Cyber Essentials or a penetration test?
A customer, a contract or an insurer has asked about your security, and the two answers you keep finding are Cyber Essentials and a penetration test. They answer different questions. Here is how to tell which one you were asked for.
Read the question you were sent
The wording usually tells you which one is wanted:
- “Do you hold Cyber Essentials (or Cyber Essentials Plus)?” asks for a certificate. Only a certificate from an IASME-licensed certification body answers it.
- “When was your last penetration test?” or “Please share a summary of your latest pen test” asks for a test report on your own systems. A certificate does not answer it.
- “What controls do you have in place?” is open. A current Cyber Essentials certificate is a recognised way to show the basics, and a recent test report shows how a specific system holds up.
UK government buyers ask suppliers for Cyber Essentials on some contracts under PPN 014, and private-sector customers have copied the question. If the contract names a level, that level is the requirement: a basic certificate does not meet a requirement for Plus.
What each one proves
- The question it answers
- Cyber Essentials: Are the five basic controls in place?
- Penetration test: How does this system hold up against a skilled attacker?
- What is checked
- Cyber Essentials: Firewalls, secure configuration, security updates, user access, malware protection
- Penetration test: The scope you agree: a web app, a network, cloud accounts, a mobile app
- How
- Cyber Essentials: Self-assessment; Plus adds a technical audit to a fixed specification
- Penetration test: Manual-led testing, planned with you
- What you get
- Cyber Essentials: A certificate
- Penetration test: A report of findings, ranked by risk, with fixes
- Who does it
- Cyber Essentials: An IASME-licensed certification body
- Penetration test: A testing firm, often CREST-accredited
| Aspect | Cyber Essentials | Penetration test |
|---|---|---|
| The question it answers | Are the five basic controls in place? | How does this system hold up against a skilled attacker? |
| What is checked | Firewalls, secure configuration, security updates, user access, malware protection | The scope you agree: a web app, a network, cloud accounts, a mobile app |
| How | Self-assessment; Plus adds a technical audit to a fixed specification | Manual-led testing, planned with you |
| What you get | A certificate | A report of findings, ranked by risk, with fixes |
| Who does it | An IASME-licensed certification body | A testing firm, often CREST-accredited |
The NCSC describes Cyber Essentials as the minimum level of security it recommends for every organisation. Its penetration testing guidance treats a test as a way to gain assurance that your vulnerability management works, not as the main way to find vulnerabilities.
When you need both
Many organisations end up with both, because different people ask. A typical pattern: the contract asks for Cyber Essentials, and a larger customer’s security questionnaire also asks for a recent penetration test of the system they will use. Insurers ask too: the NCSC’s cyber insurance guidance notes that some insurers look favourably on recognised defences such as Cyber Essentials.
If you need both, getting Cyber Essentials first usually makes sense: fixing the five controls is the cheaper work, and a tester who does not have to report missing updates and default passwords spends the days you pay for on the deeper issues.
Getting each one
Cyber Essentials: choose a certification body from IASME’s directory, licensed for the level you need. IASME explains the difference between the two levels, and our Cyber Essentials Plus guide covers preparing for the audit.
Penetration test: decide what needs testing, then ask two or three firms to quote on the same scope. See what to send a firm for a quote and what a test costs.
Next steps
Sources
- NCSC: Cyber Essentials overview
- IASME: Cyber Essentials and Cyber Essentials Plus: what is the difference?
- GOV.UK: PPN 014: Cyber Essentials scheme
- IASME: Network Directory of Certification Bodies
- NCSC: Penetration testing guidance
- CREST: A cyber buyer's guide to vulnerability assessment and penetration testing
- NCSC: Cyber insurance guidance
Frequently asked
Does Cyber Essentials Plus count as a penetration test?
No. The Plus audit checks a sample of your systems against the NCSC’s fixed test specification for the five Cyber Essentials controls, and the result is a certificate. A penetration test is scoped around the systems you choose and gives you a findings report. If a questionnaire asks when your last penetration test was, a Cyber Essentials certificate does not answer it.
Which should a small business get first?
If a contract or customer names Cyber Essentials, start there: the basic certificate is a self-assessment against five controls, and fixing those controls first means a later penetration test spends its time on deeper issues. If a customer asks for a penetration test of a specific system, such as your web app, that is the answer to their question.
Can one firm do both?
Sometimes. Cyber Essentials is certified by IASME-licensed certification bodies, and some penetration testing firms are also licensed. Check IASME’s directory for the licence, and the firm’s own accreditation, such as CREST, for the testing.
Find firms that fit your test
Answer a few questions about what needs testing and why, and see matched firms with a link to each one’s contact page.
Match with firms