A five-person company pays the micro fee band (£320 plus VAT, 0 to 9 staff) for Cyber Essentials self-assessment and typically needs a week of part-time effort. Scope is the whole organisation: every laptop and phone that reaches company email or files, plus every cloud service. The controls that take longest are separate admin accounts and MFA on every service.
Key takeaways
- A five-person company pays the IASME micro-band fee of £320 plus VAT (0 to 9 staff) for a Cyber Essentials self-assessment, according to IASME's published fee bands checked on 3 November 2026.
- Every laptop and phone that reaches company email or files is in scope, including personal phones, because NCSC Requirements v3.3 puts user-owned devices that access organisational data in scope.
- In micro-band assessments the time commonly goes on three things: separate admin accounts (A7.6, A7.7), MFA on every cloud service (A7.16, A7.17) and personal phones.
- A no to A7.16 or A7.17 fails the assessment under the Danzell guidance, so check MFA on Xero, LinkedIn and every other listed service, not only Microsoft 365.
- Organisation
- Five staff, home working, company laptops, personal phones, Microsoft 365, Xero, LinkedIn
- IASME fee
- £320 plus VAT, micro band (0 to 9 staff), checked 3 November 2026
- Scope
- Whole organisation: 5 laptops, 5 phones, 3 cloud services; home routers excluded
- Time taken
- About a day of a director's time over a week
- Changes needed
- Separate admin accounts, MFA on Xero and LinkedIn, 6-character device PINs, one phone replaced
- Certificate
- Valid for 12 months from issue, then renewed against the question set current at the time
Who is the company and what do they run?
A five-person consultancy. Two directors, three consultants. No office server. Everyone works from home or client sites on a company MacBook or Windows laptop, with a personal phone for email. Microsoft 365 Business Premium for email, files and Teams. Xero for accounts. A LinkedIn company page. A broadband router in each home.
That gives a scope answer straight away.
| Question | Answer |
|---|---|
| A1.3 | 5 employees |
| A2.1 | Whole organisation |
| A2.4 | "Home working, no company network. All staff connect over home broadband or client Wi-Fi." |
| A2.5 | "None. Home routers are excluded; all devices rely on software firewalls." |
| A2.6 | 3 x Apple MacBook Air, macOS 26; 2 x Dell Latitude, Windows 11 Pro 25H2 |
| A2.8 | 4 x Apple iPhone, iOS 26; 1 x Samsung, Android 16 |
| A2.9 | Microsoft 365, Xero, LinkedIn |
Three details matter here. The A2.6 guidance requires the Windows edition and feature version, so "Windows 11" on its own comes back as a query; "Windows 11 Pro 25H2" does not. Home routers must not be listed in A2.5, and the guidance says so. Social media accounts are cloud services under A2.9, so LinkedIn goes on the list and its MFA gets checked.
Which controls were already in place?
More than the directors expected. Business Premium ships with Defender for Business, Intune and Conditional Access, so the malware protection questions (A8.1 to A8.3) and the software firewall question (A4.1.1) were a matter of confirming settings. macOS and Windows both auto-update, which covers A6.4AUTO-FAIL for operating systems. Chrome, Edge and Office auto-update, which covers most of A6.5AUTO-FAIL.
Device locking under A5.9 needed one change: two laptops had a four-digit PIN. The requirement for unlock-only credentials is a minimum of 6 characters, and Intune enforced it in an afternoon.
Where did the time go?
Three places, which is a typical pattern for a company this size.
Separate admin accounts (A7.6, A7.7). Both directors were Global Administrators on the accounts they used for email. The fix was two new admin-only accounts, Global Admin removed from the daily accounts, and a sentence in the notes describing which account does what.
MFA for every user and every service (A7.16AUTO-FAIL, A7.17AUTO-FAIL). Microsoft 365 was fine. Xero had MFA for one director and not the other. LinkedIn had none. Both were fixed in an hour once someone looked, but nobody had looked.
