When a company hears about online Essentials for the first time, it’s usually seen as a simple, low-cost certification that shows a basic level of online cleanliness. That’s exactly why a lot of businesses do it—either because a client or supplier has asked for proof of basic security controls or because it’s a requirement in a tender document. But once the certificate is in hand, a strange trend starts to show itself. After passing the standard Cyber Essentials test, a lot of companies decide to go after Cyber Essentials Plus within months or even weeks. If you know why this happens, you can learn a lot about how mature an organisation’s cyber security is and why a self-assessed certificate often feels like only half the job.
The space between self-evaluation and peer review
For the basic Cyber Essentials certification, you have to fill out a form about yourself. Before giving the certificate, a qualified examiner looks over the answers to a set of questions about the organisation’s firewalls, safe setup, user access control, malware protection, and patch management. This method is useful because it makes a company think about its security in a planned way, often for the first time. It depends on the honesty and technical knowledge of the person who fills out the questionnaire, though, so there is no way for someone outside the organisation to check what is really going on with its devices and networks.
That hole is filled by Cyber Essentials Plus. Instead of just believing what people say, a technical assessor goes to the organization, either virtually or in person, and tests the systems that were asked about in the questionnaire. Vulnerability scans are carried out, sample devices are checked for missing patches, and controls are checked in real life instead of just on paper. This difference is the main reason why many business owners decide to upgrade. The extra value becomes clear once they know that the standard certificate only confirms what they said, while Cyber Essentials Plus confirms what is really true.
Pressure from clients and the supply chain
Cyber Essentials Plus is required by many of the businesses that the businesses that the businesses work with. This is why the businesses need it. Because supply chains are getting longer and more digitally linked, bigger companies are becoming more wary of how their sellers and subcontractors handle security. More specific security standards are now written into contracts by procurement teams. This is because a breach at a small source can just as easily reveal a bigger client’s data as a breach at the client itself.
Eighteen months ago, a basic Cyber Essentials certificate might have been enough for a client. But now, many procurement departments ask for Cyber Essentials Plus, especially for contracts that involve sensitive data, financial information, or access to critical infrastructure. Businesses that want to keep contracts they already have or win new ones often find that the standard license doesn’t open all the doors it used to. It stops being a choice to upgrade and starts being a business necessity.
Thoughts on insurance and risk
Getting cyber insurance is now a normal part of running a business, but insurers are becoming pickier about the risks they will take. Some insurance companies now give better rates or make the application process easier for businesses that have Cyber Essentials Plus instead of the standard certificate. This is because the independent verification makes them more confident in the security claims being made.
Some businesses have had bad experiences when they tried to get cyber insurance and had to deal with long surveys or higher rates. This makes a verified license very appealing. Cyber Essentials Plus effectively gives a third party proof that has been checked by a third party. This lowers uncertainty, and insurers offer better terms when uncertainty is low. Businesses that originally only wanted the basic certificate to be compliant often change their minds when they learn that a small extra investment in Cyber Essentials Plus could make a big difference in their insurance coverage.
Having more confidence after getting the first certification
It’s easy to forget that this progression also has a psychological and organisational side to it. In order to complete the standard Cyber Essentials process, a business may have to properly record its IT estate for the first time. When you ask about things like firewall configuration, patch management schedules, and user access permissions, you can often find holes that no one else had seen because they weren’t asked to think about them in a structured way.
When business owners do this exercise once, they usually get a better idea of their own security and want to check more often to make sure the changes they made were effective. When asked, “Have we described sensible controls?” the standard certificate gives an answer. “Do those controls actually work when tested?” is what Cyber Essentials Plus says. Businesses that have spent time and money making their security tighter will want to see proof that their efforts have paid off. An expert technical review gives them just that.
Not just a license, but real security benefits
You would be wrong to think that companies only upgrade for financial or image reasons. Cyber Essentials Plus has a technical verification process that can find problems that you can’t find by yourself. When you scan for vulnerabilities, you might find software that an internal IT team thought was up to date but hasn’t been updated. Device checks might show that there is a security strategy in writing, but it hasn’t been applied regularly to all laptops and workstations that are in use. These results are not really failures, but rather chances. In fact, many businesses say that the Cyber Essentials Plus process is when their security went from being theoretical to being able to be shown to be real.
This practical value is often very important to businesses that have grown quickly or have a mix of company-owned and personal devices. The independent and hands-on nature of the assessment gives leadership teams peace of mind that a questionnaire alone can’t give. This peace of mind is especially important as a business grows and the consequences of a security breach get worse.
A step that makes sense instead of a jump
The fact that the change from the standard certificate to Cyber Essentials Plus is gradual rather than scary is probably the most important reason why businesses do it. If you’re already familiar with the standard certification process, the technical assessment will feel like a natural next step instead of something completely new. This is because the control areas underneath are the same. A business already knows about the five main control areas that the plan covers and has set up the necessary paperwork, rules, and technology. When you upgrade to Cyber Essentials Plus, you don’t have to start from scratch. Instead, you have to show that the work you’ve already done is solid through independent testing.
Cyber Essentials Plus is a good next step for businesses of almost any size because it can be added on to over time. A lot of the time, smaller companies that weren’t sure if they wanted to go through a more thorough review find that the step to full expert verification is much easier than they thought. Larger businesses, on the other hand, usually plan for Cyber Essentials Plus from the start, seeing the basic certificate as just the first step in a longer-term plan for protection.
In conclusion
Moving up from Cyber Essentials to Cyber Essentials Plus is a reasonable step in the way companies think about cyber security. Once decision-makers know the difference between self-assessment and independent technical verification, what starts out as a compliance exercise (often done to please a client or meet a tender requirement) often turns into a real commitment to tested and verified security. Customers and supply lines putting pressure on businesses, better insurance terms, rising employee trust, and the finding of real security holes all make Cyber Essentials Plus seem like the natural end of a journey that starts with the standard certificate. It’s not a question of whether or not many businesses will go after Cyber Essentials Plus; it’s just a matter of when.