Cyber Essentials Plus: get ready for the technical assessment

When Plus is the right route

Start with the wording your customer, tender or insurer has given you. If it explicitly asks for Cyber Essentials Plus, the verified self-assessment alone will not meet that request. If it only asks for Cyber Essentials, use our standard certification packages to compare the available support.

Plus can also give your organisation stronger evidence that its security controls work. We help you weigh that requirement against the scope and cost before booking the assessment.

What the independent assessment checks

Plus tests the same five control areas as Cyber Essentials: firewalls, secure configuration, access control, malware protection and security updates. The assessor checks a sample of the environment, including devices and relevant internet-facing systems, using technical tests and vulnerability checks.

Our preparation turns that into practical work for your team: establish which systems belong in scope, check that supported software and updates are in place, review account controls, and assemble the information the assessor needs. The certification body confirms the sampling and test arrangements for your organisation.

See the NCSC scheme overview and IASME’s scheme FAQs for the official explanation.

What the £2,995 starting package includes

The published starting price is £2,995 + VAT for a straightforward remote scope in the assessment provider’s 1–9 licence band. That band is an assessment pricing condition; we confirm how it applies to your organisation before issuing a quote.

Your package includes:

• the Cyber Essentials certification fee;
• the remote Cyber Essentials Plus technical assessment fee;
• Nerdster’s pre-assessment technical review;
• evidence preparation and coordination with the assessor; and
• support during the agreed audit window.

Separately scoped: implementing technical fixes, replacement devices or software, additional licences, larger or more complex environments, and onsite assessment. Your written quote explains these costs, the responsibilities of your IT provider and any assessor conditions.

Already hold a suitable Cyber Essentials certificate? Tell us its date and scope so we can confirm what can be reused and quote for the work you need.

Request a scoped Plus quote

Plan Cyber Essentials and Plus together

Cyber Essentials must come first. IASME explains that if it was achieved less than three months before Plus certification, you do not need to repeat the self-assessment questions. We check dates with the certification body and plan the preparation and assessment around them.

Allow time for changes before committing to an audit date. A device that needs replacing or software that needs upgrading can take longer than preparing the evidence. Tell us your contract or renewal deadline at the start so we can discuss a realistic schedule.

A clear division of responsibilities

1. Scope and quote. We review your requirement, current certificate, organisation size, systems and deadline.
2. Readiness review. We identify gaps and agree an action plan, with named responsibilities for your team, your IT provider and Nerdster.
3. Prepare and coordinate. Agreed fixes are completed and the evidence and assessment arrangements are checked.
4. Independent assessment. The approved body performs the testing and makes the certification decision.

Certification lasts 12 months, so discuss renewal before the expiry date. Ongoing support is available under a separate scope if you want help keeping the controls maintained.

Using Plus for defence work

DCC Levels 2 and 3 require Cyber Essentials Plus, but a Plus certificate alone does not meet the wider DCC requirements. If a defence customer has specified a DCC level, use our Defence Cyber Certification readiness service so the requirements are scoped together.