Cyber Essentials for MSPs

Why this lands on your desk

An MSP rarely goes looking for Cyber Essentials work. It arrives, usually as a client forwarding an email from their insurer, their largest customer or a tender portal, with some version of "we need this by the end of the month, can you sort it?"

From there the options are all mildly unsatisfying. You can tell them to find a certification body themselves, which sends your client shopping and occasionally introduces them to somebody who also sells managed IT. You can take it on and discover that the assessment questions are about your estate as much as theirs. Or you can subcontract it to whoever answers the phone and hope the turnaround holds.

The alternative is a certification body you have terms with, that issues the certificate itself, and that has no interest in the rest of the client's IT.

The two ways partners work with us

Referral

You introduce the client and we contract with them directly. You are paid a commission on each completed assessment. No invoicing, no support burden, no involvement in the assessment itself unless you want it. Suits an MSP who wants the client looked after without adding a line of business.

Reseller

You buy at partner rates and sell at your own price. You contract with the client, you set the margin, and the client need never deal with us. Suits an MSP who already sells compliance and wants Cyber Essentials to sit inside their own stack and their own invoice.

The full model, including how it works for penetration testing, is on the partnerships page. This page is about the Cyber Essentials side of it.

Preferential rates under IASME pricing

Partners pay less than the published direct price, against IASME's own fee bands. We do not put the numbers on this page, for two reasons worth stating rather than hiding.

The first is that they are not one number. Terms move with volume and with which route you take, and an MSP placing steady work through the year should not be on the same terms as one placing a single certificate. The second is that publishing a partner rate on a public page means every direct buyer finds it too, which is unfair to the partners who negotiated it.

So the arrangement is simple: tell us roughly how many clients you expect to certify in a year and what mix they are, and you get the actual figures back in writing. No call required unless you want one.

What you are actually buying into

• An appointed IASME Certification Body. The certificate is issued by us directly. Nobody else is in the chain, so the turnaround is ours to commit to.
• Assessment within one business day of submission as standard, and the same day with the urgent option where the submission lands before midday.
• A human assessor. Submissions are reviewed by a qualified, certified assessor, never fed to a model. If a partner is putting their own brand on the outcome, that distinction matters.
• No channel conflict. We do not sell managed IT, helpdesk, licensing or monitoring, so there is nothing of yours for us to cross-sell into.
• Room to grow past Cyber Essentials. IASME Cyber Assurance Levels 1 and 2 now, Cyber Essentials Plus from late October 2026, CREST-accredited penetration testing available white-labelled, and Defence Cyber Certification Level 0 for clients with MoD contracts.

The gap analysis is where partners make their margin

Cyber Essentials is pass or fail against five technical controls. A client whose estate you already manage to a standard will usually pass first time. A client you inherited last quarter, with unmanaged laptops, local admin rights everywhere and multi-factor authentication switched on for about half the cloud services, will not.

A gap analysis before submission tells you which one you are dealing with. For an MSP that is not just a pass-rate exercise, it is a scoped piece of remediation work you are the obvious person to deliver, and it is usually worth more than the certificate. Partners who lead with it certify more clients and argue about failures less.

Who this suits, and who it does not

It suits an MSP or IT provider with a handful of clients a year being asked for Cyber Essentials, who would rather place the work with a specialist than either turn it away or become a certification body. It suits anyone whose clients are drifting into insurance renewals and tender requirements and who wants a straight answer on timing.

It does not suit an MSP certifying at real volume, who should probably look at becoming an IASME Certification Body directly. If that is you, say so on the form and we will tell you what is involved rather than sell around it.

Common questions