Cyber & ISO · IASME licensed certification body
Cyber Essentials Certification
Cyber Essentials certification with the certification body itself: we check your readiness, close the gaps with you and certify you ourselves. Official IASME fees with nothing added, a certificate in days, and £25,000 of cyber liability insurance included for eligible UK organisations.
Certification at a glance
Definition
What is Cyber Essentials certification?
Cyber Essentials certification is the UK government backed standard for basic cyber security: an annually renewed self-assessment against five technical controls, verified by a licensed assessor, at official fees from £320 + VAT set by organisation size. Cyber Essentials Plus adds an independent technical audit of the same controls. Certification is required in many central government contracts and across the Ministry of Defence supply chain.
Intelance is an IASME licensed certification body: we check your readiness, close the gaps with you and then certify you ourselves. The official fee is £320, £440, £500 or £600 + VAT by organisation size, with nothing added. Cyber Essentials Plus starts at £1,150 + VAT with Intelance, where most providers charge £1,500 to £3,000.
Certificates expire after twelve months and the question set evolves each year. Our guide to the cost of Cyber Essentials breaks down every fee, and the wider practice is described under cyber assurance.
Firewalls
Every device sits behind a correctly configured firewall or router.
Secure configuration
Defaults changed, unused software removed, services locked down.
User access control
Admin rights limited, separate accounts for daily work, MFA on.
Malware protection
Anti malware or allow listing active on every device in scope.
Security update management
High and critical updates applied within fourteen days.
The failure modes
Six reasons Cyber Essentials applications fail
Most failures are avoidable and most are found in the same six places. The readiness check looks for all of them before anything is submitted.
Unsupported software
A Windows or macOS version past end of life anywhere in scope is the only automatic fail in the scheme, and the most common one.
The fixAn inventory check before submission: upgrade it, retire it or descope it before anyone marks it.Missing MFA on cloud services
Microsoft 365, Google Workspace and every cloud service in scope need multi factor authentication for users and administrators.
The fixMFA switched on and evidenced before the questionnaire goes anywhere near the portal.Updates older than fourteen days
High and critical security updates must be applied within fourteen days of release, across every device in scope.
The fixAutomatic updates configured, and the patching answers written from evidence rather than hope.Everyone is an admin
Day to day email and browsing on administrator accounts fails user access control, however good the intentions.
The fixSeparate admin accounts, standard accounts for daily work, and the difference documented.Default and weak passwords
Router defaults, shared logins and password rules that fall short of the standard sink otherwise ready applications.
The fixThe password policy aligned to the standard, defaults changed, and the evidence kept.The scope declared wrong
Home workers, personal phones reading company email and forgotten cloud services all sit in scope whether declared or not.
The fixThe scope mapped honestly first, so the certificate covers what your customers think it covers.How it works
Application to certificate in days
The same firm checks you, fixes the gaps with you and certifies you, so nothing waits in a queue between steps.
The readiness check
Your answers reviewed against the current question set before anything is submitted, so you apply knowing the result rather than hoping for it.
Closed with you
Whatever the check finds, fixed with your team: MFA, patching, admin accounts, scope. Most gaps close within days.
Cyber Essentials
The verified self-assessment, marked by our own licensed assessors at the official IASME fee for your size. Certificate in days.
Cyber Essentials Plus
The independent technical audit of the same controls: vulnerability scans plus a sample of user devices, internet gateways and servers.
The renewal
Certificates expire after twelve months and the question set evolves. We remind you, re-check you and recertify you.
Certified less than three months before stepping up? The self-assessment stage of Cyber Essentials Plus does not need repeating, which is why many organisations take both together.
Published fees
The full offer with every fee published
Cyber Essentials itself is charged at the official IASME fee for your size. Everything around it is priced here, before you ask.
Cyber Essentials Plus
The independently audited version of the certificate: vulnerability scans and device testing by our own assessors, one to three weeks end to end.Best whenThe contract or framework names Plus, or your customers want tested proof. FeeFrom £1,150 + VAT1 to 3 weeks 02
Readiness pre-assessment
A full dry run of the assessment against the current question set, with a gap report and a fix plan, before any official submission.Best whenYou want certainty before the clock starts, or the estate has never been checked. FeeFrom £1,500 + VATDays 03
Failed Cyber Essentials support
Failed with another certification body? We diagnose why, fix the gaps with your team and get you resubmitted quickly.Best whenA rejection report has landed and a tender or renewal date has not moved. FeeFrom £950 + VAT 04ISO 27001 consulting
When customers ask for more than the floor: gap assessment, implementation and audit support under the same roof, on the same evidence.Best whenLarger customers or regulators want a full management system rather than just the five controls. FeeGap assessment from £8,500 + VATThe alternatives
The routes compared
Every IASME licensed body issues the same certificate. What differs is who prepares you, what it really costs and what happens when something fails.
A web form and a marking queue at the lowest headline price
The official fee plus the portal subscription
A feedback report and the resubmission clock
Organisations that would pass anyway
Your IT provider answers the questions on systems it also configures
Bundled into the support contract, so nobody can see it
The same hands mark their own configuration
Firms comfortable with the conflict of interest
An IASME licensed body that prepares you, then certifies you
£320 to £600 + VAT by size, nothing added. Plus from £1,150
Rare by design: the readiness check runs first, and the assessor guides any fix inside the window
Organisations that want to pass first time and stay certified
Scope
What the fee covers and what sits outside it
You get
A readiness check against the current question set before anything is submitted.
Gaps closed with your team: MFA, patching, admin accounts, scope and the evidence behind each answer.
Certification by our own licensed assessors at the official IASME fee, with the certificate in days.
