Cyber Essentials Plus

Cyber Essentials Plus is the independently audited tier of the UK government’s Cyber Essentials scheme. While standard Cyber Essentials is based on a self-assessed questionnaire, Cyber Essentials Plus requires an IASME-approved assessor to conduct a hands-on technical audit of your devices, network and configuration – verifying that the five technical controls are genuinely implemented and working, not just declared.

Cyber Essentials is a self-assessment certification – you answer a questionnaire and an approved assessor reviews your responses. Cyber Essentials Plus goes further with an independent technical audit of your actual systems, conducted remotely by a qualified assessor, to verify that the controls you have declared are in place. CE+ provides a higher level of assurance and is required for MoD contracts and many other government and enterprise frameworks.

The CE+ audit involves four main elements conducted remotely by CyberLab’s IASME-approved assessors: a device configuration audit across a sample of in-scope devices; a vulnerability assessment to confirm patching and configuration meets the required standard; an external port scan of your internet-facing IP addresses; and email and web browser configuration testing to verify that potentially malicious files are blocked. Documentation is captured throughout and used to evidence your compliance.

Yes. Cyber Essentials Plus requires a current Cyber Essentials certification as a prerequisite. CE+ must be completed within three months of your Cyber Essentials certification date. If your CE certification has lapsed, you will need to renew it before proceeding to CE+. CyberLab can support you through both certifications in a single engagement.

Once you have a valid Cyber Essentials certification in place and a signed order, CyberLab can schedule your CE+ remote audit promptly. The audit itself typically takes one to two days depending on the number of in-scope devices. The three-month window between CE and CE+ certification means it is important to start the process early – speak with our team as soon as your CE certificate is issued to avoid delays.

Yes. Ministry of Defence contracts require Cyber Essentials Plus as a minimum – standard Cyber Essentials is not sufficient. CE+ is also increasingly required by other government departments, public sector frameworks and enterprise supply chains as evidence of independently verified security controls. If you are unsure whether CE+ is required for your specific contract or framework, speak with our team.

CE+ demonstrates to clients, procurement teams and regulators that your security controls have been independently verified – not just self-declared. It is required for MoD and many public sector contracts, increasingly requested by enterprise clients as part of supplier assurance, and provides a higher level of technical assurance than standard CE. It also carries the same Cyber Liability Insurance benefit as standard CE for eligible organisations.

Eligible organisations with a turnover below £20 million receive Cyber Liability Insurance automatically upon certification – the same cover as standard Cyber Essentials. This includes a 24-hour incident response helpline and crisis management support up to a total liability limit of £25,000. Full terms and conditions are available on the IASME website.

The April 2026 Danzell update introduced stricter requirements across cloud security, multi-factor authentication and patching timelines — all of which are verified during the CE+ technical audit. If you were previously certified under an earlier standard, your renewal CE+ audit will be assessed against the updated Danzell requirements. CyberLab’s pre-assessment service can help you identify any gaps before your audit. Read our full Danzell update guide.

Cyber Essentials Plus starts from £1,395 for the full remote technical audit. The final cost depends on the size of your organisation and the number of devices in scope. If you need both CE and CE+ certifications, speak with our team about combining both in a single engagement. We are transparent about pricing throughout – speak with our team for a specific quote.

CyberLab will contact you ahead of your expiry date with the steps required to complete your annual renewal. Cyber Essentials certification is valid for 12 months – renewal is required annually to maintain your certified status and keep your Cyber Liability Insurance active.