The personal phones. Each one reads company email, so each is in scope as BYOD: the NCSC requirements v3.3 state that user-owned devices which access organisational data or services are in scope. The consultants had to confirm the OS version, that a 6-character passcode or biometric was set, and that no unsupported apps were installed. One Android phone no longer received security updates from its manufacturer, which made it unsupported software under A6.1, so it was replaced.
In this example the assessor's query was on A7.3, leavers. The company had never had a leaver, so the answer said "not applicable". The requirement is a process, not a history. The amended answer named who disables the account and when.
What did it cost and how long did it take?
The IASME self-assessment fee for the micro band (0 to 9 staff) is £320 plus VAT, per IASME's published fee bands checked on 3 November 2026. The other bands are £440 (10 to 49 staff), £500 (50 to 249) and £600 (250 and over), all plus VAT.
A company that has not held Cyber Essentials in the last four years may qualify for IASME's government-funded 75% discount, which brings the micro fee to £80 plus VAT. Eligibility is checked when you register on IASME's Supplier Assurance Tool, and you must register and purchase by 31 March 2027. Time: about a day of a director's attention spread across a week, most of it on the admin accounts and the phones. The company opted in to the included insurance at A3.2, which they qualified for as a UK company under £20m turnover certifying the whole organisation.
For A7.6: "Each director has a standard Microsoft 365 account for email and files and a separate cloud-only admin account (name-admin@) used solely for tenant administration. Admin accounts have no mailbox and MFA is enforced by Conditional Access."
Where do you start if this sounds like you?
Read what Cyber Essentials is for the scheme in one page, then the cost page for the fee bands and what an assessor charges on top. Run the readiness checker; for a company this size it takes ten minutes and the red items will usually be the three above. The Microsoft 365 and Entra ID setup guide covers the admin accounts and MFA settings, and the BYOD scope page covers the phones. If you want the assessment marked by us, a fixed-price certification includes the IASME fee and a review of your answers before submission.
- NCSCNCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 · April 2026Read on ncsc.gov.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials Danzell Question Set 2026 (v16.3)Read on iasme.co.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials (fee bands by organisation size)Read on iasme.co.uk (opens in a new tab)
- IASMEIASME, 75% funded discount for micro and SME organisationsRead on firststep.iasme.co.uk (opens in a new tab)
- IASMEIASME, Cyber liability insurance included with Cyber EssentialsRead on iasme.co.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials FAQs (renewal, failed assessments, Plus timing)Read on iasme.co.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials terms and conditions (certificate validity, free further assessment)Read on iasme.co.uk (opens in a new tab)
Frequently asked questions
Only if a contract or funder asks for it. Cyber Essentials Plus adds an independent audit of the same controls on the same scope. IASME's FAQ says that if the self-assessment certificate is less than three months old when you certify to Plus, you do not repeat the self-assessment stage. Most small companies certify at the basic level first and add Plus when a customer requires it.
Yes, if they read company email or open company files. User-owned devices that access organisational data or services are in scope under v3.3. The only exemptions are devices used solely for native voice calls, native text messages or as an MFA authenticator.
IASME says UK-domiciled organisations with turnover under £20m that certify their whole organisation are entitled to cyber liability insurance, with a £25,000 total limit of indemnity and a 24-hour helpline to report an incident. You opt in at A3.2 and give a contact email at A3.3. There is no extra cost.
Twelve months. IASME's assessment terms say a certificate is valid for 12 months from the date of issue. Renewal is a fresh self-assessment against whichever question set is current at the time; question A1.9 asks whether the application is a renewal or a first-time application.
Possibly. IASME is running a government-funded 75% discount for UK micro and SME organisations that have not held Cyber Essentials in the last four years, checked when you register on its Supplier Assurance Tool. You must register and purchase by 31 March 2027. For the micro band that takes the fee from £320 to £80 plus VAT.
Get certified at a fixed price
Precursor is an IASME Certification Body: Cyber Essentials from £1,500 and Cyber Essentials Plus from £3,000, with the IASME fee included, a free re-test if gaps are found and a written fixed price after a 20-minute scoping call.
- IASME Certification Body
- CREST accredited
- UK offices in Leeds, Newcastle, London and Edinburgh