What both certificates check
Cyber Essentials is the UK government-backed baseline for cyber security. Whichever level you go for, the same five technical controls are assessed:
- Firewalls: boundary firewalls and routers set up so only the traffic you need gets in.
- Secure configuration: default passwords changed, unused software and accounts removed.
- Security update management: only supported software, with high-risk and critical updates applied within 14 days.
- User access control: accounts only for people who need them, admin rights kept separate, multi-factor authentication on cloud services.
- Malware protection: anti-malware or application allow-listing on devices in scope.
How Cyber Essentials is assessed
Cyber Essentials is a self-assessment. You answer a detailed questionnaire about your setup, a senior person in the business signs it off, and an independent assessor reviews your answers. Nobody tests your systems directly.
That makes it quicker and cheaper, but it also means the certificate reflects how you describe your setup. If the answers are wrong, the certificate doesn't protect you.
How Cyber Essentials Plus is assessed
Cyber Essentials Plus uses the same questionnaire, then adds a hands-on technical audit. An assessor tests a sample of your devices, checks that updates and malware protection are really in place, and scans your systems from outside.
You need a current Cyber Essentials certificate before you can go for Plus, so the two are usually done one after the other.
Who usually asks for which
The simplest way to decide is to look at who's asking:
- Public sector contracts and many larger customers ask for Cyber Essentials as a minimum.
- Contracts that involve sensitive or personal data often ask for Cyber Essentials Plus, because they want evidence that the controls work.
- Cyber insurers increasingly ask whether you hold either certificate, and some offer better terms if you do.
- Ministry of Defence suppliers need Cyber Essentials as the foundation for Defence Cyber Certification.
If the tender or contract doesn't say, Cyber Essentials is the usual starting point. Plus is worth doing when you want proof you can show, not just a declaration.
How to prepare so you pass first time
- Decide your scope. Work out which devices, cloud services and users are in. Staff phones and laptops that access company data usually count.
- Check your updates. Unsupported software and missed critical updates are the most common reasons for failing.
- Turn on multi-factor authentication for every cloud service that offers it.
- Review admin accounts. Admin rights should be separate from everyday accounts and limited to the people who need them.
- Only then submit. A readiness check before the assessment is far cheaper than a failed one.
How Zarco helps
We provide Cyber Essentials and Cyber Essentials Plus. We start with a readiness check against the current question set, help you fix anything that would fail, and only then submit. For Plus, we arrange the technical audit too. Then we remind you before the certificate lapses.