Cyber Essentials Plus Certification

Cyber Essentials Plus cost starts from £3,000 for all organisations with up to 50 devices and a single site. The cyber essentials plus certification cost scales with infrastructure complexity: mid-sized organisations (50-250 devices, 2-3 sites) typically pay £2,500-£3,500, and large or complex environments (250+ devices, multiple sites, cloud infrastructure) range from £3,500-£5,000+. Pricing factors include: number of IP addresses scanned, total device count, geographical distribution, and whether pre-assessment gap analysis is required. Annual recertification is typically 20-30% less than initial certification. We provide fixed-price quotes following a brief scoping call, no hidden assessor fees.

Cyber Essentials (basic or Plus) is mandatory for all UK central government contracts involving the handling of sensitive information or ICT services. Cyber Essentials Plus, which adds an independent technical audit, is specifically required for contracts above £5 million. Many local authorities, NHS trusts, and Ministry of Defence contractors specify Cyber Essentials Plus regardless of contract value. If you are unsure which level your contract requires, the safest approach is to contact the procuring body directly or assume Plus is required: the additional assurance is recognised across the full government supply chain.

Yes. Cyber Essentials Plus must be completed within three months of your Cyber Essentials assessment. You cannot complete CE Plus on a certificate that is more than three months old. If your basic Cyber Essentials certificate is current, we can move directly to the technical audit phase. If it has lapsed, you will need to complete a new Cyber Essentials self-assessment before proceeding to CE Plus. We can run both assessments consecutively to minimise the time between certifications.

The Cyber Essentials Plus audit is an independent technical assessment performed by an IASME-accredited assessor. It covers five areas: external vulnerability scanning of internet-facing systems, internal configuration review of devices and operating systems, verification of access controls and administrative privilege separation, confirmation that anti-malware protection is deployed and updated, and patch compliance checking against the 14-day critical vulnerability window. The audit is performed on a representative sample of devices, not every device in the organisation, following the NCSC-approved test specification.

The most effective preparation for a Cyber Essentials Plus audit is a pre-assessment gap analysis, where an assessor reviews your current controls against the five NCSC requirements and identifies deficiencies before the formal audit begins. Key preparation steps include: ensuring all critical patches are applied within 14 days of release, reviewing firewall rules to remove unnecessary inbound access, implementing multi-factor authentication for cloud services, separating administrative accounts from standard user accounts, and confirming that anti-malware is deployed on all in-scope devices. We include pre-assessment gap analysis in our standard CE Plus service to maximise first-time pass rates.

Cyber Essentials is a self-assessment certification where you complete a questionnaire about your security controls, verified by an assessor reviewing your answers. Cyber Essentials Plus includes everything in Cyber Essentials plus an independent external technical audit: our assessors perform hands-on vulnerability scanning, internal configuration reviews, and physical verification of security controls. Cyber Essentials Plus provides stronger assurance and is required for UK government contracts over £5 million.

The technical audit typically takes 1-2 days depending on your infrastructure scope. The full certification process from initial scoping call to certificate issuance takes 2-4 weeks. Most organisations with a clean infrastructure receive their certificate within three weeks of engagement. We offer expedited certification for urgent government contract deadlines.

Cyber Essentials Plus certificates are valid for 12 months from the issue date. You must recertify annually to maintain your certification status and remain eligible for government contracts. The certification scope must be reassessed if you make significant infrastructure changes (new offices, cloud migrations, major IT system changes) as these may introduce new vulnerabilities or expand your attack surface.

The five controls are: (1) Boundary firewalls and internet gateways: protecting network perimeter from internet threats. (2) Secure configuration: hardening operating systems and removing unnecessary functionality. (3) Access control: user authentication, password policies, and administrative privilege management. (4) Malware protection: anti-virus/anti-malware on all devices with regular updates. (5) Patch management: keeping all systems and software up-to-date with security patches applied within 14 days for critical vulnerabilities.

If critical vulnerabilities or control deficiencies are identified, certification is withheld pending remediation. We provide a detailed remediation report listing all identified issues, their severity, and specific fix actions. Common failure reasons include: missing critical patches, weak password policies, inadequate firewall rules, missing anti-malware, or excessive administrative privileges. Once you remediate the issues, we perform targeted re-testing at no additional cost within 90 days to validate fixes before issuing the certificate.