Cyber Essentials Plus Certification

£400 + VAT per month, all-in for standard scope (up to 49 employees): the full basic CE service, audit preparation, evidence collection, the independent technical audit through our IASME-accredited certification body partner, official fees, continuous external monitoring, and annual re-certification. Larger organisations are tiered from the same floor and quoted before commitment.

Typically 45–60 days from signup for standard scope: gap analysis in week one, remediation over weeks two to five, then the basic CE self-assessment followed by the technical audit. The scheme requires basic CE to be certified within three months of the Plus audit completing, so the sequence is fixed — and we run it so the audit lands on systems already proven.

An independent assessor samples your real systems: vulnerability scans to verify patching, test malware delivered by email and download to verify protection, browser and email client configuration checks, MFA and admin-separation verification, and a device sample representative of your declared estate — home workers included. It tests what the questionnaire declared; our preparation makes sure the two match.

Identical controls, different proof. Basic CE is a verified self-assessment; Plus adds an independent technical audit of your actual systems. Plus carries more weight with enterprise buyers, government frameworks and insurers because someone independent has tested the controls rather than reviewed a declaration. With AMVIA, CE is £250+VAT/month and Plus is £400+VAT/month.

Yes — the scheme requires a valid basic CE certificate, achieved within three months before Plus certification. It's built into our delivery: the self-assessment is completed and certified first, then the audit runs. Both are included in the £400/month; you don't buy them separately.

Failing is rare on our watch because we don't book the assessor until our own checks pass — we've remediated and evidenced every in-scope system first. If the audit does surface something, fixing and re-testing is part of the service, not a new invoice.

SurfaceLoop is AMVIA's external attack surface monitoring capability — it continuously discovers and monitors your internet-facing assets: domains, subdomains, certificates, exposed services and forgotten infrastructure. It's included with Plus because external drift is exactly what fails renewal audits; catching it continuously keeps you genuinely audit-ready between annual assessments. It's a capability inside our services, not a product we sell separately.

Materially, though not usually as a formal mandate. UK insurers' proposal forms ask for the controls Plus verifies — MFA, patching, malware protection, secure configuration — and the NCSC reports organisations with CE controls are 92% less likely to make a claim. An independently audited certificate is stronger underwriting evidence than a self-declaration; some brokers and certification bodies also report premium benefits, though no major UK insurer publishes a fixed discount.

Certain MoD and central government contracts name Plus, particularly where sensitive data or higher-risk services are involved, and prime contractors increasingly flow the Plus requirement down their supply chains. The pattern to watch: if a framework or customer security schedule says 'independently audited' or names Plus, basic CE won't satisfy it — check the wording before choosing your tier.

Very little, because we've done the preparation: access to the sampled devices and accounts, a point of contact, and a few hours of availability. We coordinate the assessor, sit in on the audit, and handle evidence requests as they come — the disruption to your team is deliberately close to zero.

Yes — the audit samples the estate you declared, and devices used for business are in scope wherever they sit, including home-worker laptops and BYOD accessing company data. Remote devices are one of the most common audit trip-ups, which is why bringing them under control is part of our remediation, not an exclusion.

Yes, cleanly — the controls are identical, so everything done for CE transfers. If your basic certificate is less than three months old, the audit can often run against it directly; otherwise the self-assessment is refreshed first. Existing AMVIA CE customers move to the Plus tier by stepping up from £250 to £400/month — no restart, no project fee.

Yes — the audit is conducted through our IASME-accredited certification body partner, and the certificate is the standard Cyber Essentials Plus certificate, verifiable on the official register operated by IASME on behalf of the NCSC. You can confirm it — or check any supplier's — with our free certificate checker.