit with whichever accredited body issued them, Cyber Essentials has a single public search tool run by IASME on behalf of NCSC. A buyer can look up an organisation by name or certificate number and see the certification body that issued it, the scheme variant, basic or Plus, the date of issue, and the expiry date. There is no equivalent of a bridge letter or a bulk registry mirror the way there is for FedRAMP or PCI DSS, so this single record is the authoritative source rather than one of several. If a vendor's trust centre states a certification status that does not match what IASME's search shows, the search tool wins the argument. It is worth reading how to read a trust centre alongside this lookup, since the same discipline of checking the primary registry rather than the marketing page applies across every framework in the index, not just this one.

12 months
Certificate validity
Both Cyber Essentials and Cyber Essentials Plus certificates run on an annual cycle and must be reassessed to stay current.
5
Technical control areas
Identical scope across both tracks: firewalls, secure configuration, patching, access control and malware protection.
Smaller count
Cyber Essentials Plus listings versus basic Cyber Essentials listings
in the CertReports index on 2026-10-17, reflecting the extra cost and technical audit step most organisations do not take on.

Why the renewal date is the thing to check

A Cyber Essentials or Cyber Essentials Plus certificate lapses twelve months after issue unless the organisation goes through the full process again. Nothing forces a vendor to remove a badge from its website the day a certificate expires, and nothing in the scheme automatically flags an expired certificate to a buyer reading a security page. If the only thing you record from a vendor's self-attestation is the claim that they hold Cyber Essentials Plus, without a date attached, that fact decays the moment the certificate does, and you will not notice. The useful habit is the same one that applies to every time-bound credential in a vendor review: capture the expiry date, not just the claim, and recheck it before the next contract renewal. Our evidence expiring this month view exists for exactly this reason, because a badge without a date is not evidence, it is a screenshot.

This is not a Cyber Essentials-specific problem. Other frameworks behave the same way in a public trust centre, which is why it is worth looking at how a live record handles a status with a specific validity window. Miro's trust centre page is a useful comparison because it states an active Data Privacy Framework listing alongside a usage end date, rather than just a static logo. The lesson transfers directly: when a credential carries an expiry or end date, check the date field itself, not the badge sitting next to it, whether that credential is a Data Privacy Framework listing or a Cyber Essentials Plus certificate.

Miro logo

Miro · Trust report

Collaboration · Public evidence as of 19 Oct 2026

Visit trust centreFull evidence

Framework overview

CertReports state for each framework with public evidence: 1 verified, 8 vendor-stated.

1Documents and agreements

Legal and review documents Miro publishes or offers, as of 19 Oct 2026.

12Subprocessors

Named on Miro's public subprocessor list, last seen 19 Oct 2026.

An active listing with a stated end date is the model for reading any time-bound certification, including Cyber Essentials Plus. Every line is a dated public record from the Data Privacy Framework list and Miro's trust centre. A framework not shown means no public evidence was found, not that Miro lacks it.CertReports

How to get Cyber Essentials Plus certification

For vendors working through the process, or buyers trying to understand what a supplier still needs to complete, the sequence runs in a fixed order.

  1. 1

    Hold or apply for Cyber Essentials first

    A current Cyber Essentials self-assessment certificate is a precondition for Cyber Essentials Plus, since the Plus audit verifies the same declared scope.

  2. 2

    Choose a licensed certification body

    IASME accredits certification bodies that deliver the Plus audit. Comparing a few options before committing is worth the time, since pricing and scheduling vary between bodies.
  3. 3

    Define and agree the scope

    The organisation and assessor agree which devices, servers, cloud services and locations are in scope before testing begins, since the certificate only covers what was tested.

  4. 4

    Complete the technical audit

    The assessor runs vulnerability scans, authentication tests and patch verification against a sample of in-scope systems, either remotely or with an on-site visit.

  5. 5

    Remediate any findings

    If testing finds a control is not operating as declared, the assessor will not issue the certificate until the gap is fixed and the affected area is retested.

  6. 6

    Renew annually

    The certificate is valid for twelve months. Both the questionnaire and the technical audit are repeated each year to keep the certification current.

Timeline showing the twelve month Cyber Essentials and Cyber Essentials Plus renewal cycle from issue date to expiry
Both certificates run on a strict twelve month cycle with no automatic grace period.

Common mistakes buyers make reading the certificate

  • Treating a Cyber Essentials badge on a vendor's website as equivalent to Cyber Essentials Plus, when the two tracks have different verification methods behind them.
  • Not checking the expiry date on the IASME search record, and relying instead on a static badge or a PDF a vendor sent during onboarding.
  • Assuming the certificate covers the vendor's whole organisation, when the scope agreed with the assessor may be limited to a specific boundary, office or set of systems.
  • Confusing Cyber Essentials with ISO 27001 or SOC 2, which cover a much broader management system and are assessed differently; see SOC 2 vs ISO 27001 for how those compare to each other.
  • Assuming Cyber Essentials Plus says anything about a vendor's subprocessors or fourth-party supply chain, when it only tests the certified organisation's own in-scope systems.

The quick check before you file the evidence

Pull up the IASME certification search, enter the vendor's name, and confirm three things: the scheme variant, basic or Plus, the issue date, and the expiry date. If the expiry date has passed, treat the certification as having no public evidence rather than assuming it has simply not been renewed yet.

People also ask

What is cyber essentials plus?

Cyber Essentials Plus is the audited version of the UK's Cyber Essentials scheme. It covers the same five technical control areas as the basic self-assessment, firewalls, secure configuration, patching, access control and malware protection, but a certified assessor tests them directly through vulnerability scans and device sampling rather than relying on a written questionnaire.

What is cyber essentials plus certification?

It is the certificate issued after an independent, hands-on technical audit confirms an organisation's systems meet the Cyber Essentials control requirements. Delivered through IASME on behalf of the NCSC, it is valid for twelve months, and the public record is searchable on IASME's certification search tool by organisation name or certificate number.

How to get cyber essentials plus certification?

An organisation first holds or applies for basic Cyber Essentials, agrees scope with a licensed certification body, then undergoes the technical audit: vulnerability scanning, authentication testing and patch verification across sampled in-scope systems. Any findings must be remediated and retested before the certificate is issued, and the record of which vendors currently hold it is public.

How much does cyber essentials plus cost?

IASME publishes banded pricing for the self-assessment tied to organisation size, and certification bodies separately price the technical audit, which varies with the number of devices and locations in scope. There is no single published figure that covers every vendor, so check the certification body's current quote or IASME's price list rather than a fixed number.

Cyber EssentialsCyber Essentials PlusUK vendor securityIASMENCSC
S

Solomon Amos · Founder, CertReports

Solomon builds CertReports, the public evidence index for vendor security reviews. PhD in machine learning and cybersecurity, two years embedded at HMRC digital programmes, founder of TapTax. He writes about what registries, trust centres and auditors actually publish, and how buyers can use it before the questionnaire goes out.

Read next on CertReports

You might also like