Buy Cyber Essentials

Buy Cyber Essentials

Pick your size and pay. We set up your IASME portal account the same working day, usually within the hour, and email you the login so you can complete the assessment in your own time. Once you submit we aim to assess within one business day. Your answers are marked by a qualified, certified assessor, never fed into AI. You can preview the self-assessment questions first if you want to see where you stand. There is no call or consultation as standard. Need it faster? Add urgent turnaround below. Want your setup reviewed against the controls before you apply? That is a gap analysis, quoted separately: ask using the contact button under the form.

An appointed Certification Body: your certificate comes directly from us. Verify our credentials on the BlockMark registry, and find us listed on the IASME website.

Business name

Business size Select size… Micro (1 to 9 staff) Small (10 to 49 staff) Medium (50 to 249 staff) Large (250+ staff)

Email

Telephone

Optional add-on

Tick it if you need it.

Urgent turnaroundMoved to the front of the queue and assessed same day where your submission arrives before midday. +£100

Total: select your size + VAT

Buy now

Want a gap analysis, a different way to pay, or a question answered first?

Gap analysis. We review your setup against the controls you will be assessed on before you apply and tell you exactly what needs fixing, so nothing is a surprise when you submit. It is quoted against your setup rather than sold as a fixed add-on, so ask us and we will price it.

Anything else. Paying by card here is the quickest route, not the only one. Tell us how you would rather pay and we will sort it. Same if you want a question answered before you buy, or a quote for on-site Cyber Essentials or IASME Cyber Assurance Level 1.

Contact us →

Pick your size above and pay, and you are buying from an appointed Cyber Essentials Certification Body rather than from a reseller. The fee you see is the fee IASME publishes. The assessor who marks your answers works here. The certificate is issued by us.

What the price is, and why it is that number

IASME publishes the Cyber Essentials certification fee and sets it by organisation size. Those published fees are £320, £440, £500 and £600 plus VAT for micro, small, medium and large organisations respectively. Those are the numbers in the form above. We have not added a margin on top of the published fee, which is why the total you see is the total you pay.

That matters more than it sounds, because the certification market has a lot of resellers in it. A reseller buys certification from a Certification Body, adds a margin, and sells it on. You pay more, and when something goes wrong the person you phone is not the person who can fix it. Certifying direct removes a link from that chain.

Which size band are you?

The band is set by headcount, not by turnover or by how many devices you run, and IASME counts people on your payroll. Contractors, consultants, volunteers and, for schools, pupils are not counted.

• Micro, 0 to 9 people. £320 + VAT
• Small, 10 to 49 people. £440 + VAT
• Medium, 50 to 249 people. £500 + VAT
• Large, 250 or more people. £600 + VAT

If you are on a band boundary, use your actual payroll figure. Declaring a smaller band than you are is the sort of thing that surfaces during assessment and costs you time. There is a longer breakdown on what Cyber Essentials costs, including the costs that are not the fee.

What happens after you pay

1. Same day, usually within the hour. We set up your assessment account on the IASME portal and email you the login. Nothing else is required from you to get started.
2. You complete the self-assessment. It is a structured questionnaire covering the five controls. Most organisations spend somewhere between two hours and a couple of days on it, and the variable is not the form, it is whether your estate already meets the controls.
3. You submit, and a qualified assessor marks it. A person reads your answers. Nothing is fed into an AI tool, and nothing is auto-marked.
4. We aim to assess within one business day of submission, or the same day if you add urgent turnaround and submit before midday.
5. Pass, and your certificate is issued by us, with your entry appearing on the public register. Your certificate is valid for 12 months.
6. If something does not meet the mark, you get told exactly what and why, and you have a window to fix it and resubmit at no extra cost. That is a conversation, not a rejection letter.

There is no call or consultation as standard. If you want one, that is what the gap analysis under the form is for.

What you are actually being assessed against

Five technical controls: firewalls, secure configuration, security update management, user access control, and malware protection. They are not difficult in principle. What catches organisations out is scope and evidence rather than the controls themselves.

Since the April 2026 update to the scheme and the Danzell question set, three things in particular are worth knowing before you buy, because they are now automatic failures rather than observations:

• Multi-factor authentication on cloud services. If MFA is available on a cloud service you use and it is not switched on, that is a fail. Not a note on the report, a fail.
• High-risk and critical updates within 14 days. Operating systems, applications, router and firewall firmware. Patching that quietly slips is now one of the clearest routes to a fail.
• Cloud is in scope, with no exceptions. The old habit of drawing a scope boundary that conveniently excludes the SaaS everyone actually works in no longer survives assessment.

Assessment is also point in time, and the point is the date the certificate is issued. Anything running an unsupported operating system on that date is a problem on that date, regardless of what the migration plan says.

