// Verified Certification

CYBER ESSENTIALS
PLUS CERTIFICATION.

Most certification bodies audit what you submit on the day. We review your controls before the formal assessment begins - so gaps are fixed before the assessor starts, not after a failed result. Direct lead assessor throughout. Fixed pricing, IASME fee included.

Get Certified Today →See Pricing →
PRE-ASSESSMENT CHECK INCLUDEDINDEPENDENT AUDITNO ADD-ONSFROM £1,195 + VAT
100%
Remote Assessment
Pre-Audit
Check Included as Standard
Free
Rescan - No Extra Charge
Fixed
All-In Pricing, IASME Fee Included
// Why Choose Us

WHY VINCENT CYBER DEFENCE FOR CE PLUS?

// Pre-Audit

WE CHECK BEFORE WE AUDIT

Most certification bodies audit what you submit on the day. We review your controls against CE Plus requirements before the formal audit begins, so any gaps can be fixed before the assessor starts - not after a failed result. Included at no extra charge.

// Included

FREE RESCAN INCLUDED

If issues are found during the audit, one rescan to verify remediation is included in your fee. Most certification bodies charge extra for this. One price, no add-ons, no surprises.

// Your Assessor

DIRECT ASSESSOR, NO HANDOFFS

You deal with your Lead Assessor from first contact through to your CE Plus certificate. No helpdesk, no account managers, no rotating contacts. The person who audits your systems is the person who signs off your result.

Cyber Essentials Plus certification audit by Vincent Cyber Defence
// What Is CE Plus

CYBER ESSENTIALS PLUS EXPLAINED

Cyber Essentials Plus is the higher level of the Cyber Essentials scheme. While standard Cyber Essentials uses a self-assessment questionnaire, Plus requires an independent technical audit carried out by an approved assessor.

Our assessors remotely verify that your five security controls are correctly and effectively implemented - not just ticked on a form. For a full walkthrough of what happens on audit day, see our CE Plus audit guide.

Who Requires CE Plus?

  • MOD and central government supply chain contracts
  • Organisations handling classified or sensitive data
  • Enterprise clients requiring independent verification
  • Businesses seeking a higher level of cyber assurance
  • Organisations working toward Cyber Essentials Plus as a stepping stone to ISO 27001

CE vs CE Plus

  • Cyber Essentials: self-assessed questionnaire
  • Cyber Essentials Plus: independent technical verification -see our full comparison
  • Both: IASME-issued certificate, 12-month validity
  • Plus: higher assurance, preferred for enterprise and government

WHAT THE AUDIT COVERS

Our remote technical audit verifies all five Cyber Essentials controls are correctly implemented across your devices, systems and network.

Every CE Plus engagement includes a Pre-Assessment Check as standard - we review your controls against CE Plus requirements before the audit begins, so gaps are resolved before the assessment date, not during it. Most certification bodies skip this step.

  • DEVICE TESTING

    We test a sample of in-scope devices selected per OS type and build - including laptops, desktops and mobile - to verify configuration and patch status.

  • NETWORK SCANNING

    External vulnerability scanning of your internet-facing systems and boundary controls.

  • MALWARE SIMULATION

    Safe simulated malware testing to verify your protection is working correctly.

  • EVIDENCE REVIEW

    Review of configuration evidence and security policies to support questionnaire responses.

// Step by Step

YOUR CE PLUS JOURNEY

Seven clear steps from booking to certification.

1

BOOKING YOUR AUDIT

Complete our online enquiry form and we will schedule your assessment at a time that suits you.

2

VULNERABILITY SCANNING & PREPARATION

We will provide access to our secure cloud scanning agent, or work with your existing PCI-DSS approved scanner if you have one.

3

DOCUMENTATION

You will need to submit an up-to-date asset list and return an Audit Authorisation Form before the assessment begins.

4

PRE-ASSESSMENT CHECK

Before the audit begins, we review your controls against CE Plus requirements in full. Any gaps are identified and resolved with you ahead of the assessment date - so you go in prepared, not surprised.

5

DEVICE SAMPLING

Up to three days before audit day, we confirm the device sample - selected per OS type and build using IASME minimum sampling requirements, chosen by the auditor, not the client.

