Cyber Essentials vs Cyber Essentials Plus: What Businesses Should Know

What are the practical differences between the two certification routes?

The standard route involves an assessment against the scheme’s requirements. The Plus route adds independent technical verification of applicable controls; it should not be described merely as a more expensive badge.

A useful supplier brief should record the current environment, the people affected, the outcome expected and the decision owner. Ask providers to explain assumptions and exclusions in plain English, so differences between proposals are genuinely visible rather than concealed in different wording.

Does a customer contract or tender explicitly require the Plus level?

Read procurement wording carefully. Where a customer specifies Plus, standard certification alone may not satisfy that requirement. Confirm the exact version, scope and deadline rather than assuming a supplier’s marketing description is sufficient.

Directors should also agree how the chosen arrangement will be reviewed after implementation. Request documented service ownership, escalation contacts, management reporting and a process for making changes. These details often determine whether a promising technical solution remains useful to the business.

How should the business prepare its devices and cloud services for technical testing?

Inventory devices, supported software, administrator accounts, internet-facing services and security configuration. A practice review can expose issues before formal testing, particularly where different suppliers control different parts of the environment.

A useful supplier brief should record the current environment, the people affected, the outcome expected and the decision owner. Ask providers to explain assumptions and exclusions in plain English, so differences between proposals are genuinely visible rather than concealed in different wording.

Who coordinates the IT provider, certification body and internal management?

Agree who can supply technical evidence and who can make necessary configuration changes. Establish a realistic timeline around any remediation, retesting and the certification body’s available dates.

Directors should also agree how the chosen arrangement will be reviewed after implementation. Request documented service ownership, escalation contacts, management reporting and a process for making changes. These details often determine whether a promising technical solution remains useful to the business.

What should an SME compare when asking for certification support?

Ask whether the proposal includes scope review, configuration changes, assessment fees, assistance with failed checks and post-assessment documentation. Compare service responsibilities and not only the headline certification price.

A useful supplier brief should record the current environment, the people affected, the outcome expected and the decision owner. Ask providers to explain assumptions and exclusions in plain English, so differences between proposals are genuinely visible rather than concealed in different wording.

How can the controls be maintained after the assessment?

Certification represents a point-in-time assessment. Staff changes, new devices and cloud updates can alter the risk profile, so patching, access reviews and ongoing ownership still matter after a successful outcome.

Directors should also agree how the chosen arrangement will be reviewed after implementation. Request documented service ownership, escalation contacts, management reporting and a process for making changes. These details often determine whether a promising technical solution remains useful to the business.

A practical decision checklist for SME directors

Before approval, confirm the current problem, scope of work, relevant users and systems, expected service level and full contract commitment. Ask whether a site survey, security review or technical discovery exercise is needed. Keep a record of the assumptions used to compare providers and who is responsible for each follow-up action.

Check the transition plan, reporting arrangements, internal training needs and the evidence that will demonstrate success. Do not accept an unrealistic guaranteed outcome where the result depends on customer infrastructure or third-party services. Aim for a clear, achievable agreement that can be reviewed as the business changes.

For businesses reviewing their options, our Cyber Essentials guidance page explains the relevant services and how Supplier Synergy can help identify suitable third-party providers.

How Supplier Synergy can help

Supplier Synergy helps UK businesses understand their requirements for Cyber Essentials and Cyber Essentials Plus and identify suitable third-party providers. Our matching and advisory service is independent and supplier-funded, with no additional consultancy fee for the matching service. The selected supplier remains responsible for the services it contracts to deliver.

To get useful proposals, tell us what you are trying to achieve, the constraints you face and any important renewal or implementation dates. We can help you focus the comparison on business suitability, support and whole-term value rather than a single headline claim. Discuss your requirements or explore our business connectivity services and cyber security options.