Cyber Essentials Certification
An independently verified self-assessment for a customer requirement, a tender or your next renewal. Work directly with an IASME-licensed Certification Body, with clear assessment prices and optional support.
We assess and certify both levels directly.
Click either badge to verify the licence on the registry.
Published, by organisation size.
Our standard CE assessment prices follow IASME’s published size-based tiers; optional support is priced separately. Compare the assessment-only, audit-only and new-applicant totals below.
| Organisation size | Employees | CE assessment | CE+ audit only | New applicant CE + CE+ |
|---|---|---|---|---|
| Micro | 0 to 9 | £320 + VAT | £1,095 + VAT fixed | £1,415 + VAT |
| Small | 10 to 49 | £440 + VAT | £1,395 + VAT fixed | £1,835 + VAT |
| Medium | 50 to 249 | £500 + VAT | from £1,750 + VAT | from £2,250 + VAT |
| Large | 250 or more | £600 + VAT | from £2,500 + VAT | from £3,100 + VAT |
A CE pass is a prerequisite for CE+. New applicants need both assessments. Already passed CE less than three months ago? Ask us to confirm the certificate date, scope, eligibility and remaining window to complete the CE+ audit within three months of CE certification, not merely book it. Another CE assessment fee is not automatic.
Optional self-assessment support is £250 + VAT, separately scoped. Technical remediation, additional work and any audit travel are confirmed in the proposal. Support does not guarantee certification.
IASME’s CE and CE+ timing guidance. Confirm current scheme requirements before assessment.
v3.3 Danzell is now in force
Any Cyber Essentials assessment started on or after 27 April 2026 uses the new standard. The five controls haven't changed. The enforcement has. Most significantly: multi-factor authentication failures are now automatic failures. If any in-scope cloud service supports multi-factor authentication and you haven't enabled it, the assessment fails with no exceptions.
Other changes that catch renewals off guard: scope is broader (personal devices accessing work systems are in scope), the web applications section became application development, with publicly available commercial web applications in scope by default while bespoke and custom-developed components remain outside the Cyber Essentials technical requirements, and home working is handled differently: a home router is only in scope where your organisation supplied it, otherwise the firewall requirement must be met on the device itself. If your last assessment was before 2026, your renewal will look different.
Cyber Essentials or Cyber Essentials Plus
Same controls. Different levels of assurance. Cyber Essentials is an independently verified self-assessment; Cyber Essentials Plus adds independent technical testing to confirm those controls are working in practice.
Verified self-assessment
You answer a detailed questionnaire covering the five control areas. We review, verify, and certify. Required for certain government and defence supply chain contracts, and increasingly requested by commercial customers and insurers.
- Certain government and defence contracts
- Some cyber insurance requirements
- Supply chain compliance
- Customer trust signal
Technical verification included
Everything in Cyber Essentials, plus independent technical testing of a sample of the specified controls. This is not a full attack assessment or a penetration test. Check the actual wording of your customer’s requirement.
- MOD supply chains
- NHS and public sector contracts
- Higher-tier government frameworks
- Where Cyber Essentials Plus is explicitly required
The five technical controls
Every device, user account, and cloud service in scope must meet the requirements across all five.
Firewalls
Boundary devices and host-based firewalls must be configured to block by default. Inbound rules must be documented and justified. Routers and firewalls with factory default credentials are an automatic failure.
Secure configuration
Default accounts removed, unnecessary services disabled, password quality managed by one of the permitted approaches: multi-factor authentication, a minimum length of 12 characters, or a minimum of eight characters with automatic blocking of common passwords. Multi-factor authentication must be enabled on all admin accounts. Under v3.3, missing multi-factor authentication on any cloud service that supports it is an automatic failure.
User access control
Least privilege enforced throughout. Joiner-mover-leaver process documented. Admin accounts kept separate from day-to-day accounts and only used for administration. Special access privileges must be removed or disabled when they are no longer required.
