Cyber & ISO · IASME licensed certification body
Cyber Essentials Plus Certification
Cyber Essentials Plus certification with the certification body itself: we prepare you, run all six checks as a dry run, then audit and certify you. From £1,150 + VAT where most providers charge £1,500 to £3,000, one to three weeks end to end, and the audit itself is one day for most SMEs.
Certification at a glance
Definition
What is Cyber Essentials Plus certification?
Cyber Essentials Plus certification is the independently audited level of the UK government backed Cyber Essentials scheme. The controls are identical to Cyber Essentials. The difference is proof. A licensed assessor runs vulnerability scans and hands-on tests across a sample of your devices, all internet gateways and every internet-facing server, rather than taking the questionnaire on trust.
With Intelance, an IASME licensed certification body, Cyber Essentials Plus starts at £1,150 + VAT, fixed before we begin, where most providers charge £1,500 to £3,000. The route typically takes one to three weeks end to end, the audit itself is one day for most SMEs, and Cyber Essentials must be passed within the previous three months at the official fee of £320 to £600 + VAT by organisation size.
Both certificates renew annually and sit on the public NCSC register. Our guide to Cyber Essentials Plus covers the requirements in depth, and the wider practice is described under cyber assurance.
A dry run before the audit
We run the same six checks first, so audit day holds no surprises.
One day on site or remote
The audit itself is one day for most SMEs, run by our own assessors.
A sample of your devices
A sample of each device type, all gateways, every internet-facing server.
Proof your customer can check
The certificate sits on the public NCSC register for twelve months.
The audit
What the assessor tests
Six checks, run on a sample of every device type plus your gateways and internet-facing servers. Each card shows what has to be true to pass. The dry run tests all six before the audit is booked.
External vulnerability scan
Every internet-facing IP address scanned for known vulnerabilities and exposed services, from outside your network.
What passesNo high or critical findings on anything reachable from the internet.Authenticated patch scan
A credentialed scan of the sampled devices, checking for missing security updates and unsupported software.
What passesHigh and critical updates applied within fourteen days, nothing past end of life.Malware protection check
Anti malware confirmed present, current and correctly configured on every sampled device.
What passesProtection active and up to date on every device type in the sample.Email attachment test
Test files sent to your users to confirm dangerous attachment types are blocked before they arrive.
What passesExecutable attachments never reach an inbox in a runnable state.Browser download test
The same file types downloaded through the browser on each sampled device type.
What passesDangerous downloads blocked, quarantined or challenged before they can run.Account and MFA checks
Admin separation and multi factor authentication verified across the cloud services in scope.
What passesDaily work happens on standard accounts, and MFA is on where the scheme requires it.How it works
Booking to certificate in one to three weeks
The same firm prepares you, audits you and certifies you, so nothing waits in a queue between steps.
Cyber Essentials
The verified self-assessment must be passed within the three months before Plus, at the official fee for your size. Take both together and nothing repeats.
The dry run
We run the same six checks ourselves and fix what they find, so the audit is a formality rather than a gamble.
The audit
Scans and hands-on tests across the device sample, all internet gateways and internet-facing servers, by our own IASME licensed assessors. One day for most SMEs.
The certificate
Marked, certified and visible on the public NCSC register within days, ready to send to whoever asked for it.
The renewal
Plus renews annually alongside Cyber Essentials. We remind you, re-run the dry run and re-audit.
Starting from nothing? Cyber Essentials and Plus taken together run as one route: the self-assessment stage never repeats, and the whole journey still lands inside three weeks for most SMEs.
Published fees
The Plus fees in full
Everything around the Plus audit is priced here, before you ask.
Cyber Essentials
The verified self-assessment that must precede Plus, at the official IASME fee for your size with nothing added. Certificate in days.Best whenPlus is the target and CE is not yet in place, or is older than three months. Fee£320 to £600 + VAT by sizeDays 02
Readiness pre-assessment
The full dry run as a standalone engagement: all six checks, a gap report and a fix plan, before any audit is booked.Best whenYou want certainty before committing, or the estate has never been tested. FeeFrom £1,500 + VATDays 03
Failed Plus elsewhere
Failed the audit with another provider? We diagnose exactly which test failed and why, fix it with your team and re-audit quickly.Best whenA failed report has landed and the contract date has not moved. FeeFrom £950 + VAT 04ISO 27001 consulting
When the customer wants a management system rather than tested hygiene: gap assessment, implementation and audit support under the same roof.Best whenLarger customers or regulators are asking for more than the five controls. FeeGap assessment from £8,500 + VATThe alternatives
What is your customer or insurer asking for?
Cyber Essentials Plus, penetration testing and ISO 27001 answer different questions. Matching the certificate to the ask saves months and five figures.
That skilled humans probing your estate found specific weaknesses on that day
Days of manual testing scoped to chosen targets, plus a findings report
Typically four figures per test, scoped case by case
A specific system needs adversarial testing
That a full information security management system runs across the organisation
Months of implementation and an external certification audit
Five figures and months, with certification body fees on top
Large customers or regulators want a management system
That the five technical controls are genuinely in place, tested by a licensed assessor
A one day audit for most SMEs: scans, sampled devices, gateways and servers
From £1,150 + VAT with Intelance, one to three weeks end to end
A contract, framework or supply chain demands tested cyber hygiene
Scope
What the fee covers and what sits outside it
You get
A dry run of all six tests before the audit is booked, with the gaps fixed alongside your team.
