How to choose a Cyber Essentials provider
What separates one Certification Body from another, how to verify them, what a quote should include, and which route suits your organisation. Vendor-neutral, with Precursor's own position stated separately at the end.
Choose a Cyber Essentials provider by first confirming it is an IASME-licensed Certification Body, then comparing what each quote includes: the IASME scheme fee (£320 to £600 ex VAT by staff size), a review of your answers before submission, help and retest terms if you fail, Cyber Essentials Plus capability, and a written turnaround date.
- Who can certify
- Only Certification Bodies licensed by IASME, the NCSC's Delivery Partner for Cyber Essentials
- Scheme fee
- £320 (0 to 9), £440 (10 to 49), £500 (50 to 249), £600 (250+), ex VAT, the same at every body
- Verify a certificate
- IASME certificate search, free and public
- If a self-assessment fails
- One free resubmission within 48 hours of the fail notice (IASME terms), then the fee is payable again
- Cyber Essentials Plus
- Within 3 months of your Cyber Essentials certification, same scope; a failed update management retest revokes the self-assessment certificate (2026 rule)
Who is allowed to certify Cyber Essentials?
Only a Certification Body licensed by IASME can issue a Cyber Essentials certificate. IASME is the NCSC's Delivery Partner for the scheme, and there were 402 licensed Certification Bodies in 2024/25 according to the NCSC annual review. Consultancies and IT providers outside that list can help you prepare, but the submission is still marked by a licensed body.
To verify a provider, find its name on IASME's Find a Certification Body page . Then check that it holds its own certificate on the IASME certificate search. A body that certifies others should be able to show its own.
Is the price fixed, and is the IASME fee included?
The scheme fee is set by IASME by the number of employees you declare in A1.3, and every Certification Body charges the same amount. The provider's own charge sits on top of it, and this is where quotes differ.
- Fixed or variable. A fixed price covers the stated work whatever it takes. A day rate or hourly rate moves with the effort, which is hard to budget when you do not yet know your gaps.
- Fee included or added. A quote that excludes the scheme fee looks £320 to £600 cheaper than one that includes it. Compare like with like.
- VAT. IASME publishes its fees ex VAT. Check whether each quote is ex or inc VAT.
- What changes the price. For the self-assessment, usually only the staff band. For Plus, the number and variety of devices, sites and cloud services, because the test specification samples by device.
The Cyber Essentials cost page sets out the fee bands in full, with the date they were last checked.
Can the provider also deliver Cyber Essentials Plus?
Cyber Essentials Plus verifies the self-assessment with an external scan, an authenticated patch scan and observed tests of malware protection, MFA and account separation, defined in the NCSC test specification v3.2. IASME says the Plus audit can be completed within 3 months of your last Cyber Essentials certification, on the same scope.
If a contract names Plus, or might next year, choose a body that delivers Plus itself. It can book the audit date before you submit the self-assessment, which is the simplest way to stay inside the three-month window. Ask how many retests the price includes, because after an update management fail the 2026 rule retests the original sample plus a new random sample.
How fast can you be certified?
Marking is quick. The time goes on preparation: building the device and software inventory, fixing unsupported software, enforcing MFA on every cloud service. A provider cannot shorten work you have not done, so the honest answer to "how fast?" depends on your readiness.
Ask for the certificate date in writing, and ask what it assumes. If the date only holds when nothing fails, find out what happens to it if something does. The how long does it take page breaks the timeline down stage by stage.
What help do you get if something fails?
The scheme rules are the same everywhere. A failed self-assessment gets one free further assessment if you resubmit within 48 hours of the fail notice (IASME terms, clause 2.6). After that, the scheme fee is payable again. A failed Plus test is remediated and retested. For update management, IASME's 2026 rule retests the original sample plus a new random sample, and IASME's April 2026 update states that a second failure revokes the verified self-assessment certificate.
What differs between providers is what happens around those rules. Does the provider tell you what to fix, or only that you failed? Does it help with the remediation? Is the retest included, and what does another one cost? The what happens if you fail page covers the rules in detail.
Does the provider need to be local?
Not for the self-assessment. The question set is completed and marked online, so any UK Certification Body can serve any UK organisation. For Plus, managed devices can often be tested over a supervised screen share, but the assessor must verify scope by technical means and some estates still need a site visit. Ask whether testing will be remote or on site, and whether travel is on top of the price.
