Cyber Essentials is a UK Government backed scheme developed by the National Cyber Security Centre (NCSC), with IASME as its delivery partner. It helps you demonstrate a recognised baseline of protection against common cyber threats. We help you understand the requirements, define the right scope and prepare with confidence.
Choose Guided Preparation when your team or IT provider can lead the work, or Managed Preparation when you want us to drive the preparation project. We coordinate with trusted certification bodies to keep the route to independent assessment clear and moving. Cyber Essentials Plus readiness is scoped separately.
What you can expect
Know what is needed. Be ready to submit.
Our work starts with your environment, your reason for certification and any deadline you need to meet. We turn the requirements into a clear preparation process, helping you address gaps and submit answers that accurately describe the controls in place.
01
A clear certification scope
Understand the organisation, devices, users, networks and cloud services that need to be considered. Agree the scope and responsibilities before preparing the submission.
02
A practical readiness review
Review the five technical controls and the information behind your answers. Receive a colour coded readiness picture, prioritised gaps and actions for the right people to address.
03
An accurate, reviewed submission
Get questionnaire guidance or drafting support according to your package, followed by a final preparation check. Your board member, director or equivalent authorised senior representative confirms that the answers are accurate.
04
Support through assessment and closeout
Both preparation packages include reasonable assessor clarification support, support through one formal remediation and resubmission cycle, and a completion pack with the agreed scope, final questionnaire, action record and renewal date. The certificate is included when issued by the certification body.
What is included in the agreed scope?
Your proposal separates our preparation fee from certification body charges. Technical implementation, extensive policy creation, licences, equipment and Cyber Essentials Plus readiness or auditing are quoted separately. We agree the support, responsibilities, dependencies and any additional work before it starts. Certification decisions remain with the independent certification body.
The right support for your team
Keep the lead. Or let us drive the preparation.
Guided and Managed describe how we support your Cyber Essentials preparation. Choose the approach that fits your team’s time, technical capability and need for coordination.
You lead. We guide.
Guided Preparation
From £295Samaryam preparation fee
A good fit when your internal IT team or provider can gather the information and implement the changes. We help you interpret the requirements, review the answers and understand your readiness.
A scoping workshop and guidance through the current questionnaire.
Review of your draft answers, a readiness review and remediation recommendations.
One follow up preparation session and final submission quality check.
Reasonable assessor clarification support and one formal resubmission cycle.
A completion pack and clear next steps after assessment.
Your part in the process
Your team gathers evidence, drafts the first answers, implements changes and enters the submission in the portal.
We lead the preparation.
Managed Preparation
From £495Samaryam preparation fee
A good fit when you want a clear owner to move the preparation forward. It includes Guided support, with us coordinating information, drafting responses and managing the preparation activities.
Coordinated asset information, evidence gathering and detailed scope definition.
Questionnaire drafting and a detailed gap analysis.
Direct liaison with your IT provider and remediation tracking to closure.
Portal preparation assistance and liaison around assessor queries.
A final submission pack, completion records and renewal handover.
Your part in the process
You and your IT provider supply accurate information and carry out the agreed technical changes. Your authorised senior representative approves the submission.
Starting fees apply to straightforward environments. The number of sites, systems, cloud services and IT suppliers can affect preparation effort. We confirm your fixed preparation quote after scoping. Certification body fees, technical remediation and Plus readiness or auditing are separate, with applicable VAT made clear in your proposal.
Compare who does what
Responsibilities in the two preparation packages
Activity
Guided Preparation
Managed Preparation
Scope
Joint scoping workshop and scope review
We drive detailed scope definition
Information and evidence
Your team gathers the information
We coordinate collection with your team
Questionnaire first draft
Your team drafts; we guide and review
We draft from the information you provide
Remediation coordination
Your team manages the actions
We track actions and liaise with your IT provider
Technical implementation
Separately scoped, or delivered by your IT provider
Separately scoped, or delivered by your IT provider
Portal preparation
Your team enters the reviewed answers
We assist with preparing and transferring answers
Final approval
Your authorised senior representative
Your authorised senior representative
Assessor queries
Joint response with our guidance
We drive the response with your input
Completion pack
Included
Included
Choose the right level of assurance
Cyber Essentials or Cyber Essentials Plus?
Both assess the same five technical controls. The difference is how the controls are verified.
Verified self assessment
Cyber Essentials
You describe your organisation’s scope and controls through the questionnaire. A qualified assessor independently reviews your answers, with certification awarded when the requirements are met.
Choose Guided or Managed Preparation to help you get ready.
Independent technical audit
Cyber Essentials Plus
Build on Cyber Essentials with an independent technical audit that verifies the controls in practice. We can separately scope readiness support, coordinate access and audit arrangements, and help you plan any required improvements.
Plus readiness support and the certification body’s audit are quoted separately.
Five controls. A stronger everyday baseline.
Connected protections that address common routes into your organisation.
01
Firewalls
Control the traffic between your systems and the internet.
02
Secure configuration
Reduce exposure through secure settings and fewer unnecessary features.
03
Security update management
Keep supported software current and address critical vulnerabilities promptly.
04
User access control
Give people the access they need, with appropriate protection around accounts.
05
Malware protection
Use suitable protections to detect or prevent malicious software.
Planning for Plus? Tell us at the start so scope, readiness and audit dates can be coordinated. Cyber Essentials is a prerequisite; the Plus audit must be completed within three months of your most recent Cyber Essentials certification. We confirm the applicable route and timing with the certification body.
Stronger protection. Confidence you can demonstrate.
Reduce common risks
The five controls establish practical protections against common internet threats. Preparation helps your team understand the gaps and put the right improvements in place.
