Enquiries: 0800 3167566 | Support: 020 8545 8545
CYBER SECURITY SOLUTIONS
CYBER ESSENTIALS AND CYBER ESSENTIALS PLUS CERTIFICATION
Get certified, spread the cost and keep your controls in place between renewals.
CYBER ESSENTIALS PLUS CERTIFIED
ISO 27001 CERTIFIED
B CORP CERTIFIED
ESTABLISHED IN 1992
What is Cyber Essentials and Cyber Essentials Plus certification?
Cyber Essentials is a UK government-backed certification scheme, run by IASME on behalf of the National Cyber Security Centre. It shows that an organisation has five technical controls in place which, together, protect against the most common cyber attacks, including malware, ransomware and phishing. Cyber Essentials is assessed through a self-assessment questionnaire, verified by a certification body. Cyber Essentials Plus covers the same controls and adds a hands-on technical audit of your systems.
Opus helps mid-market and enterprise organisations understand the requirements, close the gaps, prepare the evidence and coordinate the route to certification. With Opus guiding the process, most businesses achieve Cyber Essentials within three to four weeks. Cyber Essentials Plus takes longer, depending on the changes needed.
The areas covered by the Cyber Essentials control framework
The five Cyber Essentials controls are about reducing exposure to common cyber attacks, rather than broadly identifying known and unknown vulnerabilities.
1
FIREWALLS AND ROUTERS Securing your Internet connection
2
SECURE CONFIGURATION Securing all your company devices, applications and software
3
ACCESS CONTROL Control access to your data and services
4
MALWARE PROTECTION Protection against viruses and other malware
5
SOFTWARE UPDATES Keeping your devices and software up to date
What are the two levels of Cyber Essentials certification?
There are two levels of Cyber Essentials certification: Cyber Essentials and Cyber Essentials Plus. Cyber Essentials uses a verified self-assessment, while Cyber Essentials Plus adds an independent technical audit to confirm that the same five security controls are working effectively. Cyber Essentials must be achieved before completing the Cyber Essentials Plus assessment.
Tell us your deadline and whether you need Cyber Essentials or Cyber Essentials Plus. We will show you what stands between you and certification, and what it would take to close the gaps.
What is the difference between Cyber Essentials and Cyber Essentials Plus?
| Cyber Essentials | Cyber Essentials Plus | |
|---|---|---|
| How it is assessed | Self-assessment questionnaire, verified by a certification body | The same questionnaire, plus a hands-on technical audit of your systems |
| What it proves | The five controls are in place, as declared | The five controls are in place and have been tested |
| Timing | Can be achieved first, on its own | The audit must be completed within three months of achieving Cyber Essentials |
| Fee | Set by IASME | Quoted individually, based on scope |
| Renewal | Every 12 months | Every 12 months |
| Commonly required by | UK central government contracts that handle personal or sensitive information, and many supply chains | Customers, tenders and insurers that want evidence the controls have been tested |
How does Opus support Cyber Essentials Plus certification?
Readiness review. We assess your current setup against the five controls and agree the scope for certification.
Remediation plan. Findings become a prioritised action plan. Opus can complete the work or support your IT team to do it.
Vulnerability scanning. Scanning aligned to the certification requirements finds issues before the assessor does.
Our partner carries out the Cyber Essentials Plus technical audit. We coordinate the evidence and the timetable.
Improvement beyond certification. Weekly scanning and progress reviews keep the controls in place between annual renewals.
What is included in Cyber Essentials support from Opus?
| Service | What it covers |
|---|---|
| Readiness review and gap analysis | Identify gaps, with deeper readiness support available through consultancy |
| Remediation guidance | Practical guidance, with complex remediation supported through consultancy |
| Continuous vulnerability scanning | Ongoing scanning identifies vulnerabilities beyond point-in-time assessments |
| Evidence and assessment support | Assistance providing evidence and working with customers and assessors |
| Cyber Essentials Plus assessment | Coordination and support throughout the certification and assessment process |
| Assessor updates and check-ins | Regular progress check-ins, with consultancy calls where required |
| Ongoing improvement | Continuous scanning supports ongoing security improvement after certification |
| Penetration testing | Specialist testing for deeper technical security assurance where required |
How much does Cyber Essentials certification cost?
