Charities delivering government-commissioned services are increasingly required to hold Cyber Essentials Plus, not just standard CE. As an IASME Approved Certification Body, we provide the independent technical audit your contract or commissioner demands. Pre-Assessment Check included as standard. Fixed pricing, IASME fee included.
Standard Cyber Essentials is the NCSC's recommended baseline for charities and is what most grant funders and commissioners accept. Cyber Essentials Plus - which adds an independent technical audit on top of the self-assessment - becomes relevant in specific circumstances where a higher level of verified assurance is required.
If your charity delivers services under a contract with a central government department, executive agency, non-departmental public body, or NHS body, Procurement Policy Note 014 (PPN 014) may apply. PPN 014 requires CE or CE Plus for in-scope contracts - buyers set the level per procurement. Some commissioning bodies require CE Plus rather than standard CE, particularly for contracts involving sensitive personal data or higher-risk service delivery.
In an IASME case study, Black Country Women's Aid, a domestic abuse charity, obtained CE Plus because their Ministry of Justice and Home Office contracts required it.
NHS bodies are covered by PPN 014. Charities delivering NHS-commissioned services may additionally be required to satisfy DTAC (Digital Technology Assessment Criteria) where the NHS body applies it. DTAC's C3.1 requires a Cyber Essentials certificate as baseline technical security evidence. The level required - CE or CE Plus - is set by the commissioning NHS body per procurement.
Charities holding sensitive personal data - safeguarding records, health information, financial records relating to vulnerable individuals - have a UK GDPR Article 32 obligation to implement appropriate technical security measures. CE Plus provides independently verified evidence of core technical controls, which can be relevant when demonstrating to the ICO, commissioners, or major donors that appropriate security is in place.
The right answer depends on your situation:
Not sure which applies? Ask our team →
Standard Cyber Essentials is the prerequisite for CE Plus. If your charity needs both, we can manage them as a single engagement - CE self-assessment first, then the CE Plus technical audit follows directly. CE for Charities →
Charities often have limited IT resource and a contract deadline driving certification. We include a Pre-Assessment Check before the formal audit begins - so any gaps are identified and resolved before the assessor starts, not after a failed result that could delay your contract or funding.
We work with organisations delivering government-commissioned services and understand how PPN 014 procurement requirements translate into practice. We can advise on whether CE or CE Plus is appropriate for your specific contract before you commit.
You work directly with your Lead Assessor from first contact through to your CE Plus certificate. No helpdesk, no rotating contacts. When your commissioner asks for a certification update before a contract renewal, you get a direct answer.
Four clear steps from enquiry to certification. Pre-Assessment Check included as standard - we identify any gaps before the formal audit begins.
Before the audit starts, we review your controls against CE Plus requirements in full. Any gaps are identified and resolved before the formal assessment begins - reducing the risk of issues on assessment day.
We confirm your assessment scope and asset list. You return an Audit Authorisation Form. Our assessor checks the scope is consistent with your Cyber Essentials certificate boundary before proceeding. Any partial scope exclusions require written justification; all legal entities within scope must be listed with name, registered address, and company number.
Remote vulnerability scanning, internal device sampling, and email and browser configuration checks - all conducted via screen share. No on-site visits required. Practical for charities with limited IT staff and no dedicated on-site resource.
Your CE Plus certificate is issued by IASME, published on the public register, and emailed directly to you. Valid for 12 months - annual renewal required to maintain a current certificate for ongoing contract compliance. Commissioners and procurement teams can verify it instantly on the IASME registry.
All prices are fixed and include the IASME certification fee. No hidden charges. See our full CE Plus pricing guide →
Cyber Essentials is a mandatory prerequisite for CE Plus. If you need both, buy them together and receive a bundle saving off the combined price. See bundle pricing →
CE Plus covers the same five technical control areas as standard Cyber Essentials - but verified through an independent technical audit rather than self-assessment:
The entire audit is conducted remotely via screen share. No on-site visits are required.
Cloud services your charity uses - Microsoft 365, Google Workspace, Salesforce, online case management systems - are in scope for the audit. The audit covers your configuration, access controls, and admin accounts on these platforms. The cloud provider's own underlying infrastructure is outside scope under the shared responsibility model; your configuration, access controls, and admin accounts are in scope.
Social media admin accounts (Facebook, LinkedIn, X/Twitter) used to manage your charity's pages are also in scope where they are accessible from in-scope devices. MFA must be enabled on each account where the platform offers it. Shared logins - multiple staff or volunteers using a single admin account - do not meet CE's access control requirement; each user needs their own account.
If you are unsure whether a specific system is in scope for your assessment, our team can advise before you begin.
Get independently certified for your government or NHS contract. Talk to our UK-based team today. Direct contact, fixed price, IASME approved.
The NCSC-recommended baseline for charities. Self-assessed certification for firewalls, secure configuration, access control, malware protection, and patching. From £320 + VAT.
CE for Charities →// Bundle SavingNeed both Cyber Essentials and CE Plus? Buy them together as a single engagement and receive a bundle saving off the combined price. IASME fee included.
See Bundle Pricing →// Beyond CertificationSome government and NHS contracts require an annual pen test alongside CE Plus. CVSS-scored reports, free 30-day retest included as standard. From £1,499 + VAT.
Pen Testing →Client names are withheld in line with confidentiality requirements; character references are available upon request.