Certification Body
A Certification Body is an organisation licensed by IASME, the NCSC's Delivery Partner, to assess and certify applicants for Cyber Essentials and Cyber Essentials Plus. Its assessors mark the self-assessment and run the Cyber Essentials Plus test cases. You must agree your scope with it before assessment begins. It is separate from a Cyber Advisor, who helps you prepare.
- Term
- Certification Body
- Also known as
- CB
- Category
- Scheme and certification
- Requirement area
- A. Introducing the technical controls; D. Scope
- Reviewed against
- Requirements v3.3
What does the term Certification Body mean in Cyber Essentials?
A Certification Body is an organisation licensed by IASME, the NCSC's Delivery Partner, to assess and certify applicants for Cyber Essentials and Cyber Essentials Plus.
How does Certification Body apply to Cyber Essentials?
In plain terms
The NCSC writes the rules, IASME runs the scheme, and the Certification Body is the firm that actually marks your work. You buy your assessment from one, its assessor reads your answers, and for Cyber Essentials Plus its assessor tests your systems.
What the scheme says
The requirements mention it twice: applicants "might also be required to supply evidence before your Certification Body can award certification", and "You must agree the scope with the Certification Body before assessment begins." The Cyber Essentials Plus test specification exists so that applicants "should be able to expect the same certification outcome, no matter which Certification Body they ultimately use." For Plus, the Certification Body also keeps the scope and segregation evidence "for at least the lifetime of the certificate" and supplies the malware test files used in test case 3.
In the question set, A2.1 is where the scope you agree is recorded (whole or partial organisation), and A1.14 lists "Certification Body" as one of the ways applicants hear about the scheme.
Who does what?
| Role | What it does |
|---|---|
| NCSC | Owns the scheme and writes the requirements and the Plus test specification |
| IASME (Delivery Partner) | Runs the scheme, publishes the question set and licenses Certification Bodies |
| Certification Body | Marks self-assessments, runs Plus audits and awards certification |
| Cyber Advisor | Helps you find and fix gaps before you apply; does not certify |
What to check before you choose one
That it appears on IASME's list of Certification Bodies, that it can do Plus if you need it, and how it handles a failed answer or test. Precursor Security, which runs this site, is an IASME Certification Body.
See get certified, how to choose a Cyber Essentials provider and the Cyber Essentials Plus overview.
Related terms
- Cyber AdvisorA Cyber Advisor is a person assured by the NCSC to advise organisations on how to implement the Cyber Essentials controls.
- CRESTCREST is an international not-for-profit body that accredits companies providing technical security services, such as penetration testing and security operations centres.
- Cyber EssentialsCyber Essentials is a UK government-backed certification that shows an organisation has five basic technical security controls in place to stop common internet attacks.
- Cyber Essentials certificateA Cyber Essentials certificate is the digital record, issued through a Certification Body, that an organisation has passed Cyber Essentials or Cyber Essentials Plus.
- Cyber Essentials PlusCyber Essentials Plus is the higher level of Cyber Essentials, where an assessor independently tests your systems instead of relying only on your written answers.
- Cyber Essentials Readiness ToolThe Cyber Essentials Readiness Tool is a free online questionnaire from the NCSC, run with IASME, that asks about your IT and gives a personalised action plan for meeting Cyber Essentials.
Frequently asked questions
A Certification Body is an organisation licensed by IASME, the NCSC's Delivery Partner, to assess and certify applicants for Cyber Essentials and Cyber Essentials Plus.
In the 2026 Danzell question set, Certification Body comes up at A1.14, A2.1. Read those questions against the definition above so your answers use the term the way the assessor will.
Certification Body relates to A. Introducing the technical controls; D. Scope in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.