Build customer confidence
A recognised certificate helps you demonstrate your security baseline to customers and suppliers, and respond to contracts or procurement processes that require Cyber Essentials.
Included cyber insurance
Eligible organisations can opt in to cyber liability insurance at no extra cost with whole organisation certification. We can help you understand the scheme’s eligibility criteria and insurance arrangements.
Insurance eligibility: UK or Crown Dependency domicile, annual turnover under £20 million, whole organisation certification and opting in are required. The policy has a £25,000 total limit, with terms, excesses and exclusions.
A stronger supply chain starts with shared expectations.
The voluntary pledge asks organisations to put cyber security on the board agenda, use the NCSC’s Early Warning service and take a risk based approach to requiring Cyber Essentials across their supply chains. Certification helps you respond to those customer expectations. Signing the pledge is a separate commitment.
We work with trusted IASME licensed certification bodies, with a clear separation between our preparation support and their independent assessment. Coordinated preparation and assessor liaison help keep your engagement moving with fewer avoidable delays.
01
We prepare
Scope, readiness, questionnaire support and coordination.
02
You approve
Your organisation confirms that the submission is accurate.
03
The body certifies
An independent assessor reviews the submission and awards certification when requirements are met.
Working towards a deadline?
Tell us early. We can discuss priority preparation and partner Fast Track assessment where available, with any additional fees agreed upfront. Fast Track applies to assessor feedback after submission; readiness, remediation and audit availability determine the overall timeline.
How we work together
From preparation to independent assessment.
A clear sequence of scoping, readiness, client approval and independent certification, with the level of support you choose.
01
Scope and choose
Understand your environment and deadline. Agree Guided or Managed Preparation, the certification route and a clear quote.
02
Review and prepare
Gather evidence, prepare the questionnaire and check readiness against the five controls. Agree owners for any gaps and coordinate separately scoped remediation.
03
Approve and assess
Your authorised senior representative approves the answers. The certification body assesses independently, with our support for agreed clarifications and one formal resubmission cycle.
04
Close out and sustain
When certification is awarded, receive your completion pack and renewal date. Plan Plus or ongoing support to keep the controls effective as your business changes.
Frequently Asked Questions
What would you like to know?
Practical answers about this service, its scope and the next step.
Our dedicated searchable knowledge base answers many more questions about this service.
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Cyber Essentials is a UK Government backed scheme supported by the NCSC. Cyber Essentials is a verified self assessment reviewed by a qualified assessor. Cyber Essentials Plus uses the same five technical controls but adds an independent technical audit to check that the controls are in place. Cyber Essentials certification is a prerequisite for Plus. Preparation support and certification body charges are agreed separately.
How do Guided and Managed Preparation differ?
In Guided Preparation, your team or IT provider gathers evidence, drafts answers, manages technical actions and enters the portal submission. We provide scoping guidance, a readiness review, recommendations, one follow up preparation session and final quality checks. Managed Preparation includes Guided support, with us driving detailed scoping, coordinating evidence, drafting answers, liaising with your IT provider, tracking remediation and assisting with portal preparation. Your organisation approves the answers in both packages.
How much does preparation cost?
Guided Preparation starts from £295 and Managed Preparation from £495 for straightforward environments. Scope, systems, sites, cloud services and supplier arrangements determine the final fixed preparation quote. Our preparation fee reflects complexity rather than employee count alone. Certification body fees, technical implementation, Plus readiness and Plus auditing are separate, with applicable VAT made clear in your proposal.
Is technical remediation included?
The preparation packages include identifying the actions needed, with remediation coordination and tracking in Managed Preparation. Implementation such as firewall changes, MFA rollout, patch deployment, cloud configuration, new systems or extensive policy creation is separately scoped. Your IT provider can deliver the changes, or Security Foundations can provide itemised fixed price modules agreed before work starts.
How long does preparation take, and can you help with a deadline?
We agree a realistic preparation timetable after scoping, based on your readiness, information availability and any technical changes needed. Tell us about tender or commercial deadlines early. We can coordinate with your IT provider and discuss partner Fast Track assessment where available, with additional fees agreed upfront. Fast Track concerns assessor feedback after submission; preparation, remediation and Plus audit availability still determine the overall timeline. A completion date or successful result cannot be guaranteed.
Can you prepare us for Cyber Essentials Plus?
Yes, as a separate readiness engagement. We can review the intended audit scope, identify preparation needs, coordinate your team and the certification body, and help organise access and audit dates. Plus auditing is carried out independently by the certification body and is separately charged. The Plus audit must be completed within three months of your most recent Cyber Essentials certification. If your certificate is older, the self assessment stage needs to be repeated. We confirm the route and dates with the certification body before proceeding.
How do renewal and ongoing support work?
Cyber Essentials and Cyber Essentials Plus certificates expire after 12 months. Your organisation must maintain the controls throughout the year, rather than only preparing for renewal. A separately scoped renewal review refreshes your scope, questionnaire and readiness. A Cyber Resilience Partnership can provide agreed regular reviews, such as a monthly touchpoint with your team or IT provider, to track changes to users, devices, cloud services, access and updates. Renewal preparation is included where agreed, with technical remediation separately scoped through Security Foundations.
Does passing include cyber insurance?
Eligible organisations can opt in to cyber liability insurance at no extra cost when they certify their whole organisation. They must be domiciled in the UK or Crown Dependencies and have annual turnover under £20 million. The included policy has a £25,000 total limit and is subject to its terms, excesses and exclusions. Check the current IASME eligibility and policy details.
Your priorities set the direction. A conversation helps you choose the support that fits.
A conversation is a good place to start
Let’s make your next step a confident one.
Start with a free discovery call. Tell us what matters to your business and where you need help. We’ll listen, explore your priorities and help you find a practical way forward.
