UK Cyber Essentials and Cyber Essentials Plus
Two certification levels. The same five basic protections. A clear starting point for your organisation.
Which Level Do You Need?
Cyber Essentials (CE) is a UK government-backed cyber security certification scheme. Cyber Essentials Plus (CE+) adds independent technical testing. Both focus on common internet threats; neither removes every cyber risk.
| Your Question | Cyber Essentials CE | Cyber Essentials Plus CE+ |
|---|---|---|
| How It Is Checked | Cyber Essentials (CE) Your organisation answers a questionnaire. An independent assessor checks the answers. | Cyber Essentials Plus (CE+) You pass CE first. An assessor then tests devices, services and security settings in the same scope. |
| What It Covers | Cyber Essentials (CE) The five protection areas below. | Cyber Essentials Plus (CE+) The same five protection areas, checked in practice. |
| When to Choose It | Cyber Essentials (CE) A buyer asks for CE, or you want baseline certification. | Cyber Essentials Plus (CE+) A buyer asks for CE+, or you want the added technical assessment. |
| Assessment Price | Cyber Essentials (CE) Published bands based on organisation size. | Cyber Essentials Plus (CE+) A quote based on the size and complexity of the assessment. |
Check the buyer’s exact wording: certificate level, legal applicant, scope and deadline. One certificate does not automatically cover every group company or service.
Find the Guide You Need
Start with your question. Each guide explains the practical checks, who can help and what to do next.
The Five Protection Areas
The scheme calls these “technical controls”. In everyday terms, they mean:
Firewalls
Filter network traffic to reduce unwanted access.
Secure Configuration
Remove unsafe settings and unnecessary access points.
Security Updates
Keep software supported and fix known weaknesses promptly.
User Access
Give people only the access they need; remove access when it ends.
Malware Protection
Use an accepted way to protect against malicious software.
From First Question to Assessment
Confirm the Need
Check the required level, applicant and target date.
Agree the Scope
Map work devices, accounts and services. Confirm the boundary with the certification body.
Close the Gaps
Review evidence. Your organisation or IT provider makes the changes.
Take the Assessment
A licensed certification body assesses your application and decides the result.
Plan the Cost and Timing
Budget for the Full Work
Optional advice, certification fees and any IT changes are separate costs. Ask the certification body for its current assessment price.
Set a Realistic Date
Preparation depends on your gaps and who can fix them. For Plus, pass CE first and confirm the testing deadline and availability with the certification body.
Who Does What?
Hemanth Vishnu Advisory provides readiness advice. It is not the certification body and cannot guarantee a pass.
Hemanth Advises
Hemanth personally reviews scope, gaps and evidence, and helps prepare the handoff.
You and Your IT Provider Act
You confirm the facts, approve and operate changes, and have an authorised signatory confirm the application.
The Certification Body Assesses
An independent licensed UK certification body carries out assessment and makes the certification decision.