Secordit home
Contact

What is Cyber Essentials Plus?

Cyber Essentials Plus is the independently tested level of the government-backed Cyber Essentials scheme. It assesses the same five technical controls as the first level, then goes further with an independent technical test of the organisation's systems. This page does not award a certificate, and it is not a promise of a pass. 13

By Secordit. Last checked: 10 November 2026.

Go to the steps · All glossary terms

How it works

  1. Cyber Essentials is the government-backed scheme, developed by the experts at the NCSC. It assesses five technical controls intended to protect organisations against common internet-based threats. The overview of that first level belongs on the Cyber Essentials page. 13
  2. Cyber Essentials Plus assesses the same five controls, then adds an independent technical test of the organisation's systems. That test checks that those controls work in practice. 1
  3. The NCSC comparison table describes Plus as including technical audit or testing and higher assurance, compared with a baseline at the first level. The first level is described as a combination of self-assessment and independent audit. 1

What UK guidance says

Plus pricing is quoted according to the size and complexity of the network, rather than the tiered starting price shown for the first level. Holding a current certificate is described on GOV.UK as enabling a business to bid for certain government contracts involving financial or personal data. That is not a list of those contracts, and it is not a promise that a certificate will stop an attack. 13

What to know

  • A claim treats this glossary page as a certificate or as a promise of a pass. 1
  • A claim treats a certificate as a promise that the organisation will not be attacked. 3
  • Plus pricing is being compared with the first level without checking that Plus is quoted by network size and complexity. 1

What to do now

  1. If you want to understand both levels, start with the NCSC Cyber Essentials overview and the GOV.UK scheme overview. Read the Cyber Essentials glossary page for the first level. 13
  2. Treat Plus as the same five controls plus an independent technical test, not as a different set of controls. 1
  3. If you also need help after a cyber incident, follow NCSC incident guidance. Where a crime has taken place, use Report Fraud or Police Scotland on 101. 46578

UK reporting and support

How to protect yourself

  • Use the NCSC and GOV.UK scheme pages as the description of both levels. 13
  • Do not treat this glossary page as a certificate, a pass, or use of the CE product mark. 1
  • A current certificate is described on GOV.UK as enabling a bid for certain government contracts involving financial or personal data. It is not a promise of protection. 3

Frequently asked questions

What is the difference between Cyber Essentials and Cyber Essentials Plus?

Both levels assess the same five technical controls. The first level is described as a combination of self-assessment and independent audit. Plus then adds an independent technical test of the organisation's systems, to check that those controls work in practice. The NCSC describes Plus as higher assurance. 1

Does this page or a Secordit kit award Cyber Essentials Plus?

No. This page explains the Plus level. It does not award a certificate, and it is not a promise of a pass. 13

Does a certificate mean an organisation will not be attacked?

No. GOV.UK describes a current certificate as enabling a business to bid for certain government contracts involving financial or personal data. That is not a promise that a certificate will stop an attack. 3

Matching kit

Cyber Essentials Questionnaire Prep Kit · £39 · Digital download.

A plain-English Danzell questionnaire walkthrough and workbook for UK small firms and sole traders. It is preparation only, it does not award a certificate, and it does not cover the Plus technical test.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

  1. NCSC, Cyber Essentials overview. Accessed 10 November 2026 (Europe/London).
  2. NCSC, Cyber Essentials resources. Accessed 10 November 2026 (Europe/London).
  3. GOV.UK, Cyber Essentials scheme: overview. Accessed 10 November 2026 (Europe/London).
  4. Report Fraud, Report Fraud. Accessed 10 November 2026 (Europe/London).
  5. Report Fraud, Guide to reporting cyber crime and fraud. Accessed 10 November 2026 (Europe/London).
  6. NCSC, Help for individuals. Accessed 10 November 2026 (Europe/London).
  7. Police Scotland, How to report a crime - Police Scotland. Accessed 10 November 2026 (Europe/London).
  8. Report Fraud, Reporting cyber crime and fraud or phishing attempts - Report Fraud. Accessed 10 November 2026 (Europe/London).