Many UK organisations first meet security assurance through Cyber Essentials: a customer or a government tender asks for it, and a certificate follows. Then a larger customer, an insurer or an auditor asks for a penetration test, and the obvious question comes up: don't we already have that? Usually you don't. This guide explains what each one does, how they differ, and how to use them together.
What Cyber Essentials covers
Cyber Essentials is the UK government-backed scheme, run by the NCSC with IASME as its delivery partner. It focuses on five technical controls that prevent the most common internet-based attacks:
- Firewalls: boundary and device firewalls configured to block unauthorised access.
- Secure configuration: removing default accounts and passwords and unnecessary software.
- Security update management: applying high-risk and critical updates within 14 days of release, and removing unsupported software.
- User access control: least privilege, separate admin accounts and multi-factor authentication for cloud services.
- Malware protection: anti-malware or application allow-listing on in-scope devices.
Cyber Essentials is a verified self-assessment questionnaire. Cyber Essentials Plus covers the same controls, with a hands-on technical audit by an assessor. The audit includes vulnerability scans, checks on a sample of devices, and tests that malicious attachments and downloads are blocked. Certificates are issued by IASME-licensed Certification Bodies and must be renewed every year.
What a penetration test covers
A penetration test is an authorised, simulated attack on systems you choose, such as a web application, an API, your external perimeter, your internal network or a cloud account. Testers combine tools with manual work to find and exploit weaknesses, then chain them together to show real business impact. Typical findings that Cyber Essentials would never surface include:
- One customer being able to read another customer's data through an API (broken object-level authorisation).
- Business-logic abuse, such as changing prices, skipping payment steps or reusing vouchers.
- An attack path from one phished laptop to domain admin through Active Directory misconfigurations.
- Cloud roles that let a compromised developer key reach production data.
- Injection, file upload and authentication flaws in custom code.
Side-by-side comparison
| Cyber Essentials | Cyber Essentials Plus | Penetration test | |
|---|---|---|---|
| Question answered | Are the basics in place? | Are the basics verifiably in place? | What could an attacker actually do? |
| Method | Self-assessment, verified | Self-assessment + technical audit | Manual, adversarial testing |
| Scope | Whole organisation (or a defined sub-set) | As CE, with sampled devices | Specific systems you choose |
| Custom applications | Not tested | Not tested | Tested in depth |
| Output | Certificate | Certificate | Report with findings, evidence and fixes |
| Typical cost | A few hundred pounds + VAT (IASME fee by size) | Around £1,500 to several thousand pounds + VAT | From around £2,500; see our UK pricing guide |
| Frequency | Annual | Annual | Annual + after major change |
When you need Cyber Essentials
- You are bidding for central government contracts that involve personal data or certain ICT services.
- A customer, MoD supply chain or insurer asks for it.
- You want a clear, affordable baseline that removes the most common weaknesses.
When you need a penetration test
- You build or run your own web or mobile applications, APIs or SaaS platform.
- A standard requires it, such as PCI DSS Requirement 11.4, or expects it in practice, such as ISO 27001 or SOC 2.
- Enterprise customers ask for a recent pentest report or attestation letter in security questionnaires.
- You hold large amounts of personal data and need to show "regular testing" under UK GDPR Article 32.
- You have had a significant change: a new product, a cloud migration, a merger or a major release.
Which to do first
If you have neither, start with Cyber Essentials. It's cheaper and quicker, and it fixes the weaknesses behind most opportunistic attacks. It also means testers won't spend paid days reporting missing patches. Then commission a penetration test of the systems that matter most: customer-facing applications, APIs and your internal network. If a contract or standard requires a pentest by a deadline, run the two in parallel.
After that, keep both current. Renew Cyber Essentials every year, retest after major change and, for fast-moving teams, consider continuous or automated testing between annual manual tests.
How we can help
We don't issue Cyber Essentials certificates; only IASME-licensed Certification Bodies can. We can get you ready by reviewing your controls against the current requirements, tightening patch management and endpoint and identity security, and then testing what Cyber Essentials doesn't cover with manual-first penetration testing, quoted in GBP.
Frequently asked questions
Is Cyber Essentials Plus a penetration test?
No. The Cyber Essentials Plus audit includes hands-on checks and vulnerability scanning of a sample of your devices against five baseline controls. It does not test your applications, business logic or attack paths.
Which should we do first?
If you don't yet have Cyber Essentials, start there, because it fixes the most common weaknesses cheaply. Commission a penetration test once the basics are in place, or sooner if a customer, regulator or standard such as PCI DSS requires one.
Who issues Cyber Essentials certificates?
Certificates are issued by Certification Bodies licensed by IASME, the NCSC's Cyber Essentials delivery partner. A consultancy can help you get ready, but only a Certification Body can certify you.