Can you buy Cyber Essentials online, and what happens after you pay?

Yes, you can buy Cyber Essentials online and pay by card, and we sell it that way ourselves. But a certificate is not a product that arrives in the post because you paid for it, and the organisations that get caught out are the ones who assumed it was. Here is what the money actually buys, what you still have to do, and the one check worth making before you hand your card over to anybody.

What you are actually paying for

Cyber Essentials is a verified self-assessment. You answer a structured questionnaire about five technical controls, a qualified assessor reviews the answers, and if they hold up a certificate is issued. The fee covers the assessment and the certificate. It does not cover making the answers true.

That is the whole of the confusion. People buy expecting a certificate and receive a questionnaire. The questionnaire is the work, and for most organisations it takes longer than they expected not because it is difficult but because nobody has ever had to write down how their patching actually happens.

The sequence, honestly

1. You pay. Card, a couple of minutes.
2. You get access to the questionnaire through IASME’s platform, and a conversation with whoever is going to help you through it.
3. You answer it. This is where the time goes. Expect to need the person who manages your devices in the room, or at least on email.
4. Somebody reviews the answers before submission, if you have bought from a certification body that does this. Not everybody does, and it matters enormously.
5. You submit. We assess within one business day as standard.
6. Pass, and the certificate is issued. Fail, and you have two working days to correct and resubmit at no extra cost.

That two working day window is the single most important number in the process, and it is set by IASME rather than by us. Miss it and you start a new application and pay the fee again. Which is why step four is worth more than a fast turnaround.

Buying from a certification body, or from somebody in front of one

A good deal of Cyber Essentials is sold online by organisations that are not themselves a certification body. They take your money, prepare you, and pass the assessment to a body that holds the appointment. That is legitimate and it can work well. It also means an extra handoff, an extra margin, and a longer line when something needs a decision.

You can check which you are dealing with in under a minute. IASME publishes the list of certification bodies. If the company taking your card is not on it, they are reselling. Ask them who the assessment actually goes to and how long that adds.

Solusec is on that list. When you buy Cyber Essentials from us, the assessment and the certificate both come from us, and the person who reviews your submission is a qualified assessor rather than an account manager.

What the price should and should not vary by

The IASME assessment fee is published and banded by total employee count, so that element is identical wherever you buy. Anything above it is the support wrapped around it. We go through this properly in why two quotes differ when the fee is published, but the short version is that a cheaper price almost always means less review before submission, and review before submission is what stops you burning the resubmission window.

Be wary of anything advertising a guaranteed pass. We have written about why that claim is not what it sounds like, and about what gets cut to reach a very low price.

Before you buy, three things worth knowing

Your whole organisation is normally in scope. Certifying a slice of it does not reduce the fee, because the band follows headcount rather than scope, and it can cost you the included cyber liability insurance, which requires whole-organisation certification.

Home and personal devices count. If staff use their own laptops or phones for work, they are in scope. This surprises people more than anything else in the questionnaire.

If Cyber Essentials Plus is coming, say so now. Plus requires a current Cyber Essentials certificate that is under three months old when the Plus certificate is issued. Certify today and decide on Plus in six months, and you pay for Cyber Essentials twice. Buying them together is cheaper, and we have set out when that makes sense.

So should you buy it online?

If you know you need Cyber Essentials and you want to get on with it, yes, and paying by card is the quickest route. If you are not sure whether a contract is asking for Cyber Essentials or Cyber Essentials Plus, send us the wording first. Those two differ considerably in cost and lead time and they are confused in contract clauses constantly. Reading it takes a few minutes and costs nothing.

Common questions