How to get Cyber Essentials certified in 2026

What are the steps to get certified?

There are eight steps to Cyber Essentials certification, from defining the scope to receiving the result, with Cyber Essentials Plus as an optional ninth within three months. IASME's timings are quoted from its Cyber Essentials page, checked on 3 November 2026.

1. Define the scope. Decide between whole organisation and a sub-set, then list every network, device, operating system and cloud service in scope.
2. Run a gap check. Compare your current controls with Requirements v3.3 using the free readiness checker or a gap analysis, and record what needs fixing.
3. Clear the auto-fail questions. Install critical and high-risk updates within 14 days and enforce MFA on every cloud service for users and administrators. Remove unsupported software at the same time, because the licensed-and-supported requirement must be met too.
4. Buy the assessment. Buy the self-assessment from IASME or through a Certification Body; the fee follows your staff band. You then get a login to the assessment portal and have up to 6 months to submit, so buy when the fixes are close to done.
5. Answer the Danzell question set. Complete all 106 questions in the IASME portal with specific notes that name the control, the setting and the devices it applies to. You can save and return as often as you need.
6. Get board-level sign-off. A board member or equivalent must declare that the answers are accurate before submission.
7. Submit for marking. Submit in the portal. IASME says most assessors aim to return results within 3 days, and they ask for more detail where a notes field is unclear.
8. Receive the result. A pass issues the certificate straight away, valid for 12 months. If it fails, IASME's terms give one free further assessment if you resubmit within 48 hours of the fail notice.
9. Book Cyber Essentials Plus if required. Plus testing must be completed within 3 months of the self-assessment certificate on the same scope, and the self-assessment answers cannot be changed once Plus testing starts.

The order matters. Scope first, because every later answer depends on what is in it. Gap check second, because fixing an unsupported operating system or rolling out MFA takes longer than answering the questions. The question set itself is the last thing to do, not the first.

Which questions fail the assessment on their own?

Four questions fail a Cyber Essentials assessment automatically on a No answer: A6.4, A6.5, A7.16 and A7.17. A7.15 fails automatically if a cloud service listed there as having no MFA option does offer MFA.

A6.4AUTO-FAIL and A6.5AUTO-FAIL ask whether critical and high-risk updates for operating systems and applications are installed within 14 days of release. A7.16AUTO-FAIL and A7.17AUTO-FAIL ask whether MFA is applied to every administrator and every user of your cloud services. A7.15AUTO-FAIL lists the cloud services that offer no MFA option at all.

A No on any of the four fails the whole assessment regardless of the other answers. A6.3 and A6.6 (unlicensed or unsupported software) are not labelled automatic fails, but a non-compliant answer means the licensed-and-supported requirement is not met, so clear them at the same time. Check all of them before you pay the scheme fee. The readiness checker asks each of them first for that reason.

How long does each step take?

Answering the question set takes a few hours; fixing gaps takes longer. With the evidence ready, supported certification typically takes 1 to 2 weeks.

With the evidence already gathered, the question set takes a few hours. Precursor's turnaround for a supported self-assessment is 1 to 2 weeks, and a standalone gap analysis takes 1 to 3 days. The long steps are the fixes: replacing an unsupported operating system across a fleet, enforcing MFA on a service that staff use daily, or separating administrator accounts. Plan those before you book a submission date.

IASME says most assessors aim to return results within 3 days of submission, and to re-mark a resubmission within another 3. Queries add a round each, so specific notes fields save time twice: once at marking and again by avoiding a resubmission.

How much does it cost to get certified?

The IASME scheme fee for a Cyber Essentials self-assessment is £320 to £600 plus VAT, set by staff numbers. Assessor support and Cyber Essentials Plus are priced separately by the Certification Body. Until 31 March 2027, IASME's government-funded offer takes 75% off the fee for UK organisations with fewer than 250 staff that have not held Cyber Essentials in the last four years; see Cyber Essentials funding.

Precursor's supported Cyber Essentials is from £1,500 with the IASME fee included, and Cyber Essentials Plus is from £3,000 with Cyber Essentials included, all + VAT. See the full cost breakdown.

When do you need Cyber Essentials Plus?

You need Cyber Essentials Plus when a contract, framework or customer names it; otherwise it is optional. It must follow a valid self-assessment on the same scope within three months.

Cyber Essentials Plus is required when a contract or framework names it, and is chosen by organisations that want independent testing rather than a declaration. It has one prerequisite: a valid Cyber Essentials self-assessment certificate covering the same scope. The Plus assessment must be completed within 3 months of that certification. Book the audit date when you submit the self-assessment, not after the certificate arrives, so the window is not wasted on scheduling.