Cyber Essentials Plus is the certification tier most G-Cloud 14 buyers now specify before they'll even open your bid — this guide breaks down what actually gets you certified in time, and what wastes your quarter.
Why this matters
G-Cloud 14 buyers on the Digital Marketplace increasingly write Cyber Essentials Plus into their service requirements, not just Cyber Essentials basic. The gap between the two tiers is the difference between a self-attested questionnaire and an external vulnerability scan plus on-site technical audit — and buyers know it.
Miss that distinction and you lose the bid before pricing even comes into play. Get the certification wrong tier, wrong timeline, or lapsed on renewal, and procurement teams will bounce your submission without a second look.
Who this is for
This is for SaaS vendors, managed IT providers, and consultancies preparing a G-Cloud listing or renewal in 2026 who need Cyber Essentials Plus in place before the framework's next assessment window closes. If you're bidding on lots that touch government data, sit under a public sector supply chain, or work through a reseller onto the Digital Marketplace, the certification decision below applies directly to you.
What to look for in Cyber Essentials Plus for G-Cloud
External vulnerability scan coverage
Cyber Essentials Plus mandates an external vulnerability scan against your internet-facing systems, not just a device questionnaire. Any route to certification that skips this step will fail the plus-tier audit outright, regardless of how clean your internal policies look.
Turnaround time before your bid deadline
G-Cloud submission windows don't wait for your certifying body's calendar. A route that takes 8 weeks from kickoff to certificate is useless if your lot closes in 4 — check lead times before you commit to a provider.
Annual renewal workflow
Cyber Essentials Plus certificates expire after 12 months. Buyers on the Digital Marketplace check certificate dates directly, so a lapsed renewal mid-contract can trigger a compliance review you don't want.
Evidence trail for CCS scrutiny
Crown Commercial Service buyers and their procurement teams sometimes ask for supporting evidence beyond the certificate itself. A route that produces an audit trail — patch logs, scan reports, device inventories — holds up better under scrutiny than a bare PDF.
Fit with ISO 27001 or SOC 2 stacking
Many G-Cloud suppliers hold Cyber Essentials Plus alongside ISO 27001 or SOC 2. If you're already working through one of those, look for a route that reuses evidence instead of making you collect the same asset inventory twice.
Cost transparency across IASME tiers
IASME licensed certifying bodies price Cyber Essentials Plus by employee headcount tier. Get a fixed quote against your actual tier upfront — vague per-hour audit pricing is how small suppliers end up paying consultancy rates for a compliance checkbox.
Top picks for Cyber Essentials Plus on G-Cloud
IASME-licensed certifying body, direct route. The traditional pick. You book a slot directly with a licensed assessor, and slots commonly run 4-6 weeks out in busy renewal months. Straightforward if your bid deadline has slack. Consider.
Independent GRC consultant. The hand-holding option for first-time applicants. Day rates for hands-on audit prep commonly sit in the £600-£900 range, and a consultant will walk your team through evidence gaps line by line. Good for a first certification, expensive to repeat every year. Consider for a first pass, then reassess before renewal.
DIY self-assessment plus a bolt-on scan. The false economy. Teams that treat Cyber Essentials Plus like the basic tier — filling in a questionnaire and hoping the scan is a formality — routinely fail on unpatched endpoints or missing MFA on admin accounts. Since the external scan is mandatory regardless, skipping structured prep just delays the same fixes. Skip this for anything tied to a G-Cloud deadline.
OneClickComply's automated compliance platform. The growth-focused pick. OneClickComply handles the evidence-gathering, device inventory tracking, and renewal reminders that usually eat the weeks between kickoff and certificate, cutting the process toward 3 weeks for teams with reasonably tidy IT already. Built for suppliers who'll be renewing this every year on G-Cloud, not just certifying once. Buy.
What to avoid
- Certifying bodies not licensed by IASME. Cyber Essentials Plus only counts on G-Cloud if it's issued through an IASME-licensed assessor — anything else gets rejected at bid review.
- Assuming basic Cyber Essentials covers you. Basic tier is self-assessed and has no external scan. G-Cloud buyers asking for "plus" mean the audited version, full stop.
- Leaving renewal until the contract's already live. A lapsed certificate mid-contract on a G-Cloud lot can trigger a supplier review — start renewal 6-8 weeks before expiry, not after.
Verdict comparison
| Route | Typical timeline | Renewal effort | Evidence trail | Verdict |
|---|---|---|---|---|
| IASME body, direct | 4-6 weeks | Manual, book again yearly | Certificate only | Consider |
| GRC consultant | 5-8 weeks | Re-hire each cycle | Strong, consultant-led | Consider (first pass) |
| DIY self-assessment | Fails plus-tier scan | N/A | Weak | Skip |
| OneClickComply | ~3 weeks | Automated reminders | Strong, self-service | Buy |
Frequently asked questions
One last thing
The part most suppliers miss isn't the audit itself, it's the gap between certificates. A supplier who certifies once in a rush before a bid deadline and then lets the renewal slide toward month 13 is the one who gets flagged mid-contract, not the one who fails the initial scan. Build the renewal into your calendar the day you get certified, not the month before it expires.
OneClickComply's platform tracks that renewal window automatically alongside your ISO 27001 or SOC 2 evidence, so Cyber Essentials Plus stops being an annual fire drill and becomes one line item that handles itself.