Cyber Essentials (CE) uses an independently checked questionnaire. Cyber Essentials Plus (CE+) adds technical testing. Start with the requirement you need to satisfy.
Use the buyer’s written wording and the scope of the work. A familiar scheme name is not enough to settle the level or applicant.
The tender, contract or renewal notice asks for Cyber Essentials.
Confirm the named legal applicant, required certificate scope, evidence date and whether a stated equivalent is acceptable. Plan for CE unless the buyer confirms otherwise.
The requirement explicitly names Cyber Essentials Plus (CE+).
Plan for CE first, then the Plus audit in the required scope. Ask the buyer whether its wording allows another route.
Prepare for Plus TestingYou want a recognised baseline for common internet threats or customer assurance.
CE may meet that aim. Consider Plus where you need stronger independent evidence that the controls work in practice.
Understand the Five ProtectionsThe buyer says ‘cyber certification’, ‘government standard’ or gives a deadline without naming level or scope.
Ask the buyer or procurement contact in writing which level, legal entity, scope, evidence date and accepted equivalents apply before buying an assessment.
Resolve these points with the buyer before setting a target date.
A verified self-assessment against five technical controls, reviewed by an independent assessor. It gives baseline assurance; the basic assessment does not include a separate technical scan.
The same five controls, with an independent technical audit of systems in scope. It provides higher assurance that controls are implemented in practice. CE+ does not cover every cyber risk, certify a particular product or replace additional controls for higher or targeted threats.
Fictional small supplier Northbank Studio has a tender deadline but the notice does not say which company in its group must hold the certificate or what scope is acceptable.
Hemanth personally advises on scope and evidence. Your organisation or IT provider makes the changes; an independent licensed UK certification body assesses the application and decides the result.