Cyber & ISO · IASME licensed certification body
Cyber Essentials Pre-Assessment
A full dry run of Cyber Essentials before anything official is submitted: every control checked, every gap found and a fix plan you can act on in days. Run by the same IASME licensed certification body that will certify you, so readiness and certification never argue with each other.
The pre-assessment at a glance
Definition
What is a Cyber Essentials pre-assessment?
A Cyber Essentials pre-assessment is a structured dry run of the certification: your scope, devices and cloud services checked against the current question set and the five controls by a licensed assessor, before anything official is submitted. It exists because failed applications cost time, money and tender deadlines, and almost every failure is visible in advance.
Intelance runs the pre-assessment and hardening package from £1,500 + VAT in days, fixed before we begin. Because we are an IASME licensed certification body, the firm that checks your readiness is the firm that certifies you: Cyber Essentials at the official fee of £320 to £600 + VAT by size, and Cyber Essentials Plus from £1,150 + VAT.
The same engagement is called a Cyber Essentials readiness assessment, gap assessment or pre-audit. The work is identical. Our questionnaire guide shows what the assessment asks, and the wider practice is described under cyber assurance.
Every control checked
Firewalls, configuration, access, malware and updates, against the current question set.
The scope mapped honestly
Home workers, BYOD and cloud services included before they surprise an assessor.
A prioritised fix plan
What must change, what should, and what already stands, in plain English.
A readiness decision
A clear yes or not yet, with the route to certification either way.
The surprises
Six expensive surprises the pre-assessment prevents
Almost every failed application traces to one of these six. Each card shows where the pre-assessment catches it, while it still costs days rather than deadlines.
The automatic fail
Unsupported software hiding in scope: the one finding that fails a Cyber Essentials application outright, and the most common.
Caught hereThe inventory check runs first, so end of life systems are upgraded, retired or descoped.The scope shock
The assessment covers home workers, personal devices reading company email and every cloud service, whether you declared them or not.
Caught hereScope mapped and agreed before a single question is answered.The MFA gap
Cloud services without multi factor authentication for users and administrators fail user access control.
Caught hereMFA switched on and evidenced across everything in scope.The patching backlog
High and critical updates older than fourteen days on devices in scope.
Caught hereThe backlog cleared, and automatic updates configured to keep it cleared.The admin habit
Daily email and browsing on administrator accounts, however good the intentions.
Caught hereSeparate accounts issued and the habit broken before anyone marks it.The evidence gap
Right answers you cannot prove: policies unwritten, settings unverified, screenshots missing.
Caught hereEvidence gathered per answer, so the assessor never has to come back twice.How it works
Scope to readiness decision in days
Four steps, one decision, and certification straight after with the same firm.
Scope and mapping
Devices, users, cloud services, home working and networks mapped against the scheme rules, so the boundary is right before anything is checked.
Gap analysis
Every control checked against the current question set, hands on where it matters, with nothing taken on trust.
Remediation and hardening
A prioritised fix plan: what fails, what risks a fail and what already stands. Gaps closed with your team while momentum is high.
Ready or not yet
A clear readiness decision with the evidence behind it. If you are ready, certification starts immediately.
Certification
Cyber Essentials at the official fee for your size, or straight into the Plus audit, with the same firm carrying you through.
Aiming for Plus? The pre-assessment extends to a dry run of all six audit tests, so the one day audit holds no surprises either.
Published fees
Where the pre-assessment leads
Every route out of the readiness decision is priced here, before you ask.
Cyber Essentials
The verified self-assessment, marked by our own licensed assessors at the official IASME fee for your size with nothing added.Best whenThe readiness decision is yes and the certificate is the goal. Fee£320 to £600 + VAT by sizeDays 02
Cyber Essentials Plus
The independently audited level: the pre-assessment extends to a dry run of all six audit tests, then the audit itself in one day for most SMEs.Best whenThe contract or framework names Plus. FeeFrom £1,150 + VAT1 to 3 weeks 03
Failed Cyber Essentials support
Failed with another certification body? We diagnose exactly why, fix the gaps with your team and get you resubmitted quickly.Best whenA rejection report has landed and the deadline has not moved. FeeFrom £950 + VAT 04ISO 27001 consulting
When customers want a full management system rather than baseline hygiene: gap assessment, implementation and audit support under the same roof.Best whenLarger customers or regulators are asking for more than the five controls. FeeGap assessment from £8,500 + VATThe alternatives
The routes compared
Three ways to approach the certification. The difference is where the failures get found.
The questionnaire answered from memory and submitted cold
The fee, the failure, the resubmission and the lost weeks
One automatic fail hiding in scope sinks the application
Simple estates, recently tested and certain
The free IASME readiness tool and question set, worked through internally
Free, plus the internal time to interpret every question
Honest effort, but nobody checks the answers before the assessor does
Small, simple estates with time and appetite
A licensed assessor dry runs the whole assessment, from £1,500 + VAT
Fixed before work starts, with the fix plan included
Failures are found here, where they cost days rather than deadlines
Anyone with a deadline, a complex estate or a previous failure
Scope
What the fee covers and what sits outside it
You get
A scope map covering devices, cloud services, BYOD and home working, agreed before questions are answered.
