Is Cyber Essentials Plus certification worth the investment for small firms?

Cyber Essentials Plus is a stepped-up version of Cyber Essentials that includes hands-on technical testing by an assessor and a certificate recognised by the NCSC; it’s aimed at firms that need stronger assurance for customers, suppliers or insurers and certificates are valid for 12 months (NCSC).

What Cyber Essentials Plus actually checks

At its core, Cyber Essentials Plus verifies the same five basic controls as Cyber Essentials but with an assessor performing active checks rather than just reviewing paperwork. The five areas are: boundary firewalls and internet gateways; secure configuration; access control; malware protection; and patch management. Plus adds practical verification — for example, an assessor will attempt logins, inspect device configuration and validate patch status on a sample of machines, rather than taking an attestation alone.

This matters because the assessment gives you independent evidence that those controls are implemented, not just claimed. That independent evidence is what many buyers and insurers ask to see. The NCSC explains the scheme and the difference between self-declaration and tested assurance on its Cyber Essentials pages; use that resource when you need the official checklist and scheme rules.

Commercial value: who benefits and how it pays back

Think of Cyber Essentials Plus as a commercial credential rather than a pure security project. It’s useful when a contract, tender or potential client explicitly asks for tested assurance, or when you want a clearer position with cyber insurers. It reduces the negotiation friction — you can show an assessor-signed certificate instead of lengthy technical evidence.

Procurement: public-sector buyers and many larger corporates commonly ask for Cyber Essentials (and sometimes Plus) in their supplier checks.
Insurance: some underwriters recognise Cyber Essentials as a risk control when setting policy terms or premiums.
Sales credibility: it’s a simple third-party signal to clients that you follow basic cyber hygiene.

That said, Plus is not a silver bullet. If your business processes or data handling require a higher standard (payment card handling, health records, or complex SaaS platforms), you’ll still need additional controls or certifications. Evaluate whether the reduced procurement friction or potential insurance benefit outweighs the upfront and ongoing effort for your size and sector.

How to prepare, typical effort and next steps

Preparation is straightforward but practical. An assessor will test a sample of devices and configurations, so tidy your estate first. Key preparatory actions include:

Inventory and scope: list devices, servers and cloud services that are in scope.
Patch and update: ensure operating systems and key apps are patched and supported.
Access controls: enable unique accounts, remove shared admin credentials and add multi-factor authentication where possible.
Malware protection: deploy and update endpoint protection and verify logs.
Configuration: lock down default passwords, close unused ports and check firewall rules.

A small firm with 10–200 staff can typically complete these steps in a few days to a few weeks depending on backlog and third-party systems. Costs depend on whether you use external consultancy or do the work in-house; expect a range from a few hundred to a few thousand pounds when you add assessor fees, internal labour and any remedial fixes. If you want help turning those tasks into a workable plan, consider a testing and remediation service such as a Cyber Essentials service that combines the assessment with hands-on fixes.

When booking an assessor, ask what their sample size is, whether they test remote/home devices, and if cloud-hosted services fall inside the scope for your business. Keep a short evidence pack (screenshots of patch status, MDM reports, firewall rules) to speed the process.

When to ask for help

If your IT team is stretched, you have more than a handful of remote devices, or you’re tendering for contracts that explicitly ask for tested assurance, bring in experienced help. A short engagement that focuses on the five controls will typically get you certified faster, reduce the risk of failing the assessor checks, and leave you with clearer, repeatable processes — which saves time and money next year.

FAQ

How long does a Cyber Essentials Plus certificate last?

Certificates are valid for 12 months, after which you must be reassessed to renew (see the NCSC Cyber Essentials scheme page).

Will Cyber Essentials Plus reduce my cyber insurance premium?

It can help in negotiations: some insurers offer better terms or simpler underwriting if you hold tested assurance, but outcomes vary by insurer so check with your broker before relying on a premium cut.

How much downtime should I expect during an assessment?

Assessors sample devices and usually work remotely; most businesses report little to no planned downtime if they prepare evidence and patch systems beforehand.

Can I fail Cyber Essentials Plus and what then?

Yes — failures are typically about unpatched systems, weak access control or poor configuration; you get a set of remediation actions and can re-test once fixes are applied.