Malware protection
Active endpoint protection on every in-scope device. Signatures current. Mobile apps from official stores only. On-access scanning enabled. One approved mechanism must be in place on every device in scope.
Security update management
High and critical patches applied within 14 days of release. Only software still receiving vendor security updates may remain in scope. Unsupported software must be replaced, removed from scope through a valid scope definition, or covered by a recognised vendor extended support programme. Mainstream Windows 10 support ended on 14 October 2025.
The five things that break a first attempt
The questions look simple. These are the failure modes we see again and again as a Certification Body.
Scope underestimated
Cloud services used for work (Slack, Notion, GitHub, Figma, your Microsoft 365 tenant) are in scope. Personal devices accessing work systems are in scope. Most first attempts exclude things that should be included.
Multi-factor authentication gaps on cloud services
Under v3.3, an automatic failure. If any in-scope service supports multi-factor authentication and it isn't enabled, the assessment fails. Check every cloud service, not just email.
Admin account misuse
Using the same account for admin tasks and day-to-day work is a failure. Admin accounts must be dedicated, protected by multi-factor authentication, and used only for administration.
Unsupported software in use
Any software no longer receiving vendor security updates is a failure. Mainstream Windows 10 support ended on 14 October 2025, so devices without updates cannot meet the requirement. Eligible devices covered by a valid Extended Security Updates programme remain supported while that coverage continues.
Default credentials on devices
If the admin password on any boundary firewall or router is still the factory default, that is an automatic failure. Check every boundary device in scope.
From scoping call to certificate.
Scoping call
A free 30-minute scoping call. Understand your environment, clarify the requirement and discuss preparation.
Fixed-price quote
Clear size-based assessment prices, with optional support and any additional work agreed separately.
Assessment
Structured questionnaire for Cyber Essentials, or questionnaire plus technical audit for Cyber Essentials Plus.
Certification
Certificate issued typically within 2 working days of a passed assessment.
Annual renewal
We remind you well in advance and recertify efficiently each year.
After certification
Cyber Essentials gets you certified. It doesn't tell you what to fix next or how to build a security programme around the controls. If you want strategic advice on what comes after the certificate, our Security Consulting service covers risk prioritisation, remediation planning, and building on Cyber Essentials towards a stronger overall posture.
Security Consulting →Request your free scoping call
30 minutes to clarify the right level, scope and next steps. A call request is not a confirmed audit booking or a guarantee of a pass.
Get in touchCyber Essentials guides
Written by the people who assess these applications. Everything below answers a question we are asked before certification rather than after.
- Cyber Essentials cost and pricing. What the assessment fee covers, where the rest of the money goes, and our published prices for both levels.
- Understanding your Cyber Essentials scope. Whole organisation or subset, cloud services, home working, personal devices and the device ownership matrix.
- How long Cyber Essentials certification takes. Published assessor timescales, three realistic timelines, and how to work backwards from a tender deadline.
- Renewing your Cyber Essentials certificate. What changes in year two, when to start, and why renewal is a fresh assessment.
- Cyber Essentials or Cyber Essentials Plus. The difference between the two levels and how to tell which one your customer is asking for.
- Common reasons organisations fail. The five findings that account for most unsuccessful assessments, and what actually happens if you do.
- Staying compliant between assessments. Certification describes twelve months of operation, not one good day.
- Cyber Essentials in Salisbury and Wiltshire. How local assessment works, and when being nearby actually matters.
Related capabilities
Penetration Testing
A penetration test answers one question: could a determined attacker do real harm to this business? Everything else (checklists, …
Read moreVulnerability Management
Penetration testing tells you what an attacker could do today. Vulnerability management tells you what’s changing, every …
Read moreIASME Cyber Assurance
IASME Cyber Assurance is the information security standard that sits above Cyber Essentials and below ISO 27001, available as a …
Read more