Every control checked hands on against the current question set, with nothing taken on trust.
A prioritised fix plan in plain English, closed alongside your team while momentum is high.
Evidence collected per answer, so the assessor never has to come back twice.
A readiness decision, then certification with the same firm at published fees.
This is not
The certification itself. It is the rehearsal that makes the certification a formality.
A vulnerability scan in disguise. It covers scope, controls, evidence and answers rather than software versions alone.
Padding. If you are already ready, the decision says so and the spend stops at the pre-assessment.
Generic advice. Everything maps to the current IASME question set, which changes year to year.
Where to start
The situations that bring people here
Four situations we are usually called into. If none of them fit, speak to an assessor and we will point you at the right first step.
Why Intelance
What you can expect from a licensed body
The same firm certifies you
The pre-assessment is run by the IASME licensed certification body that will mark your assessment, so readiness and certification never argue with each other.
The current question set
The scheme evolves every year. The dry run checks against the question set you will face rather than the version from last year.
One fixed fee that does not move
From £1,500 + VAT agreed before we begin, and it does not grow because gaps were found. Finding gaps is the job.
Honest when you are ready
If the estate would pass today, the readiness decision says so and the spend stops. The pre-assessment is a route to certification rather than a toll booth on the way to it.
The whole ladder under one roof
Cyber Essentials, Plus, ISO 27001 and IASME Cyber Assurance run by one firm, so the evidence gathered here keeps paying.
The people behind the work
The pre-assessment is run by our own licensed assessors, with senior consultants closing the gaps beside your team. Nothing is outsourced and nothing sits in a queue.
Readiness guides
All insights
Cyber EssentialsCyber Essentials questionnaire guide: how to answer every question (UK 2026)
How to answer the Cyber Essentials questionnaire, with seven worked example answers reviewed by an IASME licensed certification body: what a weak answer looks like, what a strong one looks like, and why scope decides everything.
24 March 2026 · 14 min read Read the guide
Cyber EssentialsCyber Essentials requirements explained (UK 2026 guide)
24 March 2026 · 9 min read
Cyber EssentialsCommon Cyber Essentials failures (and how to avoid them)
24 March 2026 · 9 min read
Cyber EssentialsCyber Essentials 2026: key changes and what they mean for SMEs
23 March 2026 · 11 min readReady to talk?
Tell us where the estate stands
Thirty minutes with a licensed assessor on your scope, your deadline and what has already been tried. If a tender is forcing the pace, say so: the pre-assessment starts the same week.
FAQs
Pre-assessment questions answered
What is a Cyber Essentials pre-assessment?
A structured dry run of the certification by a licensed assessor: scope mapped, every control checked against the current question set, gaps fixed and evidence gathered, ending in a clear readiness decision before anything official is submitted.
How much does a Cyber Essentials pre-assessment cost?
From £1,500 + VAT with Intelance, fixed before we begin, and the fee does not grow because gaps were found. Certification then follows at published fees: Cyber Essentials at the official £320 to £600 + VAT by size, and Cyber Essentials Plus from £1,150 + VAT.
How long does it take?
Days, for most organisations: scope and gap analysis early in the week, remediation alongside your team, and the readiness decision at the end. Certification can start immediately after a yes.
Do we need one?
Not always, and we will say so. A small, simple estate that was tested recently can go straight to certification, and the free IASME readiness tool is a genuinely useful self-check. The pre-assessment earns its fee when there is a deadline, a complex or unmapped estate, a previous failure, or Cyber Essentials Plus on the contract.
What does it check?
The scope boundary first, including home working, BYOD and cloud services, then all five controls against the current question set, hands on where it matters, and finally the evidence behind every answer. The output is a prioritised fix plan and a readiness decision.
Does it cover Cyber Essentials Plus?
Yes. For Plus, the dry run extends to all six audit tests: the vulnerability scans, patch checks, malware checks, email and browser tests and the account checks, so the one day audit holds no surprises.
What happens if gaps are found?
They are prioritised and fixed with your team as part of the engagement: that is the hardening half of the package. Remediation support continues until the readiness decision is a yes, and the fix plan stays yours either way.
Is this the same as a Cyber Essentials gap assessment?
Yes. Pre-assessment, readiness assessment, readiness review, gap assessment and pre-audit all describe the same dry run. Whatever it is called, the test is whether it checks the current question set, covers scope and evidence, and ends in a decision.
We failed Cyber Essentials. Can you help us pass?
Yes. If you failed with another certification body, our recovery service from £950 + VAT diagnoses exactly which answers failed and why, fixes the gaps and gets you resubmitted quickly. The scheme also allows two working days after a failure to fix simple issues and resubmit at no extra charge, so speed matters.