2026 Comparison
Cyber Essentials vs Cyber Essentials Plus: Which Do You Need?
Both certifications are managed by the NCSC and delivered through IASME. The difference comes down to one thing: independent technical verification.
The short answer
- • Choose Cyber Essentials if your customers, regulators or insurers simply require "Cyber Essentials" – most central government contracts handling personal data fall here.
- • Choose Cyber Essentials Plus if a contract specifies "CE+", or you handle MOD, NHS sensitive data, or want maximum supply-chain assurance.
Cyber Essentials
Verified self-assessment reviewed and certified by us as your IASME-licensed Certification Body.
- £320 + VAT
- From 24 hours
- Questionnaire only
Cyber Essentials Plus
Everything in CE, plus an independent technical audit.
- £1,400 + VAT
- Within 5 working days
- Hands-on device audit + vuln scan
Feature comparison
| Feature | Cyber Essentials | CE Plus |
|---|---|---|
| Verified self-assessment questionnaire | ||
| Reviewed by IASME-accredited assessor | ||
| Independent technical audit of devices | ||
| External vulnerability scanning | ||
| Authenticated patch & malware checks | ||
| Certificate valid for 12 months | ||
| £25,000 cyber insurance via Cyber Essentials (eligible UK orgs under £20m turnover) | ||
| Listed on IASME public register | ||
| Typical turnaround | From 24 hours | Within 5 working days |
| Starting price | £320 + VAT | £1,400 + VAT |
When to choose Cyber Essentials
- You bid on UK central government contracts handling personal information
- You sell on G-Cloud or Government Commercial Agency frameworks
- Your enterprise customers ask for "Cyber Essentials" without specifying Plus
- You want to lower cyber insurance premiums
- You need certification quickly (24 hours possible)
When to choose Cyber Essentials Plus
- A contract or RFP specifies "Cyber Essentials Plus" or "CE+"
- You handle MOD, NHS sensitive data or critical national infrastructure
- You're a Tier 1/2 supplier where customers want hands-on assurance
- You handle large volumes of personal or financial data
- You want the strongest market signal of cyber maturity
Frequently asked questions
Not sure which you need?
Tell us your customer or framework requirement and we'll recommend the right level. Most clients get a quote within 24 hours.