Cyber Essentials vs Cyber Essentials Plus: Which One Do You Need for AWS or Cloud Workloads?

The one-sentence difference

Cyber Essentials is a self-assessment you fill in and a certification body reviews. Cyber Essentials Plus is the same questionnaire plus an independent assessor who connects to your systems and tests them. Same five controls, higher assurance.

Same controls, two levels of verification

Both levels assess the same five NCSC controls: firewalls and internet gateways, secure configuration, user access control, malware protection, and patch management. What changes is how the certification body confirms you meet them.

Cyber Essentials Plus is not a separate, harder standard. It is Cyber Essentials with the answers independently verified. If you would pass the audit, your self-assessment answers should already be true; Plus just proves it.

Which one do you need?

The honest answer is: whichever the party asking for it requires. Work back from the requirement.

Cyber Essentials (basic) is usually enough when:

• A customer contract or tender specifies “Cyber Essentials” with no “Plus”.
• You want a baseline security credential to signal diligence.
• You are early stage and the requirement is light-touch.

Cyber Essentials Plus is required when:

• The contract, framework, or buyer explicitly says “Plus”.
• You are integrating with NHS systems (the Data Security and Protection Toolkit references it).
• An enterprise procurement team or regulated-sector buyer mandates independent verification.
• A cyber insurer offers materially better terms for Plus, or will only underwrite with it.
• Investor due diligence in a regulated sector expects it.

If nobody has specified “Plus”, you probably need the basic level. If in doubt, ask the party requesting it, do not over-certify by default. Over-scoping the assessment is one of the most common ways teams waste time and money on this.

What the “Plus” audit actually adds for a cloud team

For a cloud workload on AWS, the Plus audit is where architecture choices start to matter. The assessor tests live infrastructure, so the shape of your environment changes how much surface area there is to examine:

• Internet-facing services get port-scanned. A single ALB or CloudFront distribution in front of private subnets is a small, clean target. A sprawl of public IPs on EC2, RDS, or test resources is a large one.
• Patch management is verified, not asserted. On managed services (Fargate, RDS, Lambda) AWS patches the platform, shrinking what the assessor tests to your container images and dependencies. On raw EC2, you own the OS and must show patches applied within 14 days.
• Endpoint scope is real. Plus tests the laptops your team uses to access production, not just the servers. This catches teams who focused entirely on server-side security.

The basic self-assessment asks you to confirm these things. Plus checks them. That is the whole difference, and it is why a well-architected AWS environment makes Plus much easier than a manual, ad-hoc one.

For the full control-by-control mapping to AWS services, see our Cyber Essentials Plus for AWS guide, and for the hands-on pre-audit review, the AWS security audit checklist.

How this sits alongside ISO 27001 and SOC 2

Cyber Essentials (either level) is a UK baseline focused on five technical controls. It is not equivalent to ISO 27001 or SOC 2, which are broader information-security management frameworks covering governance, risk, and process, not just technical hygiene. Teams often start with Cyber Essentials Plus as a fast, concrete credential and pursue ISO 27001 later when a larger enterprise or regulatory requirement demands it. They complement each other; the technical controls you build for CE+ feed directly into the broader frameworks.

Frequently asked questions

In short: match the level to what the party asking for it actually requires, and remember that on a well-architected AWS environment the gap between the two is mostly about proving controls you should already have, not building new ones.