I mark Cyber Essentials assessments and carry out Cyber Essentials Plus testing, so this is the question I'm asked most. The short answer: if someone else has told you which one they need, that's your answer. If nobody has, start with Cyber Essentials and plan to step up.

The same 5 controls

Both certifications assess the same 5 technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Get those right and you stop the large majority of commodity attacks. Neither certification covers governance, policy or people; that's what IASME Cyber Assurance is for.

Cyber Essentials: verified self-assessment

You answer a set of questions about your systems, a board member signs to say they're true, and an assessor like me marks them. It's fast, it's affordable, and it's the minimum for most central government contracts. It also comes with cyber liability insurance for UK organisations under £20 million turnover that certify their whole organisation.

Cyber Essentials Plus: we check

Plus takes your Cyber Essentials answers and tests them. We scan a sample of your devices and servers for missing patches and weak configuration, test whether malware and malicious email get through, and verify your cloud accounts. If something fails you have 21 days to fix it. It's the level primes, insurers and an increasing number of tenders ask for, and every DCC level above 1 requires it.

How to decide

  • Bidding for defence or government work: check the contract. Cyber Essentials is the floor; Plus is increasingly the expectation.
  • Your insurer or a big customer has asked: they'll say which. It's usually Plus.
  • Nobody has asked yet: get Cyber Essentials now, use the year to tidy up, and go for Plus at renewal.

Whichever you choose, prepare first. A gap review and a pre-assessment scan turn a nervous certification into a formality, which is why every organisation CRIBB has guided through the process has passed. If you'd like to talk it through, get in touch, or read more about the certifications we deliver.