Before you buy, three honest checks

We would rather you spent the fee once. Run these first.

1. Is MFA on everywhere it can be?

Microsoft 365, Google Workspace, your accounting package, your CRM, anything cloud-hosted with a login. If the answer is "mostly", that is a fail waiting to happen.

2. Is anything running past its end of support date?

Windows 10 reached end of support in October 2025. Old Android phones that no longer receive security updates count too, if work email is on them. A single unsupported device in scope will stop the certificate.

3. Can you draw the scope boundary honestly?

Whole organisation is the cleanest and the most useful to a buyer reading your certificate. A partial scope is allowed, but under the current question set you have to describe what sits outside it, and you have to list the legal entities covered. A scope drawn to dodge a problem usually creates a harder conversation later.

If any of those three gave you pause, ask us for a gap analysis before you buy the certification. We look at your setup against the controls, tell you what needs fixing, and you go into the assessment knowing the answer.

Buying this for a deadline

Most people who land on this page are not buying Cyber Essentials because they woke up wanting it. There is a contract, a tender, a framework, or an insurer at renewal. Three things are worth knowing about the clock.

The part we control is fast. We aim to assess within one business day of your submission, same day with urgent turnaround if it arrives before midday. The part we do not control is how long your organisation takes to complete the questionnaire and to fix anything that does not meet the controls, and that is where real timelines are won or lost. An organisation already running MFA and patching properly can be certified in a day or two. One that needs to roll out MFA across sixty people first cannot, and no Certification Body can change that.

If the deadline is genuinely tight, the pages on same-day certification, certifying for a contract and certifying for insurance set out what is realistically achievable in each case.

What comes with the certificate

Beyond the certificate and the register entry, UK-based organisations with turnover under £20 million that certify their whole organisation can opt in to IASME's included cyber liability insurance, which carries a £25,000 limit of indemnity. Higher limits are available to buy. It is opt-in rather than automatic, so if you want it, say so during the assessment. Organisations over the turnover threshold, or certifying only part of the organisation, are not eligible.

The certificate runs for 12 months. Recertification is a fresh assessment against whatever the question set says at that point, not a rubber stamp, which is worth budgeting for rather than being surprised by.

If you need Cyber Essentials Plus, read this first

Plus is a hands-on technical audit rather than a questionnaire, and it is a separate purchase. Two things about sequencing matter, and getting them wrong is expensive.

Cyber Essentials is a prerequisite, and your certificate has to be under three months old when the Plus audit starts. Buying Cyber Essentials now and getting to Plus in six months means paying for Cyber Essentials again. If you know Plus is coming, tell us now and we will sequence it properly.

Your self-assessment also has to be finalised and unchanged before Plus testing begins, so the two cannot overlap. The Cyber Essentials Plus page covers what the audit actually involves.

The five controls, and what you will actually be asked

The question set is long, but it only ever circles five things. Knowing which question belongs to which control makes the self-assessment far less daunting, and it tells you in advance where your own answers are going to be weak.

1. Firewalls

Every device that connects to an untrusted network needs a firewall between it and that network, and that firewall needs to block inbound connections by default. You will be asked whether default administrative passwords on boundary firewalls have been changed, whether the administration interface is reachable from the internet, and whether any inbound rules you have opened are documented with a business reason and reviewed.

The commonest stumble is not a missing firewall. It is an inbound rule somebody opened in 2021 for a supplier who no longer works with you, which nobody can now justify.

2. Secure configuration

Devices and software should not be running as they came out of the box. Expect questions on removing or disabling unused accounts and software, changing default passwords, disabling auto-run, and locking devices with a PIN, password or biometric.

Password policy sits here too, and it is more flexible than people assume: a minimum of eight characters where multi-factor authentication is in place, twelve where it is not, or eight with an automatic deny list of common passwords. You pick the approach that fits, but you have to pick one and apply it.

3. Security update management

All software in scope has to be supported by its vendor, licensed, and receiving updates. High-risk and critical updates have to be applied within fourteen days of release. Automatic updates should be enabled wherever they are available.

This is the control that fails organisations most often, and almost never because of the operating system. It is the browser plug-in, the design package, the accounting software nobody thinks of as software, and the one laptop that lives in a drawer and comes out quarterly.

4. User access control

Accounts have to be unique to a person, created through some sort of approval, and removed when somebody leaves. Administrative privileges need to be separate from day-to-day accounts, granted deliberately and reviewed. And multi-factor authentication has to be enabled on cloud services wherever the service supports it.

That last one is not negotiable since the scheme was updated, and a single administrator without it is enough to fail the assessment. Pull the enforcement report from your tenancy rather than asking whether anyone has been excluded. The report is the truth, the question gets you somebody’s recollection.

