Cyber Essentials covers five controls. An attacker starts at six.

Cyber Essentials is a UK government-backed certification scheme owned by the National Cyber Security Centre and delivered by IASME. It certifies that an organisation has five basic technical controls in place: firewalls, secure configuration, security update management, user access control and malware protection. Certification is valid for twelve months and is assessed through a self-assessment questionnaire reviewed by a certification body.

Both cover the same five technical controls. Cyber Essentials is a self-assessment: you complete a questionnaire, a board-level representative signs it, and a certification body reviews the answers. Cyber Essentials Plus adds an independent technical audit, in which an assessor tests a sample of your devices directly, checking patch levels, malware protection and account separation, and running simulated malicious emails and file downloads. Plus requires a current Cyber Essentials certification first. In short, one records what you say, the other verifies a sample of it.

IASME sets certification pricing in bands based on organisation size, and Cyber Essentials Plus is priced separately and quoted by the certification body because it involves an assessor’s time on your devices. Because the bands are reviewed periodically, check the current figures with IASME or an accredited certification body rather than relying on a number quoted on a third-party page. We do not issue certificates and take no fee from the scheme.

If you bid for central government contracts involving sensitive or personal data, some require it, and Cyber Essentials Plus specifically. Beyond that it appears constantly in commercial supply-chain questionnaires and increasingly in cyber insurance applications. On the security merits alone it is worth doing, because the five controls block most opportunistic attacks. Treat it as the floor rather than the goal.

No. Cyber Essentials is a self-assessment against five controls. Cyber Essentials Plus adds a technical audit that samples your devices to verify those same five controls, which makes it a verification exercise rather than an attack. A penetration test has no fixed control list: a tester attacks your systems to find the paths that actually work, including privilege escalation, lateral movement, segmentation failures, business logic flaws and everything else outside the five controls. The two are complementary and neither replaces the other.

Because the assessment answered a narrow question well and left the broader one untouched. Cyber Essentials Plus confirms that a sample of your devices has the five controls applied. It does not examine whether one compromised user account reaches domain admin, whether your segmentation holds, whether an attacker can delete your backups, or whether your application exposes one customer’s data to another. Jaguar Land Rover, Marks & Spencer and the Co-op all held certifications and ran serious security programmes. All three went dark. An assessor checks whether controls exist. An attacker checks whether they hold.

No. We are an offensive security firm, not an accredited certification body, so we cannot issue Cyber Essentials or Cyber Essentials Plus certificates and we would rather tell you that plainly than sell you something adjacent. Go to IASME or an accredited certification body for the certificate. Come to us for the test that shows what an attacker reaches once those five controls are in place, and we will write the findings so your assessor, your board and your engineers can all use them.