The two certification levels

Cyber Essentials

A self-assessment. You complete a questionnaire covering the five controls across your organisation's scope, an independent assessor from a certification body reviews and verifies your answers, and a certificate is issued if you meet the requirements.

Cyber Essentials Plus

The same five controls, but independently, technically verified. A qualified assessor runs vulnerability scans and hands-on technical tests against a sample of your devices, rather than relying on your self-reported answers. It's a materially higher bar, and some contracts specifically require it rather than the base-level certificate.

Most organisations start with Cyber Essentials and move to Plus later, often because a client or public sector contract requires it.