Cyber Essentials vs Cyber Essentials Plus

Understand the purpose

The scheme gives businesses a defined starting point for technical security controls. It can help an owner discuss security with staff, clients and insurers using a recognised framework. It does not promise that a business will never be attacked or that every legal and contractual requirement has been met.

Before choosing a level, find out what the client, tender or insurer actually asks for. A requirement for Plus should not be answered with a standard certificate, and a supplier questionnaire may ask about controls beyond either assessment. Keep the evidence accurate and current.

The five controls apply in practice

Firewalls control network connections. Secure configuration removes unsafe defaults and unnecessary access. Security update management keeps supported software updated. User access control limits permissions to what people need. Malware protection helps prevent malicious software affecting devices.

These controls involve actual settings and working habits. Buying a product is not the same as demonstrating that every device in scope uses it correctly. Unsupported applications, forgotten accounts and equipment outside the usual office can complicate preparation, so list them early.

What technical testing changes

Plus adds testing to the assessment process. That means your preparation should be based on working controls rather than answers that sound reasonable on a form. Staff availability, device access and the chosen scope need to be coordinated with the certification partner.

Current requirements and assessment arrangements should be confirmed with that partner. Do not assume a previous year's questionnaire, scope or device list is still suitable. Tell the partner about important changes in working patterns or systems before the assessment is arranged.

Our role is preparation and support

Cloud Smart is Cyber Essentials certified, but we are not a certification body and hold no ISO certification. We help review the controls, explain gaps, coordinate agreed improvements and manage the application with our certification partner. The partner handles assessment and certification.

We have guided clients through Cyber Essentials and Cyber Essentials Plus. Jo Martin's review on our service page describes Sean's guidance through the process. We preserve that review as written rather than turning it into a guarantee about another business's result or timetable.

Agree the scope and commercial details

Start with the users, locations, cloud services and devices the business relies on. Identify who can approve changes and which suppliers need to be involved. Agree a realistic sequence for improvements, especially where software compatibility or staff access could be affected.

Our published support starting point is £95 per month. A written quote should explain preparation, assessment costs, term and any separately approved remedial work. We do not claim that every possible fee or improvement is included in that starting figure.

After certification, continue maintaining the controls. New starters, leavers, devices and application changes can affect the position you originally assessed. Treat the certificate as evidence of a defined assessment, and keep your day-to-day security responsibilities clear. Call us to discuss the scope your business needs before booking an assessment.

Before you decide

Keep evidence somewhere the authorised business contact can find it. Record the assessment scope and the person responsible for each ongoing control. When a device, supplier or working location changes, ask whether the change affects your documented position rather than waiting until the next application to discover an omission.

Free tools to help you prepare

• Cyber Essentials readiness check