Cyber Essentials vs CE Plus: Which Do You Need? | 2026

THE KEY DIFFERENCE IN ONE SENTENCE

Cyber Essentials is self-assessed - you answer a questionnaire. Cyber Essentials Plus is independently verified - a qualified assessor checks that your controls are actually working.

CYBER ESSENTIALS: SELF-ASSESSMENT

Standard Cyber Essentials uses an online questionnaire. You answer questions about how your organisation addresses each of the five core controls - firewalls, secure configuration, access control, malware protection, and patch management.

An IASME Approved Certification Body reviews your answers and, if everything is in order, issues your certificate. The assessment is remote and can be completed quickly. Use our CE readiness checklist to verify your controls before you submit.

• Who conducts it: You complete the questionnaire; an approved assessor reviews it
• Evidence required: Written responses about your controls
• Technical verification: No independent technical testing
• Certificate validity: 12 months
• Best for: SMEs, first-time certification, commercial supply chain requirements

CYBER ESSENTIALS PLUS: INDEPENDENT VERIFICATION

Cyber Essentials Plus adds an independent technical audit on top of the self-assessment. An IASME-approved assessor remotely tests your systems to verify that the controls you described in your questionnaire are correctly and effectively implemented in practice.

This includes testing sample devices, scanning for vulnerabilities, and checking that your malware protection is functioning correctly. If you are considering Plus, use the CE Plus readiness checklist to see exactly what the audit covers before you commit.

• Who conducts it: IASME Approved Certification Body (independent)
• Evidence required: Questionnaire plus technical verification
• Technical verification: Yes - remote audit of your systems
• Certificate validity: 12 months
• Best for: Government contracts, enterprise supply chains, higher assurance needs

WHICH LEVEL DO YOU NEED?

The right level depends on your circumstances:

• You need standard CE if: your contract or client requires Cyber Essentials certification without specifying Plus, or if you are certifying for the first time
• You need CE Plus if: your government contract specifies Plus, your enterprise client requires independently verified assurance, or you are working toward higher maturity certifications. See our CE Plus service for what the process involves
• You need both if: Plus includes the self-assessment as a first step - so achieving Plus means you also hold standard CE

CAN YOU DO PLUS WITHOUT DOING CE FIRST?

You do not need to have done CE with another provider before coming to us - we handle both in a single engagement. However, CE basic must be certified before the Plus audit can begin: you complete the self-assessment questionnaire, receive your CE certificate, and then the technical audit follows. In practice, the two stages run back-to-back with minimal delay.

TIME LIMITS FOR CE PLUS

Two important windows apply to the CE Plus process. Once Cyber Essentials basic is certified, you have 90 days (3 months) from that certification date to complete and pass CE Plus. If issues are identified during the CE Plus audit, you also have 30 days from the date the assessment started to remediate and have checks revisited. Both windows run simultaneously - whichever expires first governs. If either closes before CE Plus is passed, your Plus application closes and you must re-certify at CE basic level before restarting the Plus process, at additional cost. Starting the process promptly and going into the audit well-prepared are the best ways to avoid this. Our CE Plus readiness checklist covers everything you need to verify before the audit begins.

HOW LONG DOES EACH TAKE?

Once your controls are ready, Cyber Essentials moves quickly. After submission, assessments are typically completed within 1-2 business days. Cyber Essentials Plus results are typically confirmed within 3-5 business days of the audit starting. Both timelines assume controls are in place - organisations needing to address gaps first may take longer.

COST DIFFERENCE

Cyber Essentials Plus involves more assessor time due to the independent technical audit, so it costs more than standard Cyber Essentials. Pricing by organisation size:

All prices include the IASME certification fee. CE certification also includes free cyber liability insurance up to £25,000 for eligible UK organisations. See our pricing page for full details.

HOW VINCENT CYBER DEFENCE SUPPORTS YOUR CERTIFICATION

Whichever level you need, the process at Vincent Cyber Defence is designed to get you certified first time - with no surprises on assessment day.

• Pre-submission gap check included as standard - before your assessment is formally submitted, we review your controls against every requirement. For CE Plus, this is a full Pre-Assessment Check covering all five controls before the technical audit begins. Gaps are identified and resolved with you ahead of time.
• Guided questionnaire submission - we walk you through the CE self-assessment questionnaire, explaining each requirement and reviewing your responses. You complete and sign the declaration yourself, but you are not left to figure it out alone.
• Direct lead assessor throughout - you deal with one named assessor from first contact through to your certificate. No helpdesk, no account managers, no rotating contacts.
• Free rescan included (CE Plus) - if issues are found during the Plus audit, one rescan to verify remediation is included at no extra charge.
• Bundle and save - if you need both CE and CE Plus, our bundle pricing covers both certifications in a single engagement at a reduced combined price. We manage the 90-day window for you.