Cyber Essentials vs Cyber Essentials Plus

Cyber Essentials and Cyber Essentials Plus cover exactly the same five controls: firewalls, secure configuration, security update management, user access control and malware protection. The difference is who checks your answers. Basic Cyber Essentials is a self-assessment you sign and a certification body marks. Plus is a technical audit where an assessor tests the systems themselves.

So the question is rarely "which standard is higher?" It is "who is asking, and what will they accept?"

The short version

	Cyber Essentials	Cyber Essentials Plus
What you do	Answer the question set (Danzell, under v3.3)	Pass basic Cyber Essentials, then a technical audit by an assessor
Who checks	A certification body marks your answers	An assessor tests a sample of your systems
External vulnerability scan	No	Yes, every internet-facing service in scope
Device testing	No	Yes, an authenticated scan of sampled devices, plus email and browser malware tests
Timing	Any time	Within three months of passing basic
Valid for	12 months	12 months

What Plus adds, concretely

Plus is not a longer questionnaire. It checks that the answers you gave in the self-assessment are true on real machines.

The external scan. The assessor scans every internet-accessible service on your in-scope IP addresses. The NCSC test specification runs each service through a flowchart, and the first step is blunt: a vulnerability scoring 7.0 or more fails that service. There is no 14-day grace period at that step. A service that needs no login (unless it only serves public, read-only content), one still on default passwords, or one with no login throttling or lockout also fails. The scan post walks through the whole flowchart.

Sampled devices. The assessor runs an authenticated scan on a sample of laptops, desktops and servers. Here the 14-day rule does apply: a 7.0+ vulnerability fails once its fix has been available for more than 14 days.

Malware tests. The assessor checks how email and browsers on sampled devices handle test malicious files.

Under v3.3, if a sampled device fails the update-management test, you fix it and the assessor retests the original sample plus a new random one. Fail that second time and the basic certificate is revoked as well.

Which one is being asked for

Read the wording in the tender, contract or supplier questionnaire, not the summary someone forwarded.

• "Cyber Essentials" on its own usually means the basic certificate is enough.
• "Cyber Essentials Plus" means the audited one. A basic certificate will not count, however recent it is.
• "Cyber Essentials or equivalent" is worth a question to the buyer before you spend anything. Equivalence is their call, not yours.

If nobody is asking for Plus yet, basic is the sensible first step. You need it before Plus anyway, and the self-assessment shows you where the gaps are.

When to book Plus

Plus has to happen within three months of passing basic, so the order is fixed: basic first, then Plus while the clock is running. What you can control is how ready you are on the day.

The external scan is the part that catches teams out, because it fails on findings, not on paperwork. Before booking:

1. List every IP address and hostname in scope, including cloud services. Cloud services cannot be excluded under v3.3.
2. Find every service that answers from the internet and check that it has a documented business need.
3. Remove or cut off anything unsupported. End-of-life software fails both versions, and it is the least arguable failure in the scheme.
4. Patch anything internet-facing with a 7.0+ vulnerability now, not "within 14 days". The external scan gives you no window.

The Cyber Essentials checklist has the full list for the self-assessment side.

Where CyberSpec fits

CyberSpec does not certify anyone. Certification comes from IASME and its certification bodies. What it does is scan your internet-facing assets continuously and show a readiness view against the five controls: which ones an assessor would likely fail you on today, which need a human to review, and which you have to vouch for yourself because no external scan can see them. The Cyber Essentials overview explains that split control by control.

Sources: the NCSC's Requirements for IT Infrastructure v3.3 (April 2026), the Cyber Essentials Plus Test Specification v3.2 (April 2025, the latest published when we checked in October 2026), and IASME's summary of the April 2026 changes. Where this page and the current documents disagree, the documents are right.