Microsoft Solutions
Business Solutions
Microsoft for Business
Join us at our next event
By Industry
How we help
Blog

Cyber Essentials vs Cyber Essentials Plus: What’s the Real Difference?

8 Sep, 2026

Imagine two companies both claim they’ve locked every door in their building.

One says: “We’ve checked ourselves and everything’s secure.”

The other says:

“An independent security expert checked and confirmed everything’s secure.”

Which one would give you more confidence?

That’s essentially the difference between Cyber Essentials and Cyber Essentials Plus.

Both certifications help organisations demonstrate a commitment to cyber security, but one includes an additional layer of independent verification. Depending on your customers, industry, and business goals, that distinction could make all the difference.

Cyber Essentials vs Cyber Essentials Plus at a Glance

There’s a common misconception that Cyber Essentials and Cyber Essentials Plus assess completely different security standards.

In reality, both certifications focus on the same core cyber security controls. The difference lies in how those controls are assessed and verified.

For a quick comparison, have a look at the table on the left.

While the table gives you the headline differences, it’s worth taking a closer look at what both certifications are actually assessing. Because despite the extra “Plus” in the name, the security requirements themselves may be more similar than you think.

Comparison Chart showing differences between Cyber Essentials and Cyber Essentials Plus

 

The Five Security Controls: Firewalls, Secure configuration, user access control, malware protection, security updates

The Real Difference: Self-Assessment vs Independent Verification

Although Cyber Essentials and Cyber Essentials Plus assess the same five security controls, the way those controls are validated is what sets them apart.

With Cyber Essentials, your organisation completes a self-assessment questionnaire, confirming that the required controls are in place.

Cyber Essentials Plus takes this a step further. An accredited assessor independently verifies that those controls are operating as expected, providing additional confidence that security measures are not only documented but working effectively in practice.

Think of it this way: Cyber Essentials demonstrates that you’ve implemented the required controls, while Cyber Essentials Plus provides independent evidence that those controls are functioning as intended.

For customers, suppliers, and other stakeholders, that distinction can be significant. While both certifications show a commitment to cyber security, Cyber Essentials Plus offers a higher level of assurance because compliance has been externally verified.

Why Might Customers Ask for Cyber Essentials Plus?

Tender and Procurement Requirements

Many organisations include cyber security requirements within their supplier selection process. In some cases, Cyber Essentials Plus may be required to provide additional assurance around a supplier's security posture.

Supply Chain Expectations

Larger organisations are increasingly reviewing the security standards of their suppliers. Cyber Essentials Plus helps demonstrate that your controls have been independently verified.

Handling Sensitive Information

Organisations that handle sensitive customer, financial, or operational data may be asked to provide greater assurance around how that information is protected.

Building Competitive Trust

Cyber Essentials Plus can help strengthen customer confidence and differentiate your organisation when suppliers offer similar products or services.

Which Certification Is Right for Your Business?

 

If you’re still deciding between Cyber Essentials and Cyber Essentials Plus, these questions can help guide your decision:

Are customers or suppliers asking for independent verification?

Do you regularly complete supplier security questionnaires?

Are you bidding for contracts with cyber security requirements?

Do you handle sensitive customer, financial, or operational data?

Would independently verified certification help build customer trust?

Are your security controls ready for external assessment?

If you answered “yes” to several of these questions, Cyber Essentials Plus may be worth considering.

If not, Cyber Essentials can still provide a valuable foundation for demonstrating good cyber security practices.

Which Option Is Right for Your Business?

Cyber Essentials and Cyber Essentials Plus both help organisations demonstrate a commitment to good cyber security practices. While they assess the same core controls, the key difference is how those controls are validated.

For some organisations, Cyber Essentials provides the right foundation. For others, particularly those facing customer, supplier, or procurement requirements, Cyber Essentials Plus offers additional assurance through independent verification.

Our Perspective

At String, we’ve chosen to achieve Cyber Essentials Plus certification ourselves because we recognise the value that independent verification provides. External assessment offers added reassurance for customers, partners, and stakeholders.

Ultimately, the right choice depends on your organisation’s goals, customer expectations, and the level of assurance you want to demonstrate. Whether you’re starting your certification journey or considering Cyber Essentials Plus, understanding the difference will help you make a more informed decision.

 

Need help preparing for Cyber Essentials or Cyber Essentials Plus certification? The team at String can help you understand the requirements, identify any gaps, and ensure you’re ready for assessment, whether you’re applying for certification for the first time or taking the next step towards independent verification.

Contact
 Cyber Security

Related

How can we help?
Let's Talk