When buying Cyber Essentials and Plus together is the cheaper route

The most expensive mistake in Cyber Essentials is not choosing the wrong provider. It is certifying in January, being asked for Plus in June, and discovering that your certificate has aged out and you are paying the base fee a second time before the audit can even be booked. It happens constantly, it is entirely avoidable, and the fix is a conversation at the start rather than a purchase at the end.

The rule that causes it

Cyber Essentials is a prerequisite for Cyber Essentials Plus, and the certificate has to be under three months old when the Plus certificate is issued. Not a year. Three months.

That window exists for a sensible reason. Plus audits the controls you declared in your self-assessment, and a declaration made eleven months ago is not evidence of anything much. But it means the two certifications are a single piece of planning rather than two separate purchases, and treating them as separate is what costs money.

What the combined price saves

We price the two together as a single package, and the saving is the Cyber Essentials element at roughly half the standalone fee:

The comparison in the last column is against buying Cyber Essentials at the published fee and Plus separately. The real saving is larger than the table suggests if the alternative was certifying twice because the window closed, which is a full extra base fee rather than a discount foregone.

Both options are on the Cyber Essentials Plus page as a single dropdown, so you can see the difference before you commit.

When buying both together is right

• A customer has asked for Plus. The obvious case. You need both, so buy both.
• You do not hold Cyber Essentials at all. Then there is no decision: the base certificate has to exist first, and doing it as one engagement is cheaper and faster than two.
• Your certificate is more than three months old. It cannot support a Plus audit, so you are recertifying either way.
• Plus is plausible within the year. If you supply primes, defence, or anyone in a regulated chain, it is worth assuming it is coming.

When it is the wrong call

We would rather tell you not to buy something than sell you the wrong level, so, plainly:

If nobody has asked for Plus, you probably do not need it. A great many organisations arrive asking for the audited level because a contract used the phrase “Cyber Essentials” and somebody assumed the better one was meant. Plus costs more, takes longer and tests more, which is right when it is required and wasted when it is not. Send us the contract wording and we will read it. The difference is set out on Cyber Essentials versus Cyber Essentials Plus.

If your certificate is nearly new and Plus is genuinely a year away, there is no advantage to bundling now, because the window will have closed by the time the audit happens.

If your estate is not ready, buying Plus does not make it ready. Plus is a hands-on audit of a sample of your devices, and patching behind the fourteen day window or multi-factor authentication exceptions nobody has reviewed will be found. That is not a reason to avoid it, but it is a reason to look first.

What happens on the combined route

Cyber Essentials first, assessed within one business day of submission. Then the Plus audit on a booked date, sequenced so the base certificate is comfortably inside its window when the Plus certificate is issued. Both the assessment and the certificate come from us, because we are an appointed Certification Body for both, so there is no handoff to another provider between the two halves.

The audit samples your devices under IASME’s rules rather than charging per device, which is why the price is a fixed band by organisation size rather than a per-seat calculation. More on what the audit actually does on the day is on the fast Cyber Essentials Plus page.

Common questions