The audit in one day for most SMEs, on site or remote, by our own licensed assessors.
A fixed fee from £1,150 + VAT, agreed before we begin, where most providers charge £1,500 to £3,000.
The certificate on the public NCSC register, ready to send to whoever demanded it.
A renewal rhythm: reminded, dry run re-run and re-audited every year.
This is not
A penetration test. Plus verifies the five controls. Adversarial testing of specific systems is a different engagement.
A paperwork exercise. Devices are tested hands on. A tidy questionnaire does not pass a failing estate.
A middleman. We are the certification body: the assessor who audits you works for the firm you hired.
A one-off. The certificate expires after twelve months, and the renewal is designed in rather than discovered.
Where to start
The situations that bring people here
Four situations we are usually called into. If none of them fit, speak to an assessor and we will point you at the right first step.
Why Intelance
What you can expect from a licensed body
The body behind the certificate
Intelance is licensed by IASME to audit and certify Cyber Essentials Plus. The firm that prepares you is the firm that certifies you, with no marking queue in between.
The dry run first
We sit the six tests ourselves before the audit is booked. Anything that would fail is fixed in readiness instead of on audit day.
A fixed fee below the market
From £1,150 + VAT agreed before we begin, where most providers charge £1,500 to £3,000. The price scales with device types and locations, and you see it before you commit.
One audit day for most SMEs
Scans, sampled devices, gateways and servers in a single day, on site or remote, with the certificate following within days.
The ladder carries on
Cyber Essentials, Plus, ISO 27001 and IASME Cyber Assurance run under one roof, so the evidence you build here is reused rather than rebuilt.
The people behind the work
Certification is run by our own licensed assessors, with senior consultants closing the gaps beside your team. Nothing is outsourced and nothing sits in a queue.
Cyber Essentials Plus guides
All insights
Cyber EssentialsCyber Essentials Plus: what it is, who needs it, what it costs, and how to pass
Cyber Essentials Plus, explained properly: what the audit tests, what it costs in the UK, the 27 April 2026 rule changes, and how to pass first time.
23 March 2026 · 10 min read Read the guide
Free toolCyber Essentials cost calculator
Your certification budget in under a minute
Cyber EssentialsCyber Essentials cost UK: full pricing breakdown (2026 guide)
23 March 2026 · 10 min read
Cyber EssentialsCommon Cyber Essentials failures (and how to avoid them)
24 March 2026 · 9 min read
Cyber EssentialsCyber Essentials vs ISO 27001: when you need one, both, and in what order
23 March 2026 · 10 min readReady to talk?
Tell us the deadline you are working to
Thirty minutes with a licensed assessor on the contract, the deadline and the estate. If Cyber Essentials is not yet in place, say so: taking both together is faster and nothing repeats.
FAQs
Cyber Essentials Plus questions answered
What is Cyber Essentials Plus certification?
The independently audited level of the UK government backed Cyber Essentials scheme. The five controls are identical to Cyber Essentials. The difference is that a licensed assessor tests them hands on, through vulnerability scans and checks on a sample of devices, all internet gateways and every internet-facing server.
How much does Cyber Essentials Plus cost?
From £1,150 + VAT with Intelance, fixed before we begin, where most providers charge £1,500 to £3,000. The price scales with device types and locations because the audit samples each type. The underlying Cyber Essentials fee is separate: £320 to £600 + VAT by organisation size, set by IASME.
How long does Cyber Essentials Plus take?
One to three weeks end to end with the dry run included, and the audit itself is one day for most SMEs. The certificate follows within days of a successful audit and appears on the public NCSC register.
What does the Cyber Essentials Plus audit involve?
Six checks: an external vulnerability scan of internet-facing systems, an authenticated patch scan on sampled devices, malware protection checks, an email attachment test, a browser download test, and account separation and MFA verification. The sample covers each device type, all internet gateways and every internet-facing server.
Do we need Cyber Essentials before Plus?
Yes. Cyber Essentials must be passed within the three months before the Plus audit. Taken together as one route, the self-assessment stage never repeats and the whole journey lands inside three weeks for most SMEs.
What happens if something fails on audit day?
With the dry run done, it rarely gets that far: we run the same six checks first and fix what they find. Where a finding does appear, the assessor tells you exactly what failed and why, and we re-test quickly. If you failed with another provider, our recovery service from £950 + VAT diagnoses the failure and gets you re-audited.
Is Cyber Essentials Plus a penetration test?
No. Plus verifies that the five baseline controls are genuinely in place. A penetration test is adversarial testing of chosen targets by skilled humans. Customers sometimes say one and mean the other, which is why the first call establishes who is asking and what they want.
Cyber Essentials Plus or ISO 27001?
Different questions. Plus proves tested technical hygiene in weeks for four figures. ISO 27001 proves a full management system in months for five. Many organisations hold both, and the evidence from Plus feeds straight into ISO 27001 under the same roof. Our guide to Cyber Essentials vs ISO 27001 vs IASME Cyber Assurance sets out which you need.
How often does Cyber Essentials Plus renew?
Annually, alongside Cyber Essentials. Both certificates expire after twelve months. We remind you before expiry, re-run the dry run against the current question set and re-audit.