Question 1

What is Cyber Essentials Plus?

Accepted Answer

Cyber Essentials Plus is the advanced tier of the UK government's Cyber Essentials certification scheme. It includes all Cyber Essentials requirements plus an independent technical audit where a certified assessor tests your systems to verify the controls are properly implemented. The assessor attempts to breach your network, send phishing emails, and exploit common vulnerabilities.

Question 2

What is the difference between Cyber Essentials and Cyber Essentials Plus?

Accepted Answer

Cyber Essentials is a self-assessment where you complete a questionnaire about your security controls. Cyber Essentials Plus adds an independent technical audit where a certified assessor visits your premises and tests your systems. Cyber Essentials Plus provides independent verification that your controls actually work, not just that you say they do.

Question 3

How much does Cyber Essentials Plus cost?

Accepted Answer

Cyber Essentials Plus audit costs approximately £1,200–£2,500, depending on organisation size and complexity. This is in addition to the Cyber Essentials self-assessment (£300–£500). If remediation work is needed, budget an additional £500–£5,000. Our consultancy and support costs £500–£2,000.

Question 4

How long does it take to get Cyber Essentials Plus certified?

Accepted Answer

Most businesses achieve Cyber Essentials Plus certification within 4–8 weeks. First, you complete the Cyber Essentials self-assessment (1–2 weeks). Then, the independent audit is scheduled and conducted (2–4 weeks). If remediation work is needed before the audit, allow additional time.

Question 5

What does the Cyber Essentials Plus audit involve?

Accepted Answer

The assessor visits your premises and tests your systems — attempting to breach your network from outside, sending phishing emails to your staff, checking for unpatched vulnerabilities, attempting to access systems with unauthorised credentials, and verifying that endpoint protection detects and blocks malware. The audit typically takes 1–2 days depending on organisation size.

Question 6

Do we need Cyber Essentials Plus for government contracts?

Accepted Answer

Cyber Essentials Plus is required for many UK government contracts, especially those involving sensitive data, personal information, or higher value. The UK government requires Cyber Essentials as a minimum, and Cyber Essentials Plus for certain contract types. Check the specific requirements of the contracts you're bidding for.

Question 7

What happens if we fail the Cyber Essentials Plus audit?

Accepted Answer

If you fail the audit, the assessor provides a report identifying the issues. You then have a period to fix the issues and undergo a re-test. We help you address any findings quickly and efficiently, ensuring you pass the re-test. Most failures are due to minor issues that can be fixed within a few days.

Question 8

Can you help us prepare for the Cyber Essentials Plus audit?

Accepted Answer

Yes. We conduct a gap assessment to identify what needs to be fixed, implement the remediation work, test your controls internally, and prepare you for the audit. We ensure all five controls are properly implemented and that you can demonstrate this to the assessor. Most of our clients pass the audit first time.

Question 9

How often do we need to renew Cyber Essentials Plus?

Accepted Answer

Cyber Essentials Plus certification is valid for 12 months and must be renewed annually. This involves repeating both the self-assessment and the independent audit. We provide annual renewal support, including reviewing your controls, updating documentation, and managing the re-assessment and re-audit process.

Question 10

Is Cyber Essentials Plus worth it if we already have Cyber Essentials?

Accepted Answer

Yes, for most businesses. Cyber Essentials Plus provides independent verification that your controls actually work — identifying real security gaps that self-assessment might miss. It's increasingly required for contracts and provides stronger assurance to clients and partners. If you handle sensitive data or bid for government contracts, Cyber Essentials Plus is worth the investment.

Question 11

What are the most common reasons for failing the audit?

Accepted Answer

Common reasons include unpatched software or operating systems, missing or inadequate endpoint protection, multi-factor authentication not enabled for all accounts, weak firewall rules, and insufficient access controls. We identify and fix these issues before the audit, ensuring you pass first time.

Question 12

Can you help with remediation work before the audit?

Accepted Answer

Yes. We conduct a gap assessment to identify what needs to be fixed, then implement the remediation work — configuring firewalls, securing systems, implementing access controls, deploying malware protection, setting up patch management, and enabling multi-factor authentication. We ensure all five controls are properly implemented before the audit.

Cyber Essentials Plus Certification

Understanding Cyber Essentials Plus Certification

The business impact

Who needs this?

Who doesn't need this?

The technical overview

Related technologies

What affects the cost?

Expert recommendations

Industries that benefit

Need help with cyber essentials plus certification?