What Is the Difference Between Cyber Essentials and Cyber Essentials Plus?

The Key Difference

What CE Plus Testing Includes

An assessor will actually probe your systems:

• Vulnerability scan of external-facing systems
• Configuration checks on a sample of devices
• Simulated phishing to test email controls
• Verification that patches are current and MFA is working

This isn't box-ticking. They're checking whether your security works in practice.

Which One Do You Need?

Cyber Essentials (basic) is fine if:

• You want baseline certification for general credibility
• Your customers don't specifically require CE Plus
• You're just getting started with formal security

Cyber Essentials Plus is required if:

• You're in the defence supply chain (DEFCON 658 mandates it)
• Your customers specifically ask for CE Plus
• You want to prove your security, not just claim it
• You're bidding on government contracts with data handling

Our take: If you're going to do it, do CE Plus. The extra cost is modest, and it's far more credible. Anyone can fill in a questionnaire.

The Real Difference

Basic CE asks: "Do you have MFA enabled?"

CE Plus checks: "Is MFA actually enabled on these accounts, right now?"

That gap between policy and reality is exactly where breaches happen.