6

AUDIT DAY

Your auditor conducts internal and external vulnerability scans, email and download security tests, antivirus and mobile checks, and MFA verification - all via screen share. Use our readiness checklist to prepare.

7

AFTER YOUR AUDIT

It is normal to have a few outstanding actions after the live session. Your auditor will clearly outline what is needed, how to submit evidence, and the deadline for completion. Results are typically confirmed within 3-5 business days of the audit starting.

// Audit Readiness

CE PLUS READINESS CHECKLIST

The CE Plus audit is a hands-on technical test - not a questionnaire. Seven control areas are assessed live against your systems. Use our interactive checklist to confirm everything is in place before your assessment date.

Use our free interactive checklist - 25 items across all seven audit areas with a live progress score. Tick off each item as you confirm it is in place.

Open Checklist →
Important: If any of these areas are not in place before the audit, issues will be identified during the technical assessment. You have 30 days from the assessment start date to remediate - within the 90-day window from your CE basic certification date. Both windows run simultaneously, so there is very little margin for last-minute fixes.
// Transparent Pricing

HOW MUCH DOES CYBER ESSENTIALS PLUS COST?

All prices are fixed and include the IASME certification fee. No hidden charges. See our full CE Plus pricing guide → For the complete list of what is tested, see our CE Plus requirements guide →

Organisation SizeEmployeesPrice + VAT
Micro0-9 employees£1195
Small10-49 employees£1495
Medium50-249 employees£2195
Large250+ employees£3495

FREE CYBER LIABILITY INSURANCE - UP TO £25,000

UK organisations with annual turnover under £20m automatically receive free cyber liability insurance up to £25,000 with their Cyber Essentials certificate - which is included within your CE Plus engagement. No extra cost, no separate application.

// Bundle & Save

NEED CYBER ESSENTIALS FIRST? BUNDLE AND SAVE

Cyber Essentials is a mandatory prerequisite for CE Plus. If you need both, buy them together and receive a bundle saving discount off the combined price - the saving is applied automatically when you select both in the quote builder.

Get Certified - Bundle & Save →
// Included in CE Plus

PRE-ASSESSMENT CHECK INCLUDED

Before your formal CE Plus audit begins, we review your controls against CE Plus requirements, identify any gaps, and give you the opportunity to remediate - reducing the risk of a failed assessment. Included as standard with all CE Plus assessments at no additional charge.

