How to choose a Cyber Essentials certification body
A Cyber Essentials certification body is a company licensed by IASME, the NCSC’s Cyber Essentials Delivery Partner, to mark your assessment and issue your certificate. Every certification body issues the same certificate against the same five controls, and the basic Cyber Essentials fee is set by IASME, from £320 + VAT. So choosing one comes down to Cyber Essentials Plus: how the audit is priced, run, retested and scheduled.
That is the short version, and it goes first because a lot of the material on this subject is written by certification bodies trying to suggest otherwise. More than 350 companies hold a CB licence (IASME’s figure, July 2025). A certificate from the smallest of them is worth exactly what a certificate from the largest is worth.
What is not the same is the experience of getting it, and, for Plus, the price. This guide covers which parts the scheme fixes, which parts it leaves to the CB, and what to ask before you sign.
Who is in the chain
There are three layers, and it helps to keep them apart.
- The NCSC owns the scheme and writes the technical standard: Cyber Essentials: Requirements for IT Infrastructure, currently v3.3, in force for applications started from 27 April 2026.
- IASME has been the NCSC’s sole Cyber Essentials Delivery Partner since 1 April 2020. Before that, five separate accreditation bodies ran the scheme, each with its own methodology, which is where many of the old claims that one certificate is “better” than another came from. Since 2020 there has been one route, one question set and one certificate.
- Certification bodies are licensed and assured by IASME. Their assessors mark your self-assessment and, if they are qualified for it, carry out the Plus audit.
Each CB has to hold UKAS-accredited ISO 27001, or one of IASME’s listed alternatives, plus a quality certification such as ISO 9001. A CB that offers Plus must also hold Cyber Essentials Plus itself. You can check any CB, or any certified organisation, on IASME’s public certificate search.
What is the same at every certification body, and what is not
This is the table to keep. The middle column is set by the scheme. The right column is where certification bodies actually compete.
| Set by the scheme: identical everywhere | Set by the certification body: compare these | |
|---|---|---|
| Basic Cyber Essentials price | £320 (micro, 0–9 staff), £440 (small, 10–49), £500 (medium, 50–249), £600 (large, 250+), all + VAT | Any support, consultancy or “readiness” package sold alongside it |
| Cyber Essentials Plus price | Not set. IASME says Plus “has to be quoted for individually” | Whether the quote is fixed or per device, and what can make it change |
| Standard and controls | Requirements for IT Infrastructure v3.3, five controls, the same question set | How well the assessor explains them before you submit |
| Plus audit method | NCSC Cyber Essentials Plus Test Specification: internal and external vulnerability scans, then testing of a random sample of user devices (typically around 10%), all internet gateways, and all servers offering services to unauthenticated internet users | Remote or on-site, how sampling is agreed, and the tooling used |
| Basic resubmission | Two working days to fix simple issues and resubmit at no charge | How quickly the assessor turns your resubmission round |
| Plus retest | Not set | How long you have to fix a failed sample, and whether the retest is free |
| Turnaround | Assessors aim to mark a basic submission within 3 working days | How far ahead the Plus audit can be booked |
| Validity and renewal | 12 months, with no grace period. You re-enter every answer each year | Whether they remind you and keep your scope from last year |
| Insurance | £25,000 cyber liability cover if you are UK-domiciled, turn over under £20m, and certify your whole organisation at basic level | Nothing. A CB cannot add to it or take it away |
| Assessor qualifications | Minimum standards set by IASME (see below) | Who holds them, and whether the person who audits you is the one you spoke to |
Read the middle column as a list of things you should not pay extra for. If a provider presents any of them as an advantage, such as a “fully accredited certificate” or “official NCSC certification”, that is true of every provider.
The basic price is fixed, so it cannot be the difference
IASME publishes the basic Cyber Essentials fee by organisation size, using the government’s employee bands. The fee pays for the assessment of your self-assessment by a qualified assessor. It does not change with the number of devices or with which CB you use.
So when a basic Cyber Essentials quote comes in well above £320–£600 + VAT, the difference is a service, not the certificate. That service may be worth paying for. Someone who walks you through scoping, MFA on every cloud service and the 14-day patching rule before you submit can save you a failed attempt. But it should be priced as a separate line you can say no to.
You can also apply directly through IASME’s portal, and an assessor at a CB will mark it. For a small organisation with an IT provider that already knows the controls, that is often enough.
Cyber Essentials Plus is where certification bodies differ
Plus has no published price. IASME’s own FAQ says the cost “will depend on the size and complexity of the network”, and its quote form sends your details to up to three certification bodies. Across the market, Plus is typically quoted at £1,400 to £4,000 + VAT, and most of that spread comes from one choice: pricing by device count or pricing by organisation size.
Five things are worth comparing.
1. How the price is built. A per-device quote rises with your estate and can change after the sample is drawn. A quote based on organisation size is fixed before the audit starts. Ask what, specifically, would make the figure change.
2. What happens when a sample fails. This is the question most buyers do not ask, and it is the one that decides the real cost. The scheme gives you two working days to fix simple issues on the basic self-assessment. It sets no equivalent for the Plus audit. Some CBs retest the failed controls free within a window. Others charge for a return visit, and some make you start again. Get the window in days, in writing.
