Do I need Cyber Essentials or Cyber Essentials Plus for MOD contracts?

It depends on your contract's Cyber Risk Profile. Under CSM v4, standard Cyber Essentials is required for DCC Levels 0 and 1, and Cyber Essentials Plus is required for Levels 2 and 3. If you are a new entrant or a subcontractor on low-risk work, standard Cyber Essentials is almost certainly your starting point.

What is the difference between CE and CE Plus?

Both certifications cover the same five technical controls: firewalls, secure configuration, user access control, malware protection, and security update management.

The difference is verification. Cyber Essentials is a self-assessment questionnaire, signed off at board level and verified by a certification body. Cyber Essentials Plus adds independent hands-on technical testing: vulnerability scanning of your systems, malware protection checks, and verification that controls like multi-factor authentication are actually working, not just documented.

Which one does my MOD contract need?

The invitation to tender states the Cyber Risk Profile, which maps to a DCC level:

• DCC Level 0 or 1: Cyber Essentials.
• DCC Level 2 or 3: Cyber Essentials Plus.

If you are subcontracting, your prime contractor sets your risk profile through flow-down, so ask them early. Do not wait for the paperwork to arrive with a deadline attached.

What does each cost and how long does it take?

Cyber Essentials typically costs £300 to £600 depending on company size and how much support you need, and can be achieved in days to weeks if your environment is in reasonable shape.

Cyber Essentials Plus involves assessor time and technical testing, so it costs more and typically takes four to eight weeks end to end.

One caution from experience: the questionnaire is easy to underestimate. Declaring controls you do not actually operate is worse than failing, because CE Plus testing or a DCC assessment will expose the gap later, at a less convenient moment.

Is Cyber Essentials enough on its own?

For winning MOD work, no. Cyber Essentials is the prerequisite, not the destination. Under CSM v4 it forms the core of Defence Standard 05-138, and DCC certification builds on top of it. For DCC Level 0 you need Cyber Essentials plus UK GDPR compliance evidence and demonstrable backup and recovery capability.

It is also worth being honest about what CE is: a baseline that meaningfully reduces the likelihood of commodity compromise. It is not a defence against the nation-state actors actively targeting the UK defence industrial base. Treat it as the first rung, not the ladder.