The same five controls, independently verified
Cyber Essentials Plus keeps the same five technical controls as standard Cyber Essentials, but replaces the self-assessment with a hands-on technical audit, required for higher-assurance contracts and larger tenders.
From self-assessed to independently audited
Where standard Cyber Essentials relies on your own answers verified by an assessor, Plus adds an on-site or remote technical audit, including an external vulnerability scan and sampled device checks, carried out directly by a qualified assessor.
- Independent, hands-on technical audit of your in-scope systems
- External vulnerability scan of internet-facing infrastructure
- Sampled internal device checks against the five controls
- Often required explicitly by name in tender documents
Cyber Essentials PlusCyber Essentials vs Cyber Essentials Plus
Same five technical controls, different depth of verification. Most SMEs start with Cyber Essentials; higher-assurance contracts often require Plus.
| Feature | Cyber Essentials | Cyber Essentials Plus |
|---|---|---|
| Self-assessment questionnaire | ||
| Assessor verification | ||
| Independent technical audit | ||
| External vulnerability scan | ||
| Internal device sampling | ||
| Recognised for most SME contracts | ||
| Required for higher-assurance tenders |
Steps to get certified
A guided, hands-on path from scoping to certificate, no jargon, no guesswork.
Scoping
We agree the boundary of your assessment: a device, a network, or your whole organisation.
Self-Assessment
Complete a guided questionnaire against the five technical controls, with our support throughout.
Review
We check your submission and flag anything that needs addressing before it goes for formal assessment.
Certification
Your certificate is issued, backed by IASME/NCSC accreditation, valid for 12 months.
External Scan (Plus only)
An independent technical audit and vulnerability scan of your in-scope systems.
Certified?
Now let's prove it.
Tell us a little about your organisation and we'll send an itemised quote, no obligation, no sales call required. Certified in as little as 5 days.
Frequently asked questions
We help growing UK businesses put real cyber security in place, technical controls, ongoing monitoring, testing, and certifications like Cyber Essentials when you need one, without you having to hire an in-house security team. Tell us about your business and we'll tell you honestly what you actually need, not everything we happen to sell.
It depends on your size, your industry, and what's actually driving the request, a client asking for proof of security, a contract requirement, cyber insurance, or just wanting to close obvious gaps. We start with a short conversation, not a sales script, and only recommend what genuinely fits.
Not public pricing, since it depends on your size and setup. Use our quick calculator or request a quote and we'll give you a real, itemised number, not a vague "contact us."
Yes. Certification is one thing we do, not the only thing. Penetration testing, vulnerability scanning, ongoing monitoring, and general security reviews are all things businesses use us for on their own, no certificate required.
Cyber Essentials is a UK government-backed certification scheme that proves your business has five essential technical controls in place: firewalls, secure configuration, access control, malware protection, and security update (patch) management. Many UK SMEs need it to win government contracts, satisfy client or supplier due diligence, qualify for cyber insurance, or simply to prove they take data security seriously. We handle the assessment, guidance, and paperwork for you from start to finish.
Cyber Essentials is a self-assessed questionnaire, verified and approved by a qualified assessor. Cyber Essentials Plus adds an independent technical audit: an assessor actually tests your systems on-site or remotely. We support both, and we're happy to advise which level makes sense for your contracts, insurance, or client requirements.
No, most of our clients don't. We work directly with you, or your outsourced IT provider, and explain everything in plain English without assuming a security background.
It depends what you need. A security review or vulnerability scan can often start within days. Cyber Essentials certification typically takes 1-2 weeks once we have the right information from you.
If your organisation is UK-domiciled with a gross annual turnover under £20 million and your certification covers your whole organisation, you're automatically eligible for included cyber liability insurance at no extra cost when you certify. It's optional, but most of our clients take it since there's no downside.
No, security isn't a one-time box to tick. Threats and requirements change, which is why most of our clients stay on an ongoing plan, monitoring, testing, and renewal, rather than starting from scratch every year.
Yes. Our services, including Cyber Essentials, are designed for organisations of all sizes, including sole traders and small teams with a handful of laptops and a Microsoft 365 subscription. It doesn't require expensive infrastructure, it requires the right configuration and habits. We tailor our guidance to your actual setup, so you're not paying for controls or tools you don't need.
Yes, your outsourced IT provider can absolutely support the technical work. For Cyber Essentials specifically, the named person "responsible for managing the information systems" must be a member of your own organisation, not an employee of your IT provider, but we work directly with your outsourced team on your behalf either way.