Cyber Essentials self-assessment vs using an assessor
An honest comparison of completing the Cyber Essentials self-assessment yourself for the £320 to £600 IASME scheme fee against paying an assessor for a fixed-price, supported certification: when each route makes sense and what you are paying for.
Cyber Essentials self-assessment costs £320 to £600 ex VAT via any IASME Certification Body and can be done without help if you know your estate and the requirements. An assessor reviews every answer before submission, advises on notes-field wording and helps if the first submission fails. It pays off when a deadline or contract makes a first-time fail expensive.
What is the difference in one table?
| Self-assessment direct | Assessor-supported certification | |
|---|---|---|
| What you pay | IASME scheme fee only: £320 micro, £440 small, £500 medium, £600 large, ex VAT | A fixed price that includes the scheme fee; Precursor from £1,500 + VAT |
| Who answers the questions | You | You, with an assessor reviewing every answer before submission |
| Gap analysis | None, unless you run one yourself | Depends on the provider; with Precursor, from £500 + VAT standalone |
| Notes-field wording | Your own | Reviewed against what marking assessors expect |
| If you fail | One free resubmission within 48 hours of the fail notice (IASME terms), then a new application | Same scheme rule; the review before submission is meant to stop the fail happening |
| Time | Depends on you; most assessors aim to return results within 3 days (IASME) | 1 to 2 weeks end to end |
| Best for | Renewals, small estates, IT-literate teams with time | Deadlines, first certifications, mixed estates, contract-critical outcomes |
Which should you choose?
| If this describes you | Choose | Verdict |
|---|---|---|
| Your IT team meets all five controls, can evidence them, and there is no deadline | Self-assessment direct | The scheme fee is the whole cost, and the free resubmission covers a wording mistake. |
| You are renewing and nothing material has changed | Self-assessment direct | Last year's reviewed answers are the template; read the 2026 changes first. |
| This is your first certification and a contract date depends on it | Assessor-supported | A review before submission catches the auto-fail answers before they cost you weeks. |
| You have BYOD, several cloud platforms or legacy servers | Assessor-supported, or a gap analysis first | Scope questions in section A2 are where mixed estates fail, and a review settles them before marking. |
| You want to submit yourself but do not know where the gaps are | Gap analysis, then self-assessment | A standalone gap analysis gives you the fix list and you keep the submission in house. |
What does the self-assessment involve?
You register with an IASME Certification Body (the NCSC Annual Review 2025 counted 402 across the UK), pay the scheme fee and receive access to the online question set. The 2026 Danzell set has about 106 questions across eight sections. Some are factual (A1.3 asks for headcount, A2.6 for laptop and desktop operating systems and quantities). Some are yes or no with an auto-fail attached (A6.4AUTO-FAIL on the 14-day patching rule, A7.16AUTO-FAIL on MFA for cloud administrators). Many have a notes field where you describe a process, and those notes are what the assessor actually marks.
Question A1.11 asks whether you have read the Requirements for IT Infrastructure. Treat that as a genuine prerequisite. Most self-assessment problems come from answering the questions in plain English without reading the definitions that give the words their meaning, for example what counts as a cloud service, a sub-set or a vulnerability fix.
If you fail, you get one free resubmission provided you correct and resubmit within IASME's short window. The NCSC Annual Review 2025 cites a 1.1% fail rate from IASME's review of 2024-25, falling for the fourth year running. It does not say how many submissions passed only after a resubmission, so the figure is not a measure of how easy the standard is. What happens if you fail covers the process.
What does an assessor add?
An assessor-supported certification moves the checking to before submission. A gap analysis against the 2026 question set tells you which controls are missing and which answers would fail. The assessor then reviews each answer and notes field, points out where the wording describes intent rather than a process, and confirms that the evidence behind a yes actually exists. Submission happens once, and the fee is included.
Three patterns come up often: cloud services listed in A2.9 that do not have MFA enforced for every user, operating systems in A2.6 that reach end of support during the certificate year, and a "yes" to separate administrator accounts in A7.6 where the IT team still browses and reads email as an admin. Each is a fail if submitted as written.
When is going direct the right choice?
Go direct when you have time, a small and uniform estate, and someone who has read the requirements. A ten-person consultancy on Microsoft 365 with managed laptops, MFA enforced through conditional access and Intune patching can answer the question set in an afternoon. The scheme fee is the whole cost.
Renewals are the strongest case. Question A1.9 asks whether this is a renewal, and three quarters of all certificates are. If last year's submission passed and the only changes are the 2026 question set updates, a careful re-read of the changes is usually enough.
When is an assessor worth paying for?
Pay for support when a fail costs more than the support. That is nearly always true when a contract award, a tender deadline or an insurance renewal depends on the certificate, because a failed submission that needs technical remediation can take weeks to fix and re-mark.
It is also true for mixed estates: multiple sites, BYOD, several cloud platforms, on-premise servers, or an MSP that manages some of the infrastructure. Scope questions in section A2 and the third-party account rules trip up experienced IT teams, and an assessor who marks submissions every week knows exactly where the notes need more detail.
Question A1.12 asks whether you spoke to an assured NCSC Cyber Advisor. It is not required, but it signals that the scheme expects some organisations to seek help.
| At a glance | Detail |
|---|---|
| Scheme fee | £320 to £600 ex VAT by headcount, paid on every route |
| Free resubmission | One, if resubmitted within 48 hours of the fail notice (IASME terms) |
| Supported price | From £1,500 + VAT with Precursor, IASME fee included |
| Gap analysis | From £500 + VAT standalone with Precursor |
| Renewals | 75% of 2024/25 certifications (NCSC Annual Review 2025); strongest case for going direct |
What are you actually paying for?
The premium over the scheme fee buys time and certainty, not a different certificate. The certificate an assessor-supported organisation receives is identical to one earned direct, marked to the same standard by the same kind of assessor. What changes is the probability of passing first time and the amount of internal effort spent working out what a question means.
A 40-person firm goes direct to save money, answers "yes" to A6.1 because they believe every operating system is supported, and fails on a Windows Server 2012 box that hosts a line-of-business application. The free resubmission cannot help because the fix is a server migration. The certificate arrives eleven weeks later than the tender required. A gap analysis would have found the server in day one.
Can you mix the two?
Yes. A common pattern is a standalone gap analysis (Precursor charges from £500 + VAT), then a direct self-assessment once the gaps are closed. Another is supported certification in year one and a direct renewal in year two, using the reviewed answers as the template. Either way, keep the evidence you gathered: the device inventory, software version list and admin account register are the bulk of next year's work.
Frequently asked questions
Yes. Any organisation can register with an IASME Certification Body, pay the scheme fee of £320 to £600 ex VAT and complete the Danzell question set online. If the answers are accurate and the controls are in place, you will pass. The scheme is designed to be self-assessed.
You get one free resubmission if you act quickly. IASME's terms give you 48 hours from the fail notice to correct the answers or the controls and resubmit. Further attempts are charged as a new application. The NCSC Annual Review 2025 cites a 1.1% fail rate for 2024-25.
Typically a written review of every answer before submission, guidance on the notes-field wording assessors expect to see, the IASME scheme fee and handling of the resubmission if the first attempt fails. Some providers add a gap analysis. Precursor's package is from £1,500 + VAT with the fee included, a scope review and verification of your answers; its gap analysis is from £500 + VAT standalone, and is included in the 50 to 250 device Cyber Essentials Plus tier.
No. The submission is marked against the same Requirements for IT Infrastructure v3.3 and the same Danzell question set whichever route you take, and the certificate is identical. Support improves the accuracy of your answers before marking; it does not change the pass mark.
Self-assessment takes as long as you need to gather the information, then marking, which IASME says most assessors aim to return within 3 days. A supported certification takes one to two weeks end to end, because the review and fixes happen before submission rather than after a fail.
Often yes. Question A1.9 asks whether the application is a renewal, and 75% of certifications in 2024/25 were renewals, according to the NCSC Annual Review 2025. If last year's answers are still accurate and you understand the 2026 changes, the renewal is a good candidate for going direct.
Get certified at a fixed price
Precursor is an IASME Certification Body: Cyber Essentials from £1,500 and Cyber Essentials Plus from £3,000, with the IASME fee included, a free re-test if gaps are found and a written fixed price after a 20-minute scoping call.
- IASME Certification Body
- CREST accredited
- UK offices in Leeds, Newcastle, London and Edinburgh
Other comparisons
- Cyber Essentials vs Cyber Essentials PlusWhat separates the self-assessed Cyber Essentials certificate from the audited Cyber Essentials Plus: who marks it, what is tested, how long it takes, what it costs and which one a contract is likely to ask for.
- Cyber Essentials vs IASME Cyber AssuranceHow Cyber Essentials, the NCSC technical baseline, compares with IASME Cyber Assurance, IASME's own governance-level scheme covering risk, people, data and incident management at Level 1 and Level 2.
- Cyber Essentials vs ISO 27001How the UK Cyber Essentials baseline compares with an ISO 27001 information security management system: scope, evidence, audit, timescales and which one a buyer is really asking for.