// FAQ

COMMON QUESTIONS

// Getting Started
Yes - Cyber Essentials Plus builds on top of Cyber Essentials. You must hold a valid Cyber Essentials self-assessment before the Plus technical audit can take place. Once your CE basic certification is confirmed, you have 90 days (3 months) from that certification date to complete and pass CE Plus. If CE Plus is not passed within 90 days, the Plus application closes and you will need to re-certify at CE basic level before restarting - incurring an additional certification cost. In practice, both can be completed as part of the same engagement with us to keep the process as efficient as possible. How to choose a certification body →
Cyber Essentials is self-assessed - you complete a questionnaire that is reviewed by your Certification Body. Cyber Essentials Plus adds an independent technical audit where an approved assessor actively tests your systems to verify the controls are correctly implemented, not just documented. Plus provides a significantly higher level of assurance and is required for some government and enterprise contracts. Learn about standard CE →
CE Plus is typically required for MOD supply chain contracts involving sensitive or classified data, certain NHS and public sector frameworks, and enterprise clients requiring independent technical verification rather than self-assessment. If your contract tender specifies CE Plus or an independent technical audit, standard CE alone will not be sufficient. If you are unsure what your contract requires, our team can advise.
// The Audit
The scope is agreed upfront and aligns with IASME requirements. The assessor selects a sample based on each specific OS type and build (e.g. Windows 11 24H2, macOS Sequoia 15.4). The minimum sample size depends on how many devices share each OS version: 1 device = 1 sampled, 2-5 = 2, 6-19 = 3, 20-60 = 4, 61+ = 5. We will help define scope clearly with you before the assessment begins.
Yes - remote and hybrid workers are included where they form part of your operational environment. Their devices are treated as in-scope and may be selected as part of the device sample.
Yes - we regularly assess Azure and Microsoft 365 environments as part of Cyber Essentials Plus. Cloud environments are assessed for configuration, access controls, and MFA enforcement across in-scope services. What falls in scope will depend on how your environment is structured, and we will confirm this with you before the audit.
Yes - both internal and external vulnerability scanning are included as part of the CE Plus assessment. Internal scanning covers a sample of in-scope devices; external scanning covers your internet-facing systems and services. Both are conducted remotely by our IASME-approved assessors.
The CE Plus audit is a hands-on technical assessment conducted remotely by our IASME-approved assessors. It includes: external vulnerability scanning of your internet-facing systems, internal vulnerability scanning of a sample of in-scope devices selected per OS type and build, checks on email and web browser configuration, and active verification that controls such as patching, malware protection, and access control are correctly implemented - not just documented. The audit typically takes a few hours depending on the size and complexity of your environment.
The technical audit itself typically takes a few hours to a day depending on scope and environment size. Results are typically confirmed within 3-5 business days of the audit starting. Combined with the Cyber Essentials self-assessment that precedes it, the full CE Plus process usually takes one to three weeks. Bear in mind that once CE basic is certified, you have 90 days (3 months) to complete and pass CE Plus - so it is important not to let the process stall once you have started. If the 90-day window expires, you will need to re-certify at CE basic level before restarting. We work to your timeline and can accommodate urgent certification needs.
If the audit identifies controls that are not correctly implemented, you will receive specific, actionable feedback on what needs to change. You have 30 days from the date the CE Plus assessment started to remediate those issues and have the relevant checks revisited. This remediation window sits within the broader 90-day window from your CE basic certification date - so both constraints apply at the same time. If either window expires before you pass CE Plus, your Plus application closes and you will need to re-certify at CE basic level before restarting - which incurs an additional cost. Our team will support you through remediation as efficiently as possible to protect both windows. Read our guide to passing first time →
Under the Danzell (v3.3) standard, if vulnerabilities are found in your initial device sample, you are given a remediation window to address them across your entire estate. The assessor will then retest the original sample and select a second, new random sample to verify that patches have been applied consistently. If unresolved vulnerabilities are present in the second sample, the CE Plus assessment fails automatically. Importantly, this also triggers revocation of your underlying Cyber Essentials basic certificate - meaning you would need to re-certify at CE basic level before restarting the CE Plus process, incurring additional cost and delay. This is why we work with you before the audit to ensure patching is consistent across your entire estate - not just the devices you expect to be sampled. Our preparation process is specifically designed to avoid this outcome.
A Pre-Assessment Check is included as standard with all CE Plus assessments - there is no additional charge. Before your formal audit begins, we review your controls against CE Plus requirements, identify any gaps, and give you the opportunity to remediate - reducing the risk of a failed assessment.
// Certification & Beyond
Cyber Essentials Plus certificates are valid for 12 months from the date of certification. Annual renewal is required to maintain certified status, which is important for ongoing government contracts and supply chain requirements. We can help manage your renewal cycle to avoid any gaps in certification. See our CE renewal guide for the full process.
Yes - CE Plus establishes well-documented, independently verified security controls, which provides a strong foundation for an ISO 27001 implementation. ISO 27001 is considerably broader in scope, covering governance, risk management, and organisational policies as well as technical controls - but CE Plus ensures your core technical controls are verified and working before you tackle the full management system requirements.
When your CE Plus assessment passes you receive your official IASME-issued Cyber Essentials Plus certificate, a digital CE Plus badge you can display on your website, email signature, and tender submissions, and a public listing on the IASME register of certified organisations. Your underlying Cyber Essentials basic certificate is also confirmed as part of the engagement. UK-registered organisations with annual turnover under £20 million automatically receive free cyber liability insurance up to £25,000 - included at no additional cost for whole-organisation scope. Both certificates are valid for 12 months from the date of certification.
Yes. Cyber Essentials Plus is built on top of Cyber Essentials basic - you cannot achieve CE Plus without first holding a valid CE basic certificate. If you hold a current CE Plus certificate, the CE basic prerequisite for DCC Level 0 is already satisfied. You do not need a separate CE basic certificate. However, your CE Plus certificate must be current and cover the same scope as your intended DCC assessment - a scope misalignment between the two is an automatic DCC assessment failure.
Yes - renewal follows the same process as your initial CE Plus engagement: a fresh Cyber Essentials self-assessment followed by a technical audit. Renewal pricing is the same as the initial certification fee for your organisation size. One key difference: your current CE Plus certificate remains valid while the renewal is in progress, so there is no gap in certified status provided you start before your certificate expires. We recommend beginning the renewal process at least four to six weeks before your expiry date to allow time for the Pre-Assessment Check and any remediation. We can help manage your renewal cycle to avoid any disruption to ongoing contracts.
// Microsoft 365 & Intune
Yes - Microsoft 365 and Intune-managed environments are among the most common we assess, including within larger and multi-site organisations. We are familiar with how these platforms map to Cyber Essentials Plus requirements.
Yes - we are happy to clarify requirements and explain what Cyber Essentials expects from your Microsoft 365 environment as part of the assessment process. Where additional advisory support is needed - for example, reviewing your existing Intune configuration against CE requirements - this can be discussed. We do not implement controls on your behalf, as this would conflict with our independence as your Certification Body.
// Remediation & Reassessment
One free rescan is included in your CE Plus fee. If issues are identified during the technical audit, we include a single rescan to verify remediation at no additional charge. IASME timelines take precedence: the 30-day remediation window (from the date the assessment started) and the 90-day window (from your CE basic certification date) both apply simultaneously - whichever expires first is the binding deadline. We work proactively on preparation beforehand to minimise the need for a rescan in the first place.
If issues cannot be remediated within the 30-day window, or if the 90-day window from your CE basic certification date expires, a full reassessment would be required at an additional certification charge. We work with you in advance to minimise this risk, but it is important to be aware of both windows from the outset.
Yes. Cyber Essentials Plus is open to any organisation regardless of where it is registered or based. We have certified organisations based in the United States, Germany, the Netherlands, Ireland, Spain, and Italy who needed CE Plus to supply to UK government, NHS, or enterprise clients. Because the entire CE Plus audit is conducted remotely - external vulnerability scanning, internal device scanning, and email and browser configuration checks - your physical location is not a factor. Note that the free IASME cyber liability insurance applies to UK-registered organisations only; overseas companies receive the full CE Plus certificate and IASME public register listing.
Yes. If you purchase Cyber Essentials and Cyber Essentials Plus together as a bundle, a fixed saving is applied to the combined price - Micro: £1,439 + VAT (save £76), Small: £1,838 + VAT (save £97), Medium: £2,560 + VAT (save £135), Large: £3,890 + VAT (save £205). The saving is shown in the quote builder. It is the most cost-effective way to get fully certified if you need both certifications.

