What is Cyber Essentials?

IASME certification fees are tiered by organisation size and start at around £300 plus VAT for a micro business with fewer than ten staff, rising through roughly £400, £500 and £600 plus VAT for larger bands. That fee covers the assessment itself. The larger variable cost is remediation: if devices are running unsupported operating systems, multi-factor authentication is not enabled, or patching is inconsistent, those issues must be corrected before certification is awarded. Organisations that use a partner to run the process typically also pay for readiness work, evidence gathering and submission support. Budgeting for both the fee and a remediation allowance gives a realistic picture of total cost.

The assessment questionnaire itself can usually be completed within a few days. The realistic end-to-end timescale is two to six weeks, because most organisations discover gaps during preparation that require configuration changes, software upgrades or device replacement. An organisation with a well-managed Microsoft 365 estate, enforced multi-factor authentication and consistent patching can move quickly. One with unsupported Windows versions, shared administrator accounts or unmanaged personal devices will need longer. Once submitted, the assessment is marked by a licensed assessor and the outcome is normally returned within a few working days.

No. Cyber Essentials is not a statutory obligation for businesses generally. It is contractually mandatory for suppliers on certain UK central government contracts involving sensitive or personal information, and for some Ministry of Defence supply chains. Outside those cases it is voluntary, but frequently requested: larger organisations often require it from suppliers, insurers may ask for it during underwriting, and public sector buyers commonly list it in tender requirements. Many SMEs pursue certification because a specific client contