Do I Need Cyber Essentials Plus If I Already Have the Basic Certificate?

At a Glance

Cyber Essentials Plus is not mandatory for most UK organisations, but it provides independently verified assurance that cyber security controls are working effectively. It is particularly valuable for businesses handling sensitive data, bidding for public sector contracts or meeting higher customer security expectations, offering greater confidence than Cyber Essentials alone.

Is Cyber Essentials Plus Mandatory?

Your organisation has achieved Cyber Essentials certification to protect it against common cyber threats. This means your organisation takes cyber security seriously and has implemented the five key technical controls as recommended by the UK’s National Cyber Security Centre (NCSC).

But soon enough, you may ask, “Do I need Cyber Essentials Plus? Is it mandatory?”

Answering these questions depends on your business, the type of data you handle, your customers and future growth plans. For most UK businesses, Cyber Essentials Plus is not mandatory, but there are many situations where it becomes a practical or contractual requirement.

Cyber Essentials provides a foundation, but what Cyber Essentials Plus certification offers is a much higher level of assurance because your security controls are tested independently.

In this guide, explore the differences between the two certifications, where the standard certification is enough and who really needs Cyber Essentials Plus.

What’s the Difference? Cyber Essentials vs Cyber Essentials Plus

Both certifications are based on the same five Cyber Essentials technical controls, but differ in how they are assessed. Let’s understand the differences.

Cyber Essentials

Cyber Essentials is based on a self-assessment questionnaire. It means your organisation has implemented controls covering firewalls, user access controls, secure configuration, security updates and malware protection.

Once your business meets these requirements, a qualified certification body reviews your responses before issuing certification. For smaller businesses, achieving Cyber Essentials certification is a great first step towards improving cyber security in their organisation. 

Cyber Essentials Plus

Cyber Essentials Plus builds on the same requirements but adds a layer of technical verification by an independent body. Instead of relying on self-assessment alone, a qualified assessor tests the controls directly.

Typical tests include:

• Vulnerability assessments
• Malware protection testing
• Verifying user accounts
• Validating multi-factor authentication (MFA)
• Patch management checks
• External boundary testing
• Reviewing device configuration

This independent technical audit of your IT systems verifies that controls are in place and provides your customers with greater assurance that your security controls meet the certification requirements.

When Is Cyber Essentials Alone Enough?

Cyber Essentials is often sufficient for organisations with straightforward IT environments and lower levels of cyber risk.

• Cyber Essentials acts as a good starting point if your organisation has never formally assessed its cyber security.
• Small businesses with limited IT systems often benefit from Cyber Essentials as their first recognised cyber security certification.
• Cyber Essentials may be sufficient for your current needs if your organisation doesn’t handle or process significant volumes of confidential customer, financial or regulated information.
• If your business doesn’t require an independently verified certification, the standard certificate may provide sufficient evidence for now.

However, your business’ IT requirements may change over time as contracts, compliance obligations and customer expectations evolve.

4 Signs Your Organisation Should Upgrade to Cyber Essentials Plus

Here are 4 signs that indicate it may be time to upgrade to Cyber Essentials Plus.

You Handle Sensitive or Confidential Data

If your organisation stores or processes customer personal information, financial records, healthcare data, legal documentation or intellectual property, independent verification of Cyber Essentials Plus can provide greater assurance that your systems are working well.

You Bid for Public Sector or Government Contracts

Cyber Essentials is required for certain government and public sector contracts, while some procurements or customers may specifically require Cyber Essentials Plus. Even where Plus is not mandatory, its independent technical testing can provide stronger assurance during supplier due diligence. 

Your Customers Are Asking for Greater Assurance

Some large organisations set strict criteria and standards for their suppliers. With a Cyber Essentials Plus certification, you demonstrate that your controls have been independently technically tested rather than relying on a verified self-assessment alone. . This can increase trust and confidence during due diligence checks.

You’re Reviewing Cyber Insurance Requirements

Cyber insurance companies are placing greater emphasis on businesses with strong cyber security practices. While the certification alone doesn’t guarantee lower premiums, it can indicate lower cyber risk when combined with other security controls.

Is Cyber Essentials Plus Worth the Additional Investment?

While Cyber Essentials Plus is not mandatory, it is often worth the investment for many UK organisations. Although it involves additional assessment costs, it often delivers value that extends beyond the certification itself.

• Greater customer confidence: Independent audits and verifications demonstrate a stronger commitment to protecting customer information, which can help build better customer relationships.
• Possible differentiator: With independently verified cyber security controls, your business may stand apart from those with only basic certification.
• Stronger internal security: Preparing for Cyber Essentials Plus certification encourages businesses to review and strengthen their security measures, including device security and patch management.
• Better visibility of security weaknesses: A technical audit can identify weaknesses that your business may not be aware of and address them before they can be exploited.
• Supports long-term cyber security strategy: Achieving Cyber Essentials Plus certification is not a one-off exercise, but a part of an ongoing effort to improve cyber security at a time when cyber threats are constantly evolving.

How Redpalm Helps Businesses Achieve Cyber Essentials Plus

After comparing Cyber Essentials and Cyber Essentials Plus, are you keen to take the next step?

Preparing for Cyber Essentials Plus means more than just paperwork. The additional step of independent testing also means identifying and addressing any weaknesses before the assessment begins.

Redpalm reduces any ambiguity and helps your business prepare with confidence. As a Cyber Essentials and Cyber Essentials Plus certification body, we work with businesses of all sizes to ensure their technical controls meet the requirements.

Our cyber security specialists provide:

• Gap analysis against certification requirements
• Vulnerability identification and remediation
• Microsoft 365 security reviews
• Multi-factor authentication (MFA) implementation
• Patch management guidance
• Endpoint security improvements
• Cyber Essentials and Cyber Essentials Plus certification support

Ready to take the next step beyond Cyber Essentials? Contact Redpalm today to speak with an expert about whether Cyber Essentials Plus is the right choice for you.