Cyber Essentials Plus has no fixed fee. The technical audit is quoted individually, based on the number of devices, users and systems in scope. IASME sets the Cyber Essentials assessment fee by organisation size:
- 0 to 9 employees: £320 plus VAT
- 10 to 49 employees: £440 plus VAT
- 50 to 249 employees: £500 plus VAT
- 250 employees or more: £600 plus VAT
For businesses that want more than a one-off certification project, Opus packages Cyber Essentials Plus readiness, coordination, consultancy and weekly vulnerability scanning into a monthly service.
How do Cyber Essentials and ISO 27001 work together?
Cyber Essentials covers five technical controls. ISO 27001 is a full information security management system, with 93 controls in its 2022 version spanning people, process and technology.
The two overlap, and many organisations hold both. Cyber Essentials Plus evidences the technical baseline, while ISO 27001 shows how security is managed across the business. If you need ISO 27001 as well, our compliance as a service solution manages the policies, risks and evidence alongside your Cyber Essentials work.
Why choose Opus for Cyber Essentials
Opus coordinates your certification journey, from readiness through to assessment and ongoing improvement. For managed customers, we can coordinate remediation, with any additional work agreed separately. Where required, we work with specialist partner Rootshell Security for scanning, testing and assessment.
- One point of contact. Opus coordinates readiness, remediation requirements, scanning and assessment, with remediation tracked through the vulnerability portal or managed service.
- Certification linked to real improvement. Weekly vulnerability scanning keeps the controls in place between renewals.
- Predictable cost. The monthly service spreads the cost of certification support across the year and includes the assessment fee.
- We hold the certifications we help you achieve. Opus is Cyber Essentials Plus certified and certified to ISO 27001.
Services related to Cyber Essentials
Managed Vulnerability Scanning
Weekly scanning, prioritisation and reporting that show how risk reduces over time.
Enterprise Password Management
Strong, unique passwords and secure sharing, to support the user access control requirements.
Compliance as a Service
For organisations that need ISO 27001 or other frameworks beyond Cyber Essentials.
Read our live client feedback
Cyber Essentials FAQs
Both cover the same five technical controls. Cyber Essentials is assessed through a self-assessment questionnaire verified by a certification body. Cyber Essentials Plus adds a hands-on technical audit of your systems.
IASME sets the fee by organisation size. Cyber Essentials Plus audits are quoted individually based on scope. The Opus monthly service includes the assessment fee.
With Opus guiding the process, most businesses achieve Cyber Essentials within three to four weeks. Cyber Essentials Plus takes longer, depending on your current setup and the changes needed.
No. You need Cyber Essentials first. The Cyber Essentials Plus audit must then be completed within three months.
Cyber Essentials Plus is a point-in-time assessment, renewed every 12 months. The Opus monthly service adds weekly vulnerability scanning so you keep improving between assessments.
Cyber Essentials and Cyber Essentials Plus certificates expire after 12 months and need to be renewed to stay current.
Many UK central government contracts that involve handling personal or sensitive information require Cyber Essentials. Check the requirements of each tender.
Any failing controls must be fixed and retested before certification is awarded. The Opus readiness review and vulnerability scanning are designed to find those issues before the assessor does.
No. Certificates are issued under the IASME scheme following assessment by a licensed certification body. For Opus customers, the assessment is carried out by our partner Rootshell Security, and Opus prepares you and coordinates the route to certification. Opus is Cyber Essentials Plus certified itself.
They do different jobs. Cyber Essentials proves a technical security baseline, while ISO 27001 shows how information security is managed across the whole business. Many organisations hold both, and your customers’ requirements usually decide which comes first.
Are you ready to discuss your
requirements with a specialist?
London Office
2nd Floor
63 Saint Mary Axe
London
EC3A 8AA
Reigate Office
London Court
39 London Road
Reigate
Surrey
RH2 9AQ
London Office
2nd Floor Regal Chambers
49-51 Bancroft
Hitchin
Hertfordshire
SG5 1LL