Cyber Essentials or Cyber Essentials Plus?
Quick answer: Both levels cover the exact same five technical controls. Basic Cyber Essentials is a verified self-assessment signed by a director, whereas Cyber Essentials Plus adds a hands-on technical audit of a sample of your devices and an external vulnerability scan within 3 months (90 days) of passing Basic. Under the April 2026 Danzell rules, failing a Plus patching retest revokes your basic certificate too.
Last reviewed 2 November 2026 against the Cyber Essentials requirements v3.3 (Danzell question set).
Side-by-side comparison: Cyber Essentials vs Cyber Essentials Plus
| Feature | Cyber Essentials (Basic) | Cyber Essentials Plus (CE+) |
|---|---|---|
| Technical controls required | The five controls (v3.3) | The exact same five controls (v3.3) |
| How it is assessed | Verified self-assessment questionnaire signed by a board member or director | Basic self-assessment plus a hands-on technical audit by an independent assessor |
| What the assessor tests | Reviews your written answers, scope and network descriptions | External IP scan, authenticated vulnerability scan of sampled devices, MFA check, and simulated malware/email/web tests |
| Completion window | Within 6 months of opening the assessment account | Must be completed within 3 months (90 days) of your Basic certificate issue date (IASME FAQ) |
| Official certification fee | £320 to £600 + VAT (IASME published fee by employee count in scope) | Basic fee + Certification Body audit fee (quoted according to device, OS and location count) |
| Typical time to complete | 1 to 3 weeks once gaps are fixed | 2 to 6 weeks (Basic first, then booked audit day) |
| Who usually asks for it | Most insurers, SME supply chains, standard public tenders, MOD DCC Level 0 & Level 1 | Higher-risk central government/NHS contracts, MOD DCC Level 2 & Level 3, financial/legal panels |
What happens during a Cyber Essentials Plus technical audit?
You must pass Basic Cyber Essentials first. Then, within 90 days (3 months), the Certification Body’s auditor tests a representative sample of each device type and operating system in your scope:
- Authenticated vulnerability and patch scan: The auditor scans sampled laptops, desktops, servers and mobile devices to check that every operating system and third-party application is supported and has no critical or high-risk vulnerabilities (CVSS v3 7.0+) older than 14 days.
- External boundary scan: Scans your office public IP addresses for open ports and unpatched firewall interfaces.
- Malware and web protection test: Sends harmless test files (such as EICAR test files) by email and attempts to download them in a browser on sampled devices to verify that your anti-malware and web filter block them.
- Account separation and MFA check: Verifies on screen that users are not running as local admins and that MFA prompts trigger on cloud services.
The three April 2026 Danzell changes that make Plus much stricter
In its April 2026 scheme update, IASME closed three loopholes in Cyber Essentials Plus:
- 1. Retesting now includes a fresh random sample: Previously, if two laptops failed the patching scan, some firms patched only those two laptops for the retest. Now, if your initial sample fails the update check, the auditor retests the original sample plus a brand-new random sample of devices to prove you patched your whole fleet.
- 2. A second failure revokes your Basic certificate: If you fail that retest, you don’t just fail Plus — your existing Basic Cyber Essentials certificate is revoked.
- 3. No changing your self-assessment answers once Plus starts: Your verified self-assessment must be finalised before Plus testing begins and cannot be edited afterwards to match what the auditor finds.
Check if your systems would pass Basic and Plus in the Auto-fail checker
Answer 25 quick questions to see whether any of the April 2026 Danzell rules would fail your assessment outright, with the exact fix for each.
Check if you'd auto-fail in 10 minutes →