Executive Summary: What is it?
Cyber Essentials Plus is a UK government-backed cybersecurity certification, developed by the NCSC (National Cyber Security Centre) and delivered by the IASME Consortium, its delivery partner. Basic Cyber Essentials is a verified self-assessment: the organization's answers, signed off by a board member or equivalent, are marked by an assessor. Plus assesses the same five technical controls (firewalls, secure configuration, security update management, user access control and malware protection) and adds independent technical testing of the organization's systems, to verify that the controls work in practice. Certificates expire after 12 months, so certification is renewed every year.
CFO / Business Impact: What does it cost/risk?
- UK Government Market Access: Under PPN 014, which applies from 24 February 2025 and replaced PPN 09/14 and PPN 09/23, central government departments, their executive agencies and non-departmental public bodies, and NHS bodies must require Cyber Essentials or Cyber Essentials Plus, or equivalent controls, on contracts that handle personal data of citizens or government staff, ICT systems holding OFFICIAL data, or information on the day-to-day business of government. MOD contracts under DEFCON 658 apply Defence Standard 05-138, which requires Cyber Essentials at every cyber risk profile level and Plus at Levels 2 and 3.
- Annual Renewal: A supplier must recertify every 12 months to keep a valid certificate.
- Cost Drivers: Basic Cyber Essentials is priced by the size of the organization; Plus is quoted by the certification body, by the size and complexity of the network it tests.
- Insurance Benefit: Organizations domiciled in the UK or the Crown Dependencies whose certification covers the whole organization, whose turnover is under the scheme's limit and who opt in receive cyber liability insurance arranged by IASME, the scheme's delivery partner.
Technical Reality: How does it work?
- Independent Testing: A certification body licensed by IASME tests the organization's systems to verify that the five controls work in practice.
- Five Controls: Firewalls (boundary protection), Secure Configuration (hardened defaults), User Access Control, Malware Protection, and Security Update Management (updates that fix critical or high-risk vulnerabilities applied within 14 days of release).
What the Label Means in a Solution Profile
Cyber Essentials Plus is a UK government scheme that certifies an organization's IT setup after hands-on testing by a licensed body; certificates last 12 months.
- Self-Hosted line: No self-hosted line carries it: your own estate would need certifying.
- Managed service line: "Cyber Essentials Plus (Audited)" means the organization that runs the service holds a current certificate from an IASME-licensed certification body. Basic Cyber Essentials does not earn the label.