Do you do the work, or just assess us?

We do the work. Foresight runs the gap analysis, carries out hands-on remediation, prepares the evidence and liaises with the assessor, so you pass first time rather than paying to re-sit a failed audit.

How much does Cyber Essentials cost?

The IASME assessment fee is tiered by size from around £320 + VAT and includes £25,000 cyber liability insurance for eligible UK businesses. Cyber Essentials Plus is scoped to your estate, typically from around £1,380 + VAT.

Cyber Explained

Cyber Essentials vs Cyber Essentials Plus: what’s the difference?

Q: What's the difference between Cyber Essentials and Cyber Essentials Plus?

Cyber Essentials is a verified self-assessment against five security controls. Cyber Essentials Plus tests the same controls with a hands-on technical audit by a licensed assessor. You must hold Cyber Essentials before doing Plus.

Both prove you’ve got the security basics in place — the difference is how rigorously that’s checked. Here’s which one you need.

Get certified Call 0161 738 1399

Greater Manchester & UK-wide · free, no-obligation advice

Why Foresight

Cyber Essentials Plus certified
Supporting 130+ organisations since 2006
We reply within one working hour
Plain-English, no jargon

Quick answer

Both certifications cover the same five core security controls — the difference is how they’re verified. Cyber Essentials is a self-assessment: you complete a questionnaire, which is reviewed and certified. Cyber Essentials Plus includes everything in Cyber Essentials plus a hands-on technical audit by an external assessor, who independently tests your systems. CE Plus is more rigorous and more credible — and is often required for larger contracts and some public-sector, NHS or supply-chain work.

Side by side

The key difference

	Cyber Essentials	Cyber Essentials Plus
How it’s verified	Self-assessment questionnaire, reviewed and certified	Self-assessment PLUS a hands-on technical audit
External assessor tests your systems?	No	Yes
Rigour / credibility	Good — the recognised baseline	Higher — independently tested
Often required for	Most SME needs, supplier baselines	Larger contracts, public sector, NHS, higher-assurance work
Cost	Lower	Higher (includes the audit)

The five controls

What both cover

Both certifications check the same five basics: firewalls, secure configuration, user access control, malware protection, and security update management (patching). Get those right and you’re protected against the vast majority of common attacks.

Which do you need?

A simple steer

If you just need to demonstrate the baseline — for most SMEs and many supplier requirements — Cyber Essentials is enough. If a contract, framework or sector (public sector, NHS, defence supply chains) asks for independently tested assurance, you’ll need Cyber Essentials Plus. Many organisations do CE first, then CE Plus. We handle the heavy lifting for both — see Cyber Essentials, and note the 2026 rules now bring AI tools into scope (AI & Cyber Essentials).

FAQs

Common questions

What’s the difference between Cyber Essentials and Cyber Essentials Plus?

Both cover the same five controls. Cyber Essentials is a reviewed self-assessment; Cyber Essentials Plus adds a hands-on technical audit by an external assessor who independently tests your systems.

Is Cyber Essentials Plus worth it?

If a contract or sector requires independently verified assurance — common in public sector, NHS and supply chains — then yes. Otherwise standard Cyber Essentials is often enough to demonstrate the baseline.

Do I need Cyber Essentials Plus for government or NHS work?

Often, yes. Many public-sector, NHS and higher-assurance contracts specifically require Cyber Essentials Plus rather than standard Cyber Essentials.

Can I get Cyber Essentials first and Plus later?

Yes — that’s a common path. Achieve Cyber Essentials, then add the Plus audit when you need the higher level of assurance.

What do the certifications actually check?

The same five controls: firewalls, secure configuration, user access control, malware protection, and patching — the basics that stop most common attacks.

Not sure which you need?

We’ll advise CE or CE Plus and do the heavy lifting so you pass first time.

Get certified Call 0161 738 1399