GOVERNMENT CYBER RESILIENCE PLEDGE SIGNATORY

Vincent Cyber Defence has signed the Government Cyber Resilience Pledge - including the commitment to require Cyber Essentials across our supply chain. View our signed declaration →

DIRECT LEAD ASSESSOR ACCESS

Every client works directly with a qualified lead assessor from first contact through to certification. No helpdesk, no handoffs, no rotating contacts - consistent, senior-level support throughout. This is a deliberate part of how Vincent Cyber Defence operates, not an afterthought.

// Client Reviews

WHAT OUR CLIENTS SAY

Client names are withheld in line with confidentiality requirements; character references are available upon request.

READY FOR CYBER ESSENTIALS PLUS?

Get independently verified. Talk to our UK-based team today - no jargon, no add-ons, no hard sell.

Start Your Certification →Standard CE InsteadSee Pricing →
// What Comes Next

BEYOND CE PLUS

CE Plus is independently verified certification. Here is where most organisations go next.

// Defence Supply Chain

DCC LEVEL 0

The MOD supply chain certification under DEFCON 658. If you hold CE Plus, the underlying CE basic prerequisite is already satisfied - DCC Level 0 is the natural next step for defence work.

Explore DCC Level 0 →// Independent Audit

PENETRATION TESTING

Many government and enterprise contracts require an annual pen test alongside CE Plus. CVSS-scored reports, free 30-day retest included as standard. From £1,499 + VAT.

Explore Pen Testing →// Ongoing Support

vCISO SUPPORT

CE Plus renewal managed for you each year, security policies maintained, and advisory support when a tender lands. A named security lead without the cost of a full-time hire. From £195/month + VAT.

Explore vCISO Plans →
// Blog & Guides

LATEST INSIGHTS

View All Articles →