Compliance
Cyber Essentials
Get clear on what the scheme requires, then get matched with a consultant who can get you ready.
Cyber Essentials is a UK government-backed scheme covering five technical controls. It is increasingly a condition of doing business — required for many central government contracts, common in NHS supply chains, and frequently requested by larger customers during vendor due diligence. The scheme itself is straightforward. Working out what falls inside your scope, and getting your controls into a state that will pass, is where most organisations lose time.
What Cyber Essentials covers
The scheme tests five control areas: firewalls, secure configuration, user access control, malware protection, and security update management. Cyber Essentials is a self-assessment questionnaire submitted to a Certification Body for review. Cyber Essentials Plus adds a hands-on technical audit, where the same controls are independently verified against a sample of your devices and cloud services. Certification lasts twelve months. The most common cause of delay is not technical failure but scope confusion — which devices, which cloud services, which remote workers, and which parts of the business are actually in scope. Deciding that before you start the questionnaire usually saves more time than any other single step. A consultant helps you get to the point of passing: scoping the assessment, identifying what will fail before you submit, fixing it, and preparing your answers. The certificate itself is awarded by a Certification Body appointed by IASME, the scheme's delivery partner.
Who needs it
- Organisations bidding for central government or MoD contracts where certification is a stated requirement
- Suppliers to the NHS or to larger enterprises that ask for it during procurement
- Businesses whose cyber insurer offers better terms with certification in place
- Teams that have attempted the questionnaire, found they cannot answer it honestly, and need the underlying gaps fixed
What you get
Scope clarity before you commit
A consultant works out what falls inside your assessment boundary — devices, cloud services, home workers, BYOD — so you are not restarting the questionnaire halfway through.
Matching to a vetted consultant
We connect you with a consultant experienced in the scheme and suited to your size, sector, and whether you are pursuing the basic or Plus level.
A realistic view of cost and timeline
Indicative pricing covering both the consultant's preparation work and the certification fee, plus a sensible timeline including any remediation likely to be needed.
Frequently asked questions
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Cyber Essentials is a self-assessment questionnaire reviewed by a Certification Body. Cyber Essentials Plus covers the same five controls but adds an independent technical audit, where an assessor tests a sample of your devices and cloud services directly. Plus takes longer and costs more. Many organisations complete the basic level first and move to Plus when a contract requires it.
Do we need a consultant, or can we do this ourselves?
Plenty of organisations self-certify successfully, particularly smaller ones with a simple, well-managed IT estate. A consultant earns their fee where scope is complicated — mixed device ownership, several cloud platforms, remote workers on personal equipment — or where a first attempt has already failed. The questionnaire is not difficult to fill in. Being able to answer it truthfully is the harder part.
How much does Cyber Essentials cost?
There are two costs. The certification fee is banded by organisation size and set by IASME. Consultant fees for preparation vary with scope and with how much remediation is needed. In most cases the largest cost is neither of those — it is fixing whatever the scoping exercise surfaces, such as replacing unsupported software or bringing patching under control.
How long does certification take?
If your controls are already in reasonable shape, the basic level can complete in a couple of weeks. Where unsupported software, inconsistent patching, or an unclear device inventory need addressing first, expect longer. Cyber Essentials Plus requires the basic certification to be in place beforehand, so plan the two in sequence.
Who actually awards the certificate?
A Certification Body appointed by IASME. Cibernetica connects you with a consultant who prepares you for assessment; your contract for that work is with them directly. Some consultants are themselves appointed Certification Bodies and can handle both, while others work alongside one — worth clarifying at the outset so you know how many parties are involved.