£25,000 of cyber liability insurance included for eligible UK organisations, at no extra cost.
A renewal rhythm: reminded, re-checked and recertified every year as the standard evolves.
This is not
A marking queue. A named assessor handles you from readiness check to certificate.
A middleman. We are the certification body, so the official fee on the IASME schedule is the certification fee, full stop.
A rubber stamp. The five controls must genuinely be in place. What we guarantee is that you submit when you are ready to pass.
The ceiling. When customers ask for more, ISO 27001 and IASME Cyber Assurance carry on from the same evidence.
Where to start
The situations that bring people here
Four situations we are usually called into. If none of them fit, speak to an assessor and we will point you at the right first step.
Why Intelance
What you can expect from a licensed body
The certification body itself
Intelance is licensed by IASME to certify Cyber Essentials and Cyber Essentials Plus. No middleman, no marking queue, and the official fee with nothing added.
You submit when you will pass
The readiness check runs before anything is submitted, which is why our clients pass first time instead of discovering the automatic fails in a feedback report.
Official fees published in full
£320 to £600 + VAT by organisation size for Cyber Essentials, set by IASME. Cyber Essentials Plus from £1,150 + VAT, where most providers charge £1,500 to £3,000.
Insurance included
Eligible UK organisations with under £20 million turnover receive £25,000 of cyber liability insurance with certification, at no extra cost.
A ladder when you need it
Cyber Essentials is the entry rung. When a customer or regulator wants more, ISO 27001 and IASME Cyber Assurance run under the same roof, on the same evidence.
The people behind the work
Certification is run by our own licensed assessors, with senior consultants closing the gaps beside your team. Nothing is outsourced and nothing sits in a queue.
Cyber Essentials guides
All insights
Cyber EssentialsCyber Essentials cost UK: full pricing breakdown (2026 guide)
The real Cyber Essentials cost in the UK: official IASME fees by size band, realistic Cyber Essentials Plus pricing, three realistic all-in budgets, the hidden costs, and how to avoid overpaying.
23 March 2026 · 10 min read Read the guide
Free toolCyber Essentials cost calculator
Your certification budget in under a minute
Cyber EssentialsCyber Essentials requirements explained (UK 2026 guide)
24 March 2026 · 9 min read
Cyber EssentialsHow to pass Cyber Essentials first time (UK step-by-step guide)
23 March 2026 · 9 min read
ISO 27001ISO 27001 cost UK: what certification really costs (2026)
10 July 2026 · 6 min readReady to talk?
Tell us who is asking and when
Thirty minutes with a licensed assessor on who wants the certificate, which level they mean and the date it must exist by. If the tender closes this month, say so: the readiness check starts the same week.
FAQs
Cyber Essentials questions answered
What is Cyber Essentials certification?
The UK government backed standard for basic cyber security: an annually renewed self-assessment against five technical controls, verified by a licensed assessor. Cyber Essentials Plus adds an independent technical audit of the same controls. A board member signs a declaration that the answers are true, and the certificate is checkable on the public NCSC register.
How much does Cyber Essentials cost?
The official IASME assessment fee is set by organisation size: £320 + VAT for micro organisations (0 to 9 staff), £440 for small (10 to 49), £500 for medium (50 to 249) and £600 for large (250 plus). With Intelance that official fee is the whole certification cost, with nothing added. Cyber Essentials Plus starts at £1,150 + VAT. The honest answer also includes preparation: most organisations spend more time than money, mostly on MFA, patching and tidying admin accounts.
How long does Cyber Essentials take?
With answers prepared, the questionnaire itself takes about an hour, and assessors aim to mark within three days. With our readiness check done first, the certificate typically lands in days. The scheme allows six months from application to submission, so the deadline pressure usually comes from the tender rather than the scheme.
What is the difference between Cyber Essentials and Cyber Essentials Plus?
The controls are identical. The assurance differs. Cyber Essentials is a verified self-assessment. Cyber Essentials Plus adds an independent technical audit: internal and external vulnerability scans and hands-on testing of a sample of user devices, all internet gateways and internet-facing servers. If you certified Cyber Essentials less than three months earlier, the self-assessment stage does not need repeating for Plus.
What happens if we fail?
The scheme gives you two working days to fix simple issues and resubmit at no extra charge. After that, it is a new application and a new fee. Our readiness check exists so it never gets that far. If you have already failed with another certification body, our recovery service from £950 + VAT diagnoses why, fixes the gaps and gets you resubmitted quickly.
Is anything an automatic fail?
Yes. Unsupported software in scope, such as an operating system past end of life, fails the assessment outright. It is also the most common failure, which is why the readiness check starts with an inventory.
Do we need Cyber Essentials for government contracts?
Many central government contracts require it, and the Ministry of Defence requires it across the supply chain wherever defence information is handled. Commercial supply chains increasingly ask for it too, which is why most of our clients arrive with a tender deadline attached.
What is the £25,000 cyber insurance?
UK organisations with under £20 million turnover that certify their whole organisation receive £25,000 of cyber liability insurance included with Cyber Essentials, at no extra cost. It is arranged through the scheme rather than by us, and comes with any valid certificate where the eligibility criteria are met.
Does the certificate expire?
Yes, after twelve months. The question set also evolves year to year, so renewal is a fresh assessment rather than a rubber stamp. We remind you about a month before expiry, re-check the changes and recertify you.
What comes after Cyber Essentials?
For most organisations, staying certified is enough. When larger customers or regulators want more, the usual steps are ISO 27001 or IASME Cyber Assurance, both delivered under the same roof. Our guide to Cyber Essentials vs ISO 27001 vs IASME Cyber Assurance sets out which you need and in what order.