Once a business decides it needs Cyber Essentials, a follow-up question often appears: standard certification or Cyber Essentials Plus? Both belong to the same government-backed scheme and share the same five technical controls, but they differ in how those controls are verified, how long certification takes and what it costs. Under time pressure, the choice matters. Choosing Plus when it is not required can add weeks, while choosing the basic certificate when a contract demands Plus leaves you with the wrong one entirely.

What Cyber Essentials Covers

Cyber Essentials is a verified self-assessment. Your organisation completes a questionnaire describing how it meets the five controls: firewalls, secure configuration, security update management, user access control and malware protection. A qualified assessor then reviews those answers and decides whether the standard is met. There is no on-site visit or technical testing, which is why it moves quickly once your controls are in place. With Solusec, the assessment happens within one business day as standard. For many businesses, this is exactly what customers and contracts ask for.

What Cyber Essentials Plus Adds

Cyber Essentials Plus adds a hands-on technical audit. Instead of relying only on your answers, an assessor tests a sample of your systems to confirm the controls actually work. This typically includes vulnerability scanning, checking selected devices for patching and configuration, and testing malware protection and multi-factor authentication. You must hold the standard certificate first, and the Plus audit must be completed within a set period afterwards, currently three months. Because it involves scheduling and testing real devices, it takes longer and costs more.

Check What the Requirement Actually Says

The key step is checking exactly what your customer, tender or insurer requires. Many specify Cyber Essentials alone, in which case buying Plus just adds time and cost. Others explicitly require Plus, often where sensitive data is involved. If the wording is unclear, ask before buying. Where only the standard certificate is needed and time is tight, fast cyber essentials is usually the sensible route, with assessment within one business day or the same day with an urgent option.

Timing and Speed Considerations

Speed looks different at each level. For the standard certificate, your timeline is mainly shaped by preparation, since the assessment is quick. Plus adds scheduling, testing and possibly remediation if the audit finds issues. A device that looked fine on paper might be missing an update, or a browser plug-in might fall short, and these must be fixed before Plus is awarded. If you know Plus will be needed eventually, prepare with that in mind from the start so the audit runs smoothly.

Choosing the Right Path for Your Business

For most small and medium-sized businesses meeting a straightforward customer requirement, standard Cyber Essentials is the right starting point. It is quicker, more affordable and widely recognised, with Solusec''s pricing starting at £320 plus VAT for micro organisations. Plus makes sense when a contract demands it, when you handle sensitive data, or when you want independent proof your controls work. Some organisations certify at the standard level to meet an immediate deadline, then progress to Plus. The underlying work is the same either way.