Verified against Ofcom Connected Nations Spring 2026, IASME Cyber Essentials April 2026 standard and current operator pricing.
Quick answer: Cyber Essentials Plus is the audited tier of the UK government’s Cyber Essentials scheme. It verifies — through external vulnerability scans and a sample of your laptops, servers and mobile devices — that the five technical controls (boundary firewalls, secure configuration, access control, malware protection, security update management) are properly in place. Expect £1,500–£8,000 + VAT, 6–12 weeks end-to-end and a one-year certificate. Mandatory for many UK government contracts and increasingly required by enterprise customers.
The five controls — what gets audited
| Control | What the auditor checks | Common failures |
|---|---|---|
| 1. Boundary firewalls & internet gateways | External vulnerability scan of all internet-facing IPs; admin password policy; no default credentials | RDP exposed; default router password; admin web UI exposed |
| 2. Secure configuration | Sample of laptops & servers; unnecessary accounts disabled; auto-run off; software inventory | Old test users still active; auto-run enabled; unused software with vulnerabilities |
| 3. User access control | MFA on cloud admin accounts; least-privilege; account lifecycle process | No MFA on M365 admins; shared accounts; ex-staff still have access |
| 4. Malware protection | EDR / AV deployed and updating on every endpoint; sandboxing for downloads; web filtering | EDR not on laptops; no scanning of external drives; missing on Mac fleet |
| 5. Security update management | OS & application patches within 14 days; high-severity within 14 days; unsupported software removed | Java 8 still installed; old Office 2016; pending patches over 30 days |
Cyber Essentials vs Cyber Essentials Plus
Cyber Essentials (basic)
Self-assessment questionnaire scored by IASME. £300–£500 + VAT. Trust-based.
Cyber Essentials
- Self-assessment 64-question form
- £300 + VAT (micro), £500 + VAT (small)
- 5 controls — same as Plus
- 2-week turnaround
- No on-site or remote audit
- Annual renewal
Cyber Essentials Plus
Independently verified. External scans + device sample audit. From £1,500 + VAT. Evidence-based.
Cyber Essentials Plus
- Includes the basic questionnaire
- External vulnerability scan
- Authenticated scan of sample devices
- Email phishing test (file + link payload)
- Auditor reviews evidence in person/remote
- £1,500–£8,000 + VAT
- Required for most gov contracts
The audit timeline
- Week 0–2 · Prep
Pre-audit gap analysis
Your assessor (or IT partner) walks the five controls, identifies gaps, and provides a remediation list. Most failures are caught here.
- Week 2–3 · Submit
Complete the questionnaire
64 questions on IASME’s portal. Pass this first; CE+ requires a passing CE certificate as the prerequisite.
- Week 3 · Scan
External vulnerability scan
Auditor scans every public IP. Output: list of internet-exposed services and any CVEs.
- Week 3–6 · Fix
Remediate findings
Patch software, disable RDP, rotate creds, deploy EDR to missing devices, remove EOL apps.
- Week 6–7 · Audit day
Authenticated scan on a random sample (typ. 10–15% of fleet, min 1 of each OS). Test of email filtering with mock payloads. Mobile-device review.
- Week 7–8 · Certify
Certificate issued
If you pass, IASME issues the certificate within 5 working days. Valid 12 months — no automatic renewal, but most assessors will book the next year.
Need Cyber Essentials Plus certification?
Proactive managed IT, cybersecurity audits and 24/7 monitoring from a UK team. Get a free quote.
Or call us on 0333 015 2615
What it costs in 2026 — by company size
Micro (1–10 staff)
£1,500+VAT
Single site, <15 endpoints. Includes pre-audit help and one re-test if needed.
- External + authenticated scan
- Phishing test
- Mobile device sample
- Certificate & logo
- Help with remediation
Small (10–50 staff)
£3,500+VAT
Most common SMB tier. Includes full pre-audit gap analysis and remediation guidance.
- Pre-audit gap analysis
- Remediation worklist
- Up to 3 sites
- Two re-tests included
- Help with M365 hardening
Medium (50–250)
£6,500+VAT
Larger device samples, multi-site, BYOD policy review.
- BYOD policy review
- Multi-site (up to 6)
- Larger device sample
- Mobile fleet review
- Annual renewal discount
How to pass first time
- Run a pre-audit scan yourself — Nessus, OpenVAS or Tenable IO will find what the assessor will find. Fix it before they look.
- Enforce MFA on every cloud admin — M365, Google Workspace, AWS, Azure. No exceptions.
- Patch within 14 days — Windows Update for Business, Intune Update Rings or Jamf for Mac. Document the policy.
- Remove EOL software — Java 8, Office 2016, old VPN clients. If you must keep them, isolate on VLAN with no internet.
- Standardise EDR coverage — every laptop, server, virtual machine. No “just for now” gaps.
- Document a leaver process — auditor will ask “show me what happens when an employee leaves”. Have a one-pager ready.
- Take a copy of every patch policy — a screenshot of Intune Update Rings is enough evidence.
Need help passing Cyber Essentials Plus first time?
Our cybersec team takes UK SMBs through CE+ in 6–8 weeks with a 100% first-time pass rate. Pre-audit gap analysis is free.
Bonus tip: Compliance audits are easier to run in batches. Many UK landlords pair their Cyber Essentials Plus renewal with their EPC and MEES rules for commercial property review — especially with the EPC C threshold landing in 2027.
Cyber Essentials Plus — FAQs
Yes — the 2022 IASME update brought cloud explicitly into scope. M365, Google Workspace, AWS, Azure, Salesforce all need MFA on admins, patched configurations and access lifecycle.
Yes — any device used for work is in scope, regardless of location. Home routers themselves are out of scope (they’re consumer kit) but the laptop must have its own host-based firewall on.
Company-managed phones are in scope. BYOD phones are in scope only if they access organisational data — typical UK SMB approach is to require MDM enrolment for any device touching work email.
It demonstrates baseline hygiene and most cyber insurers offer a discount. For full cover and lower premiums, insurers increasingly want CE+ plus 24/7 SOC monitoring and tested backups.
Related Reading
More from the Connection Technologies blog.