3. Remote or on-site. IASME confirms that Plus audits “can be run remotely or in person”, and most now run remotely. Location only matters if you need someone on site, for example for kit that cannot be reached remotely or for a site with poor connectivity. If you were searching for a certification body in Devon or anywhere else specific, that is the only reason it would matter.
4. How soon they can audit. Plus has to follow a current basic certificate. IASME’s rule is that if your basic certificate is less than three months old, you do not repeat the self-assessment stage. If a contract start date is driving this, ask when the auditor can start before you ask about anything else.
5. Who actually does the audit. Some providers sell Plus but subcontract the audit to another CB, so you are scoped by one company and tested by an assessor you have never spoken to. Ask whether the assessor is employed by the CB on the certificate.
What a qualified assessor looks like
IASME sets the minimum standards, and they are higher for Plus.
- A basic Cyber Essentials assessor needs at least three years’ experience in an IT or cyber security role in the last five years. They must also pass IASME’s Assessor Skills Assessment, unless they hold a CISSP, CISM, ISO 27001 Lead Auditor, a qualifying UK Cyber Security Council registration or a qualifying CCP membership, and then pass IASME’s one-day assessor course and exam.
- A Cyber Essentials Plus assessor must already be a basic assessor, be based in the UK or Crown Dependencies, and pass IASME’s Plus training course.
- Every CB offering Plus must have a Lead CE+ Assessor at all times who holds one of IASME’s “List A” qualifications: CREST Registered Penetration Tester, CREST Certified Infrastructure Tester, Cyber Scheme Team Member or Team Leader, EC-Council ECSA (Practical) or CPENT, OSCP, or UK Cyber Security Council registration as a Security Tester. Other Plus assessors need a List A qualification or a pass in the Vulnerability Assessment Plus exam set by IASME and the NCSC.
You can ask any CB which List A qualification its lead assessor holds. It is a fair question, and a good CB will answer it straight away.
Consulting and assessing from the same firm
IASME’s FAQ says plainly that certification bodies “also offer consultancy to help you understand the assessment questions”. The scheme allows a CB to advise you and then certify you. That is how most small organisations get through: the advice and the assessment come from the same people, which keeps the cost down.
It also means you should know where the line is. Ask whether the person who helps you prepare is the person who marks your submission. A well-run CB can explain how it keeps the two separate. One that can’t is telling you something.
Renewal
Certificates expire after 12 months, and IASME removes you from its list of certified organisations once yours lapses. There is no grace period, and you re-enter every answer each year, partly because the question set changes. Danzell (v3.3) changed the questions for applications started from 27 April 2026.
The renewal fee is the same IASME fee as the first year. What a good CB adds is continuity: a reminder well before expiry, last year’s scope to hand, and a note of what has changed since you last certified. If your current CB did not contact you before your certificate expired, that is a reasonable reason to move. You can change CB at renewal without any penalty.
Questions to ask before you choose
- For Plus: is the quote fixed, or per device? What would change it?
- If a sample fails, how many days do I have to fix it, and is the retest free?
- Is the audit remote or on-site, and when is your first available date?
- Is the assessor employed by you, or subcontracted?
- Which List A qualification does your Lead CE+ Assessor hold?
- If you also help us prepare, who marks our submission?
Frequently asked questions
What is a Cyber Essentials certification body? A company licensed and assured by IASME to assess organisations against Cyber Essentials and issue the certificate. All assessors must work for one.
Is an IASME certification body different from a Cyber Essentials certification body? No. Since April 2020, every Cyber Essentials certification body has been licensed by IASME. They are the same thing.
Which Cyber Essentials providers offer fixed fees? All of them, for basic Cyber Essentials: the fee is set by IASME at £320 to £600 + VAT by organisation size. For Cyber Essentials Plus there is no set fee, so ask each provider whether its quote is fixed or per device.
Does it matter which certification body I use? Not for the certificate. It is identical whichever CB issues it. It matters for the Plus price, the retest terms, scheduling, and whether you deal with one assessor throughout.
Can I use a certification body outside my area? Yes. Basic Cyber Essentials is entirely online, and most Plus audits run remotely. Location only matters if you need an on-site audit.
How much does Cyber Essentials renewal cost? The same IASME fee as your first certificate, from £320 + VAT for the basic level. Plus is re-quoted each year.
Sources
- IASME, Cyber Essentials FAQ: basic fees by size, 3-day marking, 2-working-day free resubmission, Plus “quoted for individually”, around 10% random sample, the 3-month rule, 12-month expiry, “Certification Bodies also offer consultancy”.
- IASME, Deliver this scheme: certification body security and quality requirements, assessor experience rules.
- IASME, How to become a Certification Body for Cyber Essentials (29 July 2025): “over 350” certification bodies, Lead CE+ Assessor and List A, the VA+ exam, Plus training.
- IASME, Cyber Liability Insurance: eligibility and the £25,000 limit.
- NCSC, Cyber Essentials resources: Requirements for IT Infrastructure v3.3 (27 April 2026) and Cyber Essentials Plus Test Specification v3.2 (28 April 2025).