There are four levels matched to assessed cyber risk: Level 0 (3 controls), Level 1 (101 controls), Level 2 (139 controls) and Level 3 (144 controls). All levels start with Cyber Essentials, and Levels 2 and 3 require Cyber Essentials Plus.