Cyber Essentials certification, without the headache

Only if someone is asking for it, or you want a recognised baseline. It is a certification you choose to earn, not a law. Some government contracts that handle personal data require it, and some larger businesses ask their suppliers for it.

People also search for Cyber Essentials accreditation or ‘cyber security essentials’. The scheme is called Cyber Essentials, and businesses are certified rather than accredited. If a customer, tender or insurer has asked, find out which level they want.

There are two packages and a managed renewal. The Scope and Gap Review gives you a written scope, a gap report and a fix list. Guided adds the scoping session, the questionnaire work, assessor questions and handover. Renewal, managed covers the yearly re-assessment.

Your company size and the number of devices and cloud services in scope set the price. You get a fixed written quote before you pay.

For the wider market, read our guide to what Cyber Essentials costs in the UK.

It depends mostly on how much needs fixing. Our planning estimate for the fixes is one to four weeks. IASME says an assessor then reviews answers within three working days (IASME Knowledge Hub, updated 13 April 2026).

We ask about your deadline on the first call and give you a timeline with your written quote.

Certification is carried out by an IASME-licensed Certification Body that we work with. A qualified assessor at that body marks your answers, and the body issues your certificate. We are not the Certification Body and we do not mark your answers. We arrange the assessment through that body, and any assessment fee in your package is part of our price. We guide you and are your first contact.

Yes. The body’s name appears on the assessment portal and your certificate, as on every Cyber Essentials certificate. You accept its terms on the portal, and it holds your answers and decides the result. With your permission, we can see and manage your account. The order form you sign before you pay names the body, and we will tell you now if you ask. Anyone can check your certificate on IASME’s public certificate search, which shows company name, level, dates and score.

Yes. IASME sells the assessment direct from £320 plus VAT (£384 with VAT), and you answer the questions yourself (IASME Knowledge Hub, updated 13 April 2026). That works well if you are comfortable with IT and already use multi-factor authentication everywhere.

We suit firms that would rather not work out the answers and fixes alone, or that have failed before. Our Guided packages include the assessment fee and the work around it, so compare like with like.

NCSC also lists a free 30-minute consultation with a Cyber Advisor for small organisations preparing for Cyber Essentials. That is a separate free option, not a service we provide.

NCSC explains the consultation in its post on free hands-on cyber consultancy.

You fix the answer or the underlying problem and resubmit, and we go through the assessor’s comments with you. IASME gives you two working days to resubmit, and the assessor looks again at no extra charge. If you still fail after that, you reapply and pay again.

Missing multi-factor authentication on a cloud service and unsupported software must be fixed before a pass is possible, so we check both first. No one can promise a pass, because the assessor decides the result.

The scheme includes optional cyber liability insurance for eligible organisations. You must be based in the UK or Crown Dependencies, have turnover under £20m, certify your whole organisation, and opt in. The limit is £25,000 (IASME Knowledge Hub, updated 13 April 2026). Conditions and exclusions apply.

Read IASME’s insurance terms before you decide. We cannot advise on insurance, so you answer the opt-in question yourself.

The terms are on IASME’s cyber liability insurance page.

Not always. Government guidance says it should not be applied to every contract as a matter of course. Procurement Policy Note 014 (PPN 014) covers central government buying. It says requiring Cyber Essentials or Plus is the quickest and most effective way to check suppliers that handle personal data. Check the tender for the level it requires.

Defence work is different. The Ministry of Defence has asked all its industry partners to reach Defence Cyber Certification Level 0 by 31 December 2026. Level 0 includes a requirement to obtain Cyber Essentials for the applicable business-critical systems in scope (MOD Digital blog, 13 July 2026). Defence Cyber Certification is a separate scheme that we do not arrange.

Read PPN 014 on GOV.UK.

The Level 0 deadline is set out in the MOD Digital blog post of 13 July 2026.

A certificate lasts 12 months. Renewal is a new assessment, and the renewed certificate runs for 12 months from the day you submit, not from the old expiry date. So we plan to submit close to expiry, with time to fix any comments.

We remind you two months ahead, re-check what has changed and manage the resubmission. The assessment runs as a yearly subscription that renews on its anniversary unless you give written notice 30 days before.