Cyber Essentials Plus

It gives your customers, contracts and tenders independent, verified evidence that the basics are done properly. Certification lasts 12 months, and you renew it every year.

Do you need Cyber Essentials Plus?

Cyber Essentials Plus confirms that you have done Cyber Essentials correctly. If you need to evidence your Cyber Essentials, choose CE+. If not, its only other benefit is showing a higher commitment to cyber security.

You'll usually need CE+ when:

• a customer, framework or tender asks for it by name;
• a contract mentions independent technical testing or a higher level of assurance;
• a government contract is higher risk: under PPN 014, CE+ “should be used when there is a higher risk of cyber security threats”.

If you're not sure, check the contract wording first.

How the CE+ audit works

The rules changed with the Danzell update on 27 April 2026, and they leave less room for error than before.

1. Certify Cyber Essentials first. CE+ builds on a current Cyber Essentials certificate, and the CE+ audit must be completed within three months of it.
2. The first sample is tested. The assessor tests a random sample of your user devices, your internet gateways and any servers with services open to the internet. If every device in the sample has its required updates, CE+ can be awarded.
3. If missing security updates are found, you have 30 days to apply them, and the fixes must go across your whole Cyber Essentials scope, not just the devices that were tested. The assessor then retests the first sample. If updates are still missing after the 30 days, CE+ fails and your Cyber Essentials certificate is revoked.
4. A second random sample is tested to confirm the fixes were applied everywhere. It's chosen only after the first sample is tested, you're told which devices no more than 72 hours or three working days beforehand, and it must be tested within the same 30-day window. There's no separate remediation window for the second sample. If you have only a few devices, the second sample is the devices not tested the first time; if every device was already tested, they're all rescanned.
5. Certification. You receive your Cyber Essentials Plus certificate and audit report.

What the second sample decides

That's why we recommend planning CE+ at the same time as your Cyber Essentials, and making sure every device is fully patched before the audit starts.

How we deliver Cyber Essentials Plus

We deliver CE+ through one of our partner CE+ consultants, so you have one point of contact from start to finish.

• Getting Cyber Essentials with us? If you're getting your Cyber Essentials through us, we recommend our Supported Service. Your assessor checks every answer before submission, so what's declared in your Cyber Essentials matches what the CE+ audit will find.
• Optional pre-CE+ assessment check. Before the formal audit starts, we can check your systems for non-compliant items while there's still time to put them right. It reduces the risk of a failed first sample triggering a second one.
• A fully managed remote audit, carried out by one of our partner CE+ consultants and building on your current Cyber Essentials certification. Your CE+ certificate is issued under their certification body.
• Already hold Cyber Essentials, through IASME or another certification body? Send us your Cyber Essentials report and certificate and we'll take it from there.

As with all our work, we tell you exactly what needs to change and why; the products and suppliers you use stay your choice.

What does Cyber Essentials Plus cost?

CE+ is priced individually, because the cost depends on the size and complexity of the systems in scope. Tell us a little about your organisation and we'll usually send your quote within 24 hours.

Request a CE+ quote

Questions people ask