The Short Answer
Cyber Essentials Plus is a UK government-backed cybersecurity certification that proves your business has implemented five basic technical controls to protect against the most common cyber attacks. It differs from basic Cyber Essentials by including an independent technical audit — a certified assessor tests your systems rather than just reviewing your self-assessment. For London SMEs, it matters because it is increasingly required to win government contracts, NHS contracts, and supply chain work with larger organisations. Certification typically costs between £1,500 and £3,000 and takes two to six weeks to achieve.
Cyber Essentials Plus is becoming a prerequisite for doing business in the UK. If you want to bid for government contracts, work with the NHS, or supply larger companies in regulated industries, you need it. This guide explains what it is, what it costs, and how to get certified.
What Is Cyber Essentials Plus?
Cyber Essentials is a UK government scheme run by the National Cyber Security Centre (NCSC). It defines five technical controls that protect against the most common cyber attacks:
- Firewalls — Properly configured boundary firewalls to prevent unauthorised access.
- Secure configuration — Devices and software configured securely by default.
- User access control — Administrative accounts restricted and managed properly.
- Malware protection — Anti-malware software installed and kept up to date.
- Security update management — Software and operating systems patched within 14 days of updates being released.
There are two levels of certification:
- Cyber Essentials — A self-assessment questionnaire reviewed by a certifying body. Costs around £300–£500.
- Cyber Essentials Plus — The same five controls, but verified by an independent technical audit where an assessor tests your systems in person. Costs £1,500–£3,000.
Why Does Cyber Essentials Plus Matter for London SMEs?
1. It Is Required for Government Contracts
Since 2014, Cyber Essentials has been mandatory for any business bidding for UK government contracts that involve handling personal data or providing certain ICT products and services. Cyber Essentials Plus is required for more sensitive contracts, and the threshold is rising.
2. Larger Companies Demand It in Their Supply Chains
Large enterprises and public sector organisations increasingly require their suppliers to hold Cyber Essentials Plus certification. If you want to work with the NHS, local councils, or major corporates, certification is often a non-negotiable part of the procurement process.
3. It Reduces Your Insurance Premiums
Many cyber insurance providers offer reduced premiums to businesses with Cyber Essentials Plus certification, because the five controls significantly reduce the risk of a successful attack. Some insurers require it before offering coverage at all.
4. It Signals Trust to Your Clients
Displaying the Cyber Essentials Plus badge on your website and proposals signals to clients that you take cybersecurity seriously. In competitive tenders, it can be the difference between winning and losing.
What Does the Audit Involve?
The Cyber Essentials Plus audit is a hands-on technical assessment. A certified assessor visits your premises (or conducts a remote assessment) and tests:
- Firewall configuration — They verify your firewall rules and test for open ports.
- Device configuration — They check sample devices for secure settings, including password policies and default account removal.
- Access controls — They review who has administrative access and how it is managed.
- Malware protection — They verify anti-malware is installed, active, and updated on all devices.
- Patch management — They check that operating systems and applications are patched within the required 14-day window.
The assessor also conducts internal and external vulnerability scans to identify weaknesses. If your systems pass, you receive certification valid for 12 months.
How to Get Certified: The Step-by-Step Process
- Assess your current posture — Review your systems against the five controls. Identify gaps before you engage an assessor.
- Close the gaps — Implement any missing controls: configure firewalls, update patching processes, restrict admin access, install malware protection.
- Complete Cyber Essentials (basic) — You must hold the basic certification before applying for Plus. This is a self-assessment questionnaire.
- Book your Plus audit — Engage a certified assessor. They will schedule the technical audit within a few weeks.
- Pass the audit — The assessor tests your systems. If you pass, you receive your certificate. If you fail, you get a report of what to fix and can re-test.
- Renew annually — Certification lasts 12 months. Schedule your renewal before expiry to maintain continuous certification.
How Much Does It Cost?
- Cyber Essentials (basic): £300–£500
- Cyber Essentials Plus: £1,500–£3,000 (including the basic certification)
- Remediation work (if needed): £500–£5,000 depending on your current posture
- Annual renewal: Same as initial certification
For most London SMEs, the total cost of achieving certification — including any remediation work — is between £2,000 and £5,000.
Frequently Asked Questions
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Cyber Essentials is a self-assessment questionnaire where you declare your systems meet the five controls. Cyber Essentials Plus includes an independent technical audit where a certified assessor physically tests your systems. Plus is more rigorous and more widely trusted by large organisations and government.
How long does Cyber Essentials Plus certification take?
Most businesses achieve certification in two to six weeks. If your systems already meet the five controls, the process is fast. If you need remediation work, it may take longer. The audit itself is typically completed in one to two days.
How much does Cyber Essentials Plus cost?
Cyber Essentials Plus typically costs between £1,500 and £3,000, including the basic Cyber Essentials self-assessment. If your systems need remediation work before the audit, budget an additional £500–£5,000 depending on the gaps.
Is Cyber Essentials Plus mandatory for UK businesses?
It is mandatory for businesses bidding for certain UK government contracts. It is also increasingly required by large organisations in their supply chains. Even where it is not mandatory, it is strongly recommended as a baseline cybersecurity standard.
How long does Cyber Essentials Plus certification last?
Cyber Essentials Plus certification is valid for 12 months. You must renew annually to maintain certification. Most businesses schedule their renewal audit a month before expiry to ensure continuous coverage.
