Photo by Emanuel Ekström on Unsplash
Somewhere in the small print of a grant application, someone flagged it. Cyber Essentials. Maybe it was listed as a condition of funding. Maybe it appeared as a recommended checkbox and you quietly noted it for later. Either way, the question lands the same way every time: do we need the basic level or the Plus? And what does the difference actually mean for an organisation that runs on tight budgets, mixed IT, and a team that did not sign up to become cyber security experts?
This post answers that question clearly, for museums, galleries and heritage trusts of any size.
Why this certification is showing up in more funding conditions
Cyber Essentials is a UK government-backed certification scheme focused on five core technical controls. It was originally designed for organisations bidding for government contracts, but it has steadily become a standard ask from arts and heritage funders, and that trend is moving in one direction only.
The reasoning is straightforward. Heritage organisations hold real data. Visitor records, donor details, online ticket purchases, digital archive access credentials, staff email accounts. That is exactly the kind of data attackers target, and most successful attacks against organisations of this size do not rely on sophisticated techniques. They rely on basic gaps: outdated software, weak passwords, routers left on factory settings, phishing emails that land in an inbox with no filtering in place. Cyber Essentials is designed to close those gaps systematically.
For a broader look at how cyber security applies to the sector, the Cyber Essentials for Museums and Galleries page covers the risks most commonly seen in cultural organisations and what a realistic path to certification looks like.
What Cyber Essentials actually tests
Both the standard and Plus levels cover the same five areas: boundary firewalls and internet gateways, secure configuration of devices and software, access controls and admin privileges, malware protection, and patch management. Neither level is exotic or theoretical. They map directly onto the controls that stop the most common and damaging attacks seen against UK organisations today.
At the standard Cyber Essentials level, your organisation completes a detailed self-assessment questionnaire. An independent assessor reviews your answers. If your controls are in place and described accurately, you are put forward for certification. This works well for organisations with relatively straightforward IT, a small number of devices, a single site, and no unusually complex infrastructure.
What Cyber Essentials Plus adds, and why it matters
Cyber Essentials Plus covers the same five controls. What changes is how they are verified.
Instead of relying on your self-assessment, a qualified technician tests your actual systems. They run hands-on checks against your devices, your network configuration, and your email security controls. The goal is to confirm that the controls you described in your questionnaire are genuinely in place and working as described, not just documented on paper.
This is meaningfully harder to achieve, because there is nowhere to hide if something is misconfigured in practice. It is also significantly more credible. Funders and partners who want strong assurance are increasingly asking for Plus precisely because the technical test provides independent evidence rather than a signed declaration.
The Cyber Essentials Plus Certification Package covers what the hands-on assessment process involves and how it is structured from start to finish.
Which level fits your organisation
The honest answer depends on three things.
What your funder actually requires. Some funding bodies specify Cyber Essentials. Others now specify Plus. Read the grant conditions carefully and do not assume. Going through the standard level when Plus is required means repeating the process, which costs time and money your team probably does not have spare.
How complex your IT is. A single-site volunteer museum running a handful of shared laptops and a basic website has a very different profile from a multi-site heritage trust operating a ticketing platform, an online shop, a digital archive, hybrid staff working on personal devices, and multiple third-party systems. Simpler IT generally means the standard level is achievable and proportionate. More complex environments usually benefit from the deeper verification Plus provides, and the process often surfaces configuration problems worth fixing regardless of the certification result.
What you want beyond the certificate itself. If the goal is purely to satisfy a funder requirement, the standard level may be sufficient. If the goal is genuine confidence that your systems are in good shape, Plus tells you something a questionnaire cannot.
A clear boundary: what certification does not cover
Cyber Essentials and Cyber Essentials Plus cover IT security and data protection controls. They do not cover physical security, gallery access control, object protection or anything relating to your physical collection. If a funder or partner asks whether your certification covers those areas, the answer is no, and it was never designed to. Keep that boundary clear in any conversations about scope.
Getting ready before the assessment
One of the most common stumbling blocks at Plus level is discovering during the technical test that devices or systems are not as well configured as assumed. Patch management is a frequent gap: software updates that got deferred, a legacy system nobody wanted to touch, or browser versions that fell behind without anyone noticing. Finding those gaps yourself before an assessor does is far less stressful than discovering them mid-test.
The Vulnerability Scanning and Reporting service is worth considering as a preparation step, particularly for organisations heading toward the Plus assessment. It surfaces exactly the kinds of issues that technical testers look for.
If you are starting with the standard level first and intend to build toward Plus over time, that is a sensible approach for organisations still developing their IT controls. The Cyber Essentials Certification Package covers the full self-assessment process with guidance designed to help you get your answers right the first time rather than reworking them after a failed review.
Practical takeaway
Check your funder's exact wording before you start, not after. If Plus is required, go straight there and avoid the cost of doing both in sequence. If your IT involves multiple sites, remote staff, or a mix of cloud and on-site systems, treat Plus as the appropriate level even if it is not explicitly demanded, because the technical test will tell you things worth knowing. If you are a small, volunteer-run museum with simple IT and no grant conditions specifying Plus, the standard Cyber Essentials is a meaningful and achievable place to start.