Cyber Essentials, certified directly by an IASME certification body
Cyber Essentials is the UK government’s baseline cyber security certification. It checks that five technical controls are in place across your devices and cloud services, and it is the certificate most customers, insurers and public sector frameworks ask a supplier for first. Incursion Cyber Security is an IASME-licensed certification body: we assess and issue Cyber Essentials, Cyber Essentials Plus and IASME Cyber Assurance ourselves, and our assessors are penetration testers with UK Cyber Security Council professional titles.
What Cyber Essentials is
The scheme is owned by the National Cyber Security Centre (NCSC) and delivered through IASME and its licensed certification bodies. It has two levels. Cyber Essentials, the level this page covers, is a verified self-assessment: you answer a question set about how your organisation applies five technical controls, a senior person signs the declaration, and an assessor at a certification body reviews and marks the answers. Cyber Essentials Plus covers the same controls, but an assessor tests them on your systems.
Certificates are valid for twelve months. The current requirements are version 3.3, known as the Danzell question set, which took effect on 27 April 2026.
The five controls
The requirements apply to every device and cloud service in scope, including staff phones and laptops used for work.
Firewalls. A correctly configured boundary or host firewall in front of every device, with default passwords changed and no unjustified inbound rules.
Secure configuration. Unused accounts, software and services removed; default passwords changed; devices locked with a PIN, password or biometric; password rules and brute-force protection in place.
Security update management. All software licensed and in support, with high and critical updates applied within 14 days of release.
User access control. Named accounts, a joiners-and-leavers process, separate administrator accounts, and multi-factor authentication on every cloud service that offers it.
Malware protection. Anti-malware that is current and active on every device, or an application allow-list.
Our guide to the five Cyber Essentials controls explains what each one requires, what the assessor checks and where applicants most often fall short.
How the assessment works
Scoping. We confirm your organisation size and send a short set of standard questions about your devices, users, cloud services and networks. An assessor reviews the answers before we confirm the scope and price. A call with an assessor is available if anything is unclear.
The question set. You receive access to the online assessment portal. If your controls are already in place the questions take an hour or two; most of the time goes into confirming the answers are true across the whole estate. You have six months to submit.
Marking. A named assessor reviews your submission and aims to return a result within three working days.
Result. A pass is certified by us and recorded on the IASME and NCSC registers. If you fall short, you get the assessor’s feedback and two working days to correct the issues and resubmit at no extra charge.
What it costs
Basic Cyber Essentials prices are set nationally by IASME and are the same at every certification body. They are banded by the number of employees.
| Organisation size | Cyber Essentials | Cyber Essentials Plus |
|---|---|---|
| Micro (0–9 employees) | £320 | £1,000 |
| Small (10–49 employees) | £440 | £1,600 |
| Medium (50–249 employees) | £500 | £3,000 |
| Large (250–10,000 employees) | £600 | Price on scoping |
| Enterprise (10,000+ employees) | £600 | Price on scoping |
All prices are plus VAT. The Cyber Essentials Plus price is in addition to the basic certificate; see the Cyber Essentials Plus page for what the audit involves.
Included cyber insurance
UK-domiciled organisations with an annual turnover under £20 million that certify their whole organisation can opt in to cyber liability insurance included with the certificate at no extra cost, with a £25,000 limit of indemnity. You choose whether to take it when you complete the assessment; the certification price is the same either way.
Who needs it
Cyber Essentials is required for higher-risk central government contracts under Cabinet Office Procurement Policy Note 014, and it is the baseline that NHS, local authority, education and defence supply chains, larger private sector customers and cyber insurers increasingly ask for. Where a contract specifies Plus, the basic certificate is the first step, because Plus can only be assessed against it. The government’s Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses identified an attack in the previous year and 5% held Cyber Essentials; being in the second group is a straightforward way to stand out in a supplier questionnaire.
What most commonly fails
From our own assessments: software that is out of support, most often Windows 10 since October 2025; multi-factor authentication missing from a cloud service that offers it, which is now an automatic fail; high or critical updates older than 14 days; a business owner working day to day from an administrator account; and personally owned phones used for work email that were left off the scope. All five are fixable before you submit, and the scoping questions are designed to surface them.
Cyber Essentials, Plus and Cyber Assurance
Cyber Essentials is the baseline. Cyber Essentials Plus is the same five controls, audited; it is what most contracts that specify certification actually want. IASME Cyber Assurance builds on Cyber Essentials to cover governance, risk, people, physical security, backup, resilience and UK GDPR, and is accepted by a growing number of sectors as an alternative to ISO 27001 for smaller organisations. We certify all three, and can advise which level the request you have received actually needs.
Frequently asked questions
How long does Cyber Essentials take?
If the controls are in place, a few hours to complete the question set and up to three working days for marking. If they are not, the time goes into fixing them first, which is the point of the exercise.
What is in scope?
Every device that accesses organisational data or services, including personally owned phones and laptops used for work, every internet gateway, and every cloud service you use. You can certify a subset of the organisation, but the certificate says so and a customer reading it will notice.
Is multi-factor authentication required?
Yes, on every cloud service that offers it, for all users. Under the current requirements a cloud service without MFA is an automatic fail.
What happens if we fail?
You receive the assessor’s feedback and have two working days to fix the issues and resubmit without further charge. A failed attempt is not recorded publicly.
Do we need Cyber Essentials before Cyber Essentials Plus?
Yes. Plus is assessed against a current basic certificate, and the Plus audit must take place within 90 days of it. We plan both together so the window is not missed.
Are you the certification body?
Yes. Incursion Cyber Security is licensed by IASME to assess and certify Cyber Essentials, Cyber Essentials Plus and IASME Cyber Assurance. You can check our listing in the IASME certification body directory and see everything we hold on our accreditations page.
Ready to get certified?
Book a call. Our sales team will set it up and handle the proposal, and a qualified assessor will review everything before your booking is confirmed.