5. Malware protection

You need one of three approaches on each device: anti-malware software kept current, application allow-listing so only approved software runs, or running untrusted code in a sandbox. For most organisations the built-in protection on a modern operating system is sufficient, provided it is genuinely enabled and updating.

What is in scope, and what people get wrong

Scope causes more delay than any control. The default position is that your whole organisation is in scope, and the things people miss are consistent:

Thing	In scope?	The detail that catches people
Laptops, desktops, tablets	Yes	Including the ones that rarely connect. A machine used quarterly is still in scope and is usually months behind on updates.
Staff personal phones and laptops	Yes, if used for work	A device used only for voice calls, text messages or as a multi-factor token is out. Open a work email on it and it is in.
Servers	Yes	Including virtual ones, and including anything hosting an internet-facing service.
Cloud services	Yes	All of them, infrastructure, platform and software. This surprises people who assumed the provider’s own certification covered them.
Home workers’ broadband routers	No	Unless you supplied it. What is in scope is the software firewall on the device itself, which is why that has to be on.
Guest wifi	No, if genuinely separated	Separated on the network, not just described as separated.
Sub-contractors	It depends	In scope if they use your accounts or devices. Out if they use their own and access nothing of yours.

You can certify a clearly defined part of the organisation instead of the whole, but it does not reduce the fee, which follows headcount, and it makes you ineligible for the included insurance. It is the right call for a genuinely separate business unit and the wrong one as a saving.

A fifteen minute check before you pay

None of this requires a consultant. Run through it and you will know whether you are buying a certificate or buying a project.

1. Open your cloud admin console and pull the MFA enforcement report. Read the exclusion list rather than the headline number.
2. List every operating system version in use. Anything out of vendor support has to go, be upgraded, or be genuinely separated and placed out of scope before you submit.
3. Check when your browsers and plug-ins last updated. Not the operating system, the browsers.
4. Pull your user list and look for leavers. Then look for accounts belonging to no identifiable person.
5. Count the accounts with administrative rights, and ask whether each of those people needs them for their daily work or only occasionally.
6. Write down every device used for work, including personal phones and the machine in the drawer.

If all six come back clean, the questionnaire is an afternoon. If two or three do not, that is useful to know before you pay rather than after.

Buying direct, through a reseller, or from IASME

Three routes get mentioned, and one of them does not exist.

Route	What happens
Direct from a Certification Body, which is this page	The body that assesses you is the body that takes your money and issues your certificate. One relationship, published fee, and the assessor is reachable.
Through a reseller or IT provider	They take payment, prepare you, and pass the assessment to a Certification Body. Legitimate and often fine, but there is a margin and a handoff, and when a question needs answering you are relaying it.
Direct from IASME	Not possible. IASME owns and runs the scheme as the NCSC’s delivery partner, but certification is delivered through its appointed Certification Bodies. Anyone offering to sell it to you “direct from IASME” is a reseller.

You can verify which you are dealing with in under a minute, because IASME publishes the list of appointed Certification Bodies. If the company taking your card is not on it, ask who the assessment actually goes to. There is more on this in can you buy Cyber Essentials online.

Thinking about Cyber Essentials Plus as well?

If there is any prospect of Plus, buying the two together is cheaper than buying them separately, because the Cyber Essentials element is priced at roughly half the standalone fee inside the combined package. More to the point, it avoids the three month trap: your Cyber Essentials certificate has to be under three months old when the Plus certificate is issued, so certifying today and deciding on Plus in six months means paying this fee twice.

The combined packages are on the Cyber Essentials Plus page, priced by the same four size bands, and we have set out when buying both together is the right call and when it is not.

When not to buy from this page

A buy button is not always the right answer, and we would rather say so here than take the money.

• You are not sure you need it at all. Start with do I need Cyber Essentials, which is a decision guide rather than a sales page.
• Your contract actually says Cyber Essentials Plus. Read the clause again. The two words at the end change the price and the process.
• You know the estate will not pass. Buy the gap analysis first. Certification after remediation costs the same; certification before it costs you the fee twice over in time.
• You want a conversation before you commit. That is reasonable, and the contact button under the form gets you one, usually within a business day.
• You want to pay by invoice or bank transfer. Card is the fastest route here, not the only one. Ask and we will sort it.

Why buy from Solusec

We are an appointed Cyber Essentials and IASME Cyber Assurance Certification Body, and an appointed Defence Cyber Certification body at Level 0. Solusec itself holds Cyber Essentials Plus and IASME Cyber Assurance, so we are certified to the things we assess others against rather than only selling them.

In practice what that means for a buyer is short: no reseller in the middle, the published fee rather than a marked-up one, an assessment read by a qualified person, and one accountable team from your first question to your certificate. You can check all of that rather than taking our word for it: we are on the IASME list of Certification Bodies, and our own certificates are on the BlockMark registry.

Common questions