All services Every engagement has a fixed, published price. Book a strategy call
Cyber Essentials Plus, explained properly: what the audit tests, what it costs in the UK, the 27 April 2026 rule changes, and how to pass first time.
What is Cyber Essentials Plus? It is the audited version of the UK government’s Cyber Essentials scheme: the same five technical controls, but instead of your organisation declaring that they are in place, an independent assessor connects to your systems and proves it. Standard Cyber Essentials is a verified self-assessment. Cyber Essentials Plus is a hands-on technical audit: vulnerability scans, malware protection tests, MFA checks and account checks, run against a sample of your real devices and every internet-facing system you own. That difference sounds small on paper. In practice it is the difference between saying your patching works and watching an assessor find the machine where it does not.
The short version. Cyber Essentials Plus certification requires a passed Cyber Essentials self-assessment first, then an independent audit completed within three months of it. The assessor tests a representative sample of devices (typically around 10 percent), all internet gateways and every internet-facing server, inside and out. The IASME self-assessment fee is fixed by organisation size (£320 to £600 + VAT). The Plus audit is quoted by certification bodies and most UK organisations pay between roughly £1,500 and £3,000 + VAT. Since 27 April 2026 the scheme runs on v3.3 and the Danzell question set: MFA missing on any cloud service that offers it is now an automatic fail, and patching failures must be fixed across your whole estate rather than just the sampled machines. Certificates last 12 months.
The controls are identical. The five requirements, firewalls, secure configuration, access control, malware protection and security update management, do not change between the two levels. What changes is who has to believe you. Cyber Essentials Plus vs Cyber Essentials is a question of assurance, and the table below is the honest comparison.
| Cyber Essentials | Cyber Essentials Plus | |
|---|---|---|
| Method | Self-assessment questionnaire, verified by an assessor and signed off at board level | Everything in Cyber Essentials, plus an independent technical audit of your live systems |
| Evidence | Your answers | Test results from your actual devices, gateways and cloud services |
| Typical cost | £320 to £600 + VAT (fixed IASME fee by size) | Quoted individually. Most organisations pay roughly £1,500 to £3,000 + VAT |
| Elapsed time | Days, if prepared | Two to six weeks including preparation and any remediation |
| Who asks for it | Many government contracts, insurers, smaller supply chains | MOD and sensitive government work, enterprise procurement, regulated customers |
| What it proves | You say the controls are in place | An independent assessor confirmed they work in practice |
One consequence follows from that table: if a customer or framework specifies Plus, the basic certificate does not count. The reverse works fine, because Cyber Essentials Plus certification includes and requires the standard certification underneath it.
The Cyber Essentials Plus audit follows a published test specification, so there is no mystery about what happens on the day. The assessor works through five kinds of Cyber Essentials Plus testing against a sample of your estate: a representative selection of user devices, typically around 10 percent per operating system build, plus all internet gateways and every server with services exposed to the internet. The assessor can widen the sample if they find problems.
| Test | What the assessor does | What fails it |
|---|---|---|
| External vulnerability scan | Scans your internet-facing systems from outside | Exploitable services, exposed admin interfaces, critical or high vulnerabilities |
| Authenticated internal scan | Runs a credentialed scan on each sampled device | Missing critical or high security updates older than 14 days, end-of-life software |
| Malware protection test | Sends test files by email and downloads them via the browser on sampled devices | Test files that execute or arrive without warning. Missing or misconfigured protection |
| MFA and cloud checks | Verifies multi-factor authentication on the cloud services your organisation uses | Any in-scope cloud service offering MFA where it is not enabled for all users: automatic fail under v3.3 |
| Account separation | Checks that day-to-day work does not happen on admin accounts, and accounts are not shared | Users browsing or reading email with admin rights. Shared or generic logins |
These are the Cyber Essentials Plus requirements in their practical form: not a policy review, a live demonstration. The full technical detail sits in the NCSC’s Cyber Essentials scheme documentation, and our guide to the five Cyber Essentials controls explains each control in depth.
The scheme moved to version 3.3 of the NCSC requirements on 27 April 2026, with the Danzell question set replacing Willow for every assessment account created from that date. Accounts opened earlier stay on the previous version and have six months to complete. Three changes matter most at Plus level.
MFA is now a hard gate. If a cloud service offers multi-factor authentication in any form and it is not switched on for every user, the assessment fails automatically. No compensating controls, no explanations. Patching failures now cost you the whole estate. Under the updated Test Case 2.0, if sampled devices show that the 14-day rule for critical and high updates is not being met, remediation is required across all in-scope devices rather than just the machines the assessor happened to test. The sample finds the problem. The fix is estate-wide. Cloud services cannot be scoped out. Version 3.3 adds a clear definition of a cloud service and removes the ambiguity that let organisations quietly exclude SaaS tools. If your data or services are in it and your people access it, it is in scope, and shared accounts are no longer acceptable anywhere. Our guide to the 2026 Cyber Essentials changes covers the full list, including the self-assessment side.
Two separate fees make up the certification itself, and a third number, your internal effort, is the one nobody puts on the invoice. The self-assessment fee is fixed by IASME and scales with headcount. The Plus audit fee is set by the certification body you choose, because audit effort depends on your size, the number of operating system builds, sites and servers. Individual quotes vary, which is why IASME will send you three when you enquire through their site.
| Component | Typical cost | Notes |
|---|---|---|
| Cyber Essentials self-assessment | £320 to £600 + VAT | Fixed IASME fee: £320 micro (0 to 9 staff), £440 small (10 to 49), £500 medium (50 to 249), £600 large (250+) |
| Cyber Essentials Plus audit | Roughly £1,400 to £4,500 + VAT | Quoted by the certification body. Most small and mid-size organisations land between £1,500 and £3,000 + VAT |
| Internal preparation | Varies | Patching catch-up, MFA rollout, replacing end-of-life software, admin account clean-up. Usually the largest real cost |
| Retesting after a failure | Often charged again | A failed audit typically means paying for another assessment, which is why preparation is cheaper than failure |
Intelance’s own route to Cyber Essentials Plus starts from £1,150 + VAT for small, straightforward environments, with the price confirmed before any work begins. The full breakdown of every fee in the scheme, including renewal economics, is in our Cyber Essentials cost guide.
Nobody needs Cyber Essentials Plus for its own sake. You need it because someone with money or a contract says so, or because you want the assurance the basic level cannot give. The pattern in Cyber Essentials Plus UK procurement is consistent. Central government has required Cyber Essentials in a wide range of contracts since PPN 09/23, and buyers specify the Plus level where the work involves handling sensitive data or higher-risk services. The Ministry of Defence requires certification through its supply chain wherever defence information is handled, and defence primes routinely flow the Plus requirement down to subcontractors. Beyond government, the fastest-growing source of demand is private: enterprise customers writing Cyber Essentials Plus for government contracts language into their own supplier questionnaires, and insurers pricing or conditioning cover on it.
The self-selection case is simpler. If a basic certificate would be embarrassing to defend after an incident, because your organisation is the kind that should have known whether its controls worked, then Plus is the level you were always going to need. Organisations weighing certification against a fuller framework should read our comparison of Cyber Essentials vs ISO 27001, because the two solve different problems and are frequently bought in the wrong order.
The sequence is fixed, and one date drives all the others: the Cyber Essentials Plus audit must be completed within three months of passing the self-assessment. Miss that window and you repeat the questionnaire.
First, scope honestly. Decide what is in: which devices, networks, cloud services and home workers. Under v3.3 cloud services cannot be excluded, so the scoping conversation is mostly about being accurate rather than creative. Second, pass the self-assessment. Board sign-off, verified by an assessor. If you certified less than three months ago, you do not repeat it. Our questionnaire guide walks through every question. Third, prepare the estate before the assessor arrives. Patch to within 14 days, remove end-of-life software, switch on MFA everywhere it exists, strip admin rights from daily-use accounts, and confirm malware protection is working on every build. Fourth, the audit itself. Usually a day or two, remote or on site, sampling devices and testing every internet-facing system. Fifth, remediate fast if anything surfaces. Small issues can often be fixed and retested inside the assessment window. Structural ones mean a new audit, and under v3.3 a patching failure means fixing every in-scope device before you pass.
Failure is rarely exotic. The same five findings account for most failed audits we see. Patching that exists as a policy but not on the machines: the 14-day rule is checked by authenticated scan, and the scan does not read policies. MFA gaps on forgotten cloud services: the HR portal, the expenses tool, the legacy admin login, any one of them is now an automatic fail. End-of-life software that everyone knew about and nobody owned. Admin rights used for daily work, which takes one browser session on one sampled machine to expose. Scope surprises: devices, servers or SaaS tools that were never inventoried and turn up mid-audit. The full field guide, with fixes, is in our article on common Cyber Essentials failures.
The organisations that pass first time all do the same unglamorous thing: they run the tests on themselves before paying someone else to run them. Scan your own devices with credentials and fix what the scan finds. Send yourself the malware test files. Log into every cloud service and check MFA is on for every user rather than just most of them. Audit who holds admin rights and take them off daily-driver accounts. Then book the audit inside the three-month window with slack for remediation. If the estate is complex, or a previous attempt failed, a structured pre-assessment pays for itself the first time it prevents a failed audit fee. Our step-by-step guide to passing Cyber Essentials first time covers the groundwork that Plus builds on.
Intelance provides a guided route to Cyber Essentials Plus certification from £1,150 + VAT for small, straightforward environments, covering scoping, preparation and the technical testing, with the price confirmed in writing before work begins. Organisations likely to fail without preparation can start with our pre-assessment and hardening service at £1,500, and organisations that have already failed can use our failed Cyber Essentials support from £950 + VAT to diagnose, fix and recertify. The baseline route, standard Cyber Essentials certification, is there for organisations that do not yet need the audited level.
It is the audited level of the UK government’s Cyber Essentials scheme. The same five controls as the standard certification, but verified by an independent assessor who tests a sample of your devices, all internet gateways and every internet-facing server, rather than taking your word for it.
The controls are identical. The assurance is not. Cyber Essentials is a verified self-assessment. Cyber Essentials Plus adds an independent technical audit: vulnerability scans, malware protection tests, MFA checks and account checks against your live systems.
The underlying self-assessment is a fixed IASME fee of £320 to £600 + VAT depending on size. The Plus audit is quoted individually by certification bodies. Most organisations pay between roughly £1,500 and £3,000 + VAT. Intelance’s route starts from £1,150 + VAT for small, straightforward environments.
Yes. A passed Cyber Essentials self-assessment is required first, and the Plus audit must be completed within three months of it. If you certified less than three months ago, you do not repeat the questionnaire.
From 27 April 2026 the scheme runs on v3.3 and the Danzell question set. MFA missing on any cloud service that offers it is an automatic fail, patching failures found in the sample must be remediated across all in-scope devices, and cloud services can no longer be excluded from scope.
Many central government contracts require Cyber Essentials as a minimum, and buyers specify the Plus level where the work involves sensitive data or higher-risk services. The Ministry of Defence requires certification through its supply chain wherever defence information is handled.
The audit itself usually takes one to two days. End to end, allow two to six weeks: preparation, the self-assessment if you do not hold one, the audit, and time to remediate anything it finds, all inside the three-month window.
Minor issues can often be fixed and retested within the assessment window. Larger failures mean remediating and paying for a further assessment, and under v3.3 a patching failure means fixing every in-scope device rather than just the sampled ones. A structured pre-assessment is the cheapest insurance against that outcome.
Twelve months. Both Cyber Essentials and Cyber Essentials Plus are annual certifications, and IASME removes lapsed organisations from the public register of certified organisations.
Written by Emmanuel Olatunji, Chief Enterprise Architecture Partner at Intelance. Based on the NCSC Requirements for IT Infrastructure v3.3 and the Cyber Essentials Plus test specification in force from 27 April 2026. Last reviewed 8 July 2026.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with a licensed assessor. You leave knowing which route applies to you, what it costs and what to do first.
Talk to a senior adviser
