If you are comparing Cyber Essentials vs Cyber Essentials Plus, the main difference is how your security is assessed. Cyber Essentials uses a verified self assessment, while Cyber Essentials Plus adds a technical audit of your IT systems.

For businesses deciding which certification they need, the choice usually comes down to contractual requirements, risk and the level of assurance you need.

What is the difference between Cyber Essentials and Cyber Essentials Plus?

Both certifications are based on the same five technical controls. Cyber Essentials asks you to demonstrate that these controls are in place through a verified questionnaire. Cyber Essentials Plus goes further by testing your systems to verify that those controls are actually working.

In simple terms:

• Cyber Essentials: verified self assessment.
• Cyber Essentials Plus: self assessment followed by technical testing.
• Both: certification lasts for 12 months and needs to be renewed annually.
• Plus: provides a higher level of assurance because an independent assessor tests your systems.

Cyber Essentials Plus includes testing of a representative selection of user devices, internet gateways and internet facing servers.

How much does Cyber Essentials cost in 2026?

Current IASME pricing starts at £320 + VAT for organisations with 0 to 9 employees and rises to £600 + VAT for organisations with 250 or more employees. Cyber Essentials Plus is individually quoted because the cost depends on the size and complexity of the network.

The bigger cost consideration is often the work required before assessment. Unsupported software, outdated systems or poorly managed devices may need attention before you can certify.

How long does Cyber Essentials take?

If your systems are already compliant, completing the Cyber Essentials questionnaire can be relatively quick. IASME states that prepared organisations may complete the assessment in around an hour, with assessors generally aiming to return results within three working days.

Cyber Essentials Plus takes longer because it includes technical testing, so your timescale depends on the size and complexity of your IT environment.

Do I need Cyber Essentials for government contracts?

Some public sector contracts require suppliers to hold Cyber Essentials or Cyber Essentials Plus. The exact requirement depends on the contract and its security risks.

For example, current government procurement guidance identifies contracts involving personal information, government information and certain ICT services as areas where Cyber Essentials requirements may apply. The tender should specify whether Cyber Essentials, Cyber Essentials Plus or equivalent controls are required.

For some MOD contracts, Cyber Essentials Plus can be required depending on the contract’s cyber risk profile.

What commonly causes Cyber Essentials problems?

From an IT support perspective, common problem areas include:

• Unsupported operating systems or software
• Gaps in security updates and patch management
• Poorly controlled administrator access
• Unmanaged BYOD devices
• Firewall configurations left at insecure defaults
• MFA not being applied where required

The current Cyber Essentials requirements are version 3.3, effective for assessment accounts created from 27 April 2026.

If you are unsure which certification your business needs, VectorCloud can help you assess your current IT environment, identify potential issues and prepare for certification. Get in touch to discuss your Cyber Essentials requirements.