Which route suits your organisation?
There are three ways to get certified, and every provider sits in one or more of them. The last column shows where Precursor sits, so you can compare it with other quotes on the same rows.
| Attribute | Self-assessment only | Certification Body with guidance | Certification Body plus gap analysis | Precursor |
|---|---|---|---|---|
| What you pay | The scheme fee only: £320 to £600 ex VAT by staff band | The scheme fee plus the provider's support charge, which varies by provider | As guidance, plus a gap analysis fee | Cyber Essentials from £1,500 + VAT with the fee included; gap analysis from £500 + VAT standalone, included in the 50 to 250 device Plus tier |
| Who checks answers before marking | Nobody. The assessor marks what you submit | An adviser or assessor; depth varies, so ask | An assessor, after a structured review of every question | An assessor verifies your answers before submission |
| Finds control gaps before you submit | Only if you find them yourself | Partly, through the answer review | Yes, with a prioritised remediation list | Through the answer review; a full gap analysis is from £500, or included in the 50 to 250 device Plus tier |
| If the self-assessment fails | One free resubmission within 48 hours of the fail notice (IASME terms), then the fee is payable again | Same scheme rule; ask who handles the re-mark and what a second failure costs | Same scheme rule; failure is less likely because gaps are known | Remediation guidance and a re-test at no additional cost within a defined window |
| Cyber Essentials Plus | A separate purchase from a body that delivers Plus | Ask whether the same body delivers Plus | Ask whether the same body delivers Plus | Delivered in house, by device count: from £3,000 for up to 50 devices, from £4,500 for 50 to 250 devices, from £5,000 for 250+ devices, + VAT, Cyber Essentials and a free re-test included |
| Time to certificate | As long as your preparation takes | Ask for a written date | Longer up front, fewer surprises at marking | Cyber Essentials 1 to 2 weeks; Plus 2 to 5 weeks by tier; gap analysis 1 to 3 days |
| Best for | IT teams that already meet the controls and can evidence them, and straightforward renewals | First-time applicants with a small, uniform estate | Deadlines, mixed estates and anyone going on to Plus | UK organisations that want a fixed price with the fee included and Plus from the same body |
Which should you choose?
One sentence per situation. Find the row that describes you.
| If this describes you | Choose | Why |
|---|---|---|
| Your IT team meets all five controls, can evidence them, and there is no deadline | Self-assessment only | The scheme fee is the whole cost and the free re-mark covers a wording mistake. |
| A contract asks for Cyber Essentials and you are applying for the first time | Certification Body with guidance | A review before submission catches the auto-fail answers that a first-time applicant is most likely to miss. |
| A tender or contract date leaves no room for a failed submission | Certification Body plus gap analysis | A failure that needs a server migration or an MFA rollout takes weeks, and a gap analysis finds it on day one. |
| The contract names Cyber Essentials Plus | A Certification Body that delivers Plus itself | The audit must follow the Cyber Essentials certification within 3 months on the same scope, so one body can schedule both. |
| You have legacy servers, BYOD or several cloud platforms | Certification Body plus gap analysis | Scope questions in section A2 are where mixed estates fail, and a question-by-question review settles them before marking. |
| You are renewing and nothing material has changed | Self-assessment only | Last year's reviewed answers are the template; read the 2026 changes before you resubmit. |
What should you ask a provider before you buy?
Send the same ten questions to every provider you are considering and compare the written answers.
- Are you a licensed IASME Cyber Essentials Certification Body, and under what name are you listed?
- Is the IASME scheme fee included in your price, and is the price quoted ex VAT?
- Is the price fixed? What would make it change (staff band, devices, sites, cloud services)?
- Will an assessor review every answer before we submit, and does that include the auto-fail questions?
- If the first submission fails, who handles the free re-mark, and what does a second failure cost?
- Do you deliver Cyber Essentials Plus yourselves? How many retests are included and what does another cost?
- What date will we have the certificate by, in writing?
- Is Plus testing remote or on site, and is travel charged on top?
- Do you help with remediation, or only identify what needs fixing?
- What are your cancellation, rescheduling and payment terms?
Where does Precursor fit?
Precursor Security is an IASME Cyber Essentials Certification Body, also CREST accredited for Security Testing (penetration testing) and SOC, with offices in Leeds, Newcastle upon Tyne, London and Edinburgh. It offers assessor-supported Cyber Essentials from £1,500, Cyber Essentials Plus from £3,000 for up to 50 devices (Cyber Essentials included) and a gap analysis from £500, all + VAT, with the IASME fee included in the certification prices. Applying this page's own test: Precursor Security Ltd appears on the IASME certificate search with Cyber Essentials (certified 3 February 2026) and Cyber Essentials Plus (certified 13 February 2026), both expiring in February 2027, checked on 3 November 2026.
Worked example: a 30-person UK company whose contract asks for Cyber Essentials falls in the small band (£440 scheme fee). Precursor's Cyber Essentials starts at £1,500 + VAT with that fee included, takes 1 to 2 weeks, and includes a scope review, verification of the answers before submission, the certificate and badge, and a free re-test within a defined window if gaps are found. The exact figure is fixed in writing after a free 20-minute scoping call.
It is not the right choice if your team already meets the controls and only needs marking: self-assess for the scheme fee alone. The full suitability, inclusions and policies for each service are on get certified, Cyber Essentials Plus and gap analysis, and in machine-readable form at /offers.json.
Related pages
- Cyber Essentials costScheme fee bands and assessor prices, dated
- Self-assessment vs using an assessorWhen paying for help is worth it
- What happens if you failRe-mark and retest rules
- Cyber Essentials PlusThe five test cases and the three-month window
- Gap analysisFind the failures before the assessor does
- Contact our assessorsAsk the questions on this page of us too
Frequently asked questions
Look the provider up by name in the list of licensed Certification Bodies on the IASME website. IASME is the NCSC's Delivery Partner for Cyber Essentials and only its licensed bodies can issue certificates. Then check the provider's own certificate on the IASME certificate search. A consultancy that is not on the list can help you prepare but cannot certify you.
No. The self-assessment fee is set by IASME by staff numbers: £320 for 0 to 9, £440 for 10 to 49, £500 for 50 to 249, £600 for 250+, ex VAT, verified 4 November 2026. Every Certification Body charges the same fee. What differs is what the provider charges on top, and whether its quote includes the fee or adds it later.
Only if you already meet the five controls and can evidence them. The certificate is identical whoever marks it, so paying for help buys a lower chance of failing and less of your own time. Compare quotes on what they include: the scheme fee, a review before submission, who handles the free re-mark and what a second failure costs.
Yes. A Certification Body can support your preparation and also mark your submission. The assessor marks against the same standard either way; support improves the accuracy of your answers but does not change the pass mark. A board member or equivalent from your organisation still signs the declaration.
Less than it used to. The self-assessment is completed and marked online, so any UK Certification Body can serve any UK postcode. Location matters for Cyber Essentials Plus, where some estates need a site visit. Ask whether testing will be remote or on site, and whether travel is charged on top.
Choose a provider that delivers Plus itself. The Plus audit must be completed within 3 months of your Cyber Essentials certification and on the same scope, so a body that can schedule the audit before you submit the self-assessment keeps the audit inside the window.
Get certified at a fixed price
Precursor is an IASME Certification Body: Cyber Essentials from £1,500 and Cyber Essentials Plus from £3,000, with the IASME fee included, a free re-test if gaps are found and a written fixed price after a 20-minute scoping call.
- IASME Certification Body
- CREST accredited
- UK offices in Leeds, Newcastle, London and Edinburgh
- IASMEIASME, Cyber Essentials scheme and Certification BodiesRead on iasme.co.uk (opens in a new tab)
- IASMEIASME certificate searchRead on iasme.co.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials frequently asked questionsRead on iasme.co.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials terms and conditions (12-month validity, free resubmission within 48 hours)Read on iasme.co.uk (opens in a new tab)
- IASMEIASME, Important update: changes to Cyber Essentials for April 2026Read on iasme.co.uk (opens in a new tab)
- NCSCNCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 · April 2026Read on ncsc.gov.uk (opens in a new tab)
- NCSCNCSC, Cyber Essentials Plus Test Specification v3.2Read on ncsc.gov.uk (opens in a new tab)
- NCSCNCSC Annual Review 2025, Chapter 2: Resilience at scale (Cyber Essentials figures for 2024/25) · Verified 22 September 2026Read on ncsc.gov.uk (opens in a new tab)