# Cyber Essentials Plus: what does the technical test add? Plus checks whether the security controls in your answers work on your systems. The Assurance Desk. Published 7 October 2026. Last checked 7 October 2026. Part of the guide [How much is Cyber Essentials, and what does it ask?](https://theassurancedesk.com/guides/cyber-essentials-cost-and-requirements.md). **The short answer.** Cyber Essentials Plus adds independent technical testing to the same five controls covered by Cyber Essentials. The assessor checks whether those controls work in practice. The price depends on your network’s size and complexity ([NCSC, Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview), checked 7 October 2026). ## What does Plus add to Cyber Essentials? Basic Cyber Essentials uses answers signed off by a board member or equivalent and marked by an assessor. Plus adds a technical test. The difference is how the controls are checked, rather than a new list of controls ([NCSC, Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview), checked 7 October 2026). **Answers checked, then controls tested** - **Cyber Essentials** - Complete the security questions. - Have the answers signed off. - An assessor marks the answers. - **Cyber Essentials Plus** - Covers the same five controls. - Adds independent technical testing. - Checks whether controls work in practice. The same five controls sit behind both levels. Source: NCSC, Cyber Essentials, https://www.ncsc.gov.uk/cyberessentials/overview (checked 7 October 2026) ## How should you prepare for the test? Start by reading the free question set and requirements. If parts do not make sense, a licensed certification body can help explain how they apply to your company ([NCSC, Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview), checked 7 October 2026). Preparation can be a separate service. For example, Secarma’s Digital Marketplace listing offers help defining the scope, reviewing the questionnaire and finding gaps before assessment. Scope means what the work will cover ([applytosupply.digitalmarketplace.service.gov.uk, Cyber Essentials Plus Certification, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/188147867651090), checked 7 October 2026). **Questions to settle before booking** | Ask the assessor | Why the answer helps | | --- | --- | | Which systems are in scope? | The Plus price depends on network size and complexity. | | What preparation does the quote include? | Questionnaire review and gap checks can be offered as preparation services. | | Who will explain unclear assessment questions? | A licensed certification body can provide this help. | Source: NCSC, Cyber Essentials, https://www.ncsc.gov.uk/cyberessentials/overview (checked 7 October 2026); applytosupply.digitalmarketplace.service.gov.uk, Cyber Essentials Plus Certification, Digital Marketplace, https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/188147867651090 (checked 7 October 2026) ## What does Cyber Essentials Plus cost? The NCSC describes Plus pricing as based on your network’s size and complexity. The £320 plus VAT starting figure on its page is for basic Cyber Essentials certification. Do not use it as a Plus quote ([NCSC, Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview), checked 7 October 2026). Ask the firm to separate the assessment from any preparation it offers. Then ask what would change the price. That is more useful than comparing totals with different work inside them ([NCSC, Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview) and [applytosupply.digitalmarketplace.service.gov.uk, Cyber Essentials Plus Certification, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/188147867651090), checked 7 October 2026). ## Does a firm’s own certificate tell you what it sells? Keep the firm’s own certificate separate from the assessment you want to buy. The Assurance Desk recorded Amethyst Risk Management’s statement that it holds Cyber Essentials Plus from its website on 19 September 2026. That record is about the firm’s own certification ([The Assurance Desk, Amethyst Risk Management Limited profile](https://theassurancedesk.com/advisers/amethyst-risk-management), checked 7 October 2026). When buying an assessment, ask who will assess you and which licensed certification body is responsible. When buying preparation, ask what help you will receive before the test ([NCSC, Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview) and [applytosupply.digitalmarketplace.service.gov.uk, Cyber Essentials Plus Certification, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/188147867651090), checked 7 October 2026). ## What to do 1. Read the question set and requirements with the person who runs your IT ([NCSC, Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview), checked 7 October 2026). 2. Ask the assessor to explain the systems included in the quote ([NCSC, Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview), checked 7 October 2026). 3. Separate preparation services from the assessment in your comparison ([applytosupply.digitalmarketplace.service.gov.uk, Cyber Essentials Plus Certification, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/188147867651090), checked 7 October 2026). 4. Agree who on your team will answer questions and arrange access. ## Common questions ### Is Plus a different set of security rules? No. Both levels assess the same five controls. Plus independently tests whether they work in practice ([NCSC, Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview), checked 7 October 2026). ### Is the basic assessment just an unchecked form? No. The answers are signed off by a board member or equivalent and marked by an assessor ([NCSC, Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview), checked 7 October 2026). ### Can we buy help before the test? Yes. Secarma’s public service listing, for example, offers scope checks, questionnaire review and gap analysis as preparation services ([applytosupply.digitalmarketplace.service.gov.uk, Cyber Essentials Plus Certification, Digital Marketplace](https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/188147867651090), checked 7 October 2026). ## Where next - [Customer security questionnaires: what they ask and how to answer](https://theassurancedesk.com/guides/customer-security-questionnaires-what-they-ask-and-how-to-answer.md) - [What does ISO 27001 certification take, and who can certify you?](https://theassurancedesk.com/guides/iso-27001-certification-and-who-can-certify-you.md) - [How much is Cyber Essentials, and what does it ask?](https://theassurancedesk.com/guides/cyber-essentials-cost-and-requirements.md) ## Sources - NCSC, Cyber Essentials: https://www.ncsc.gov.uk/cyberessentials/overview (checked 7 October 2026) - applytosupply.digitalmarketplace.service.gov.uk, Cyber Essentials Plus Certification, Digital Marketplace: https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/188147867651090 (checked 7 October 2026) - The Assurance Desk, Amethyst Risk Management Limited profile: https://theassurancedesk.com/advisers/amethyst-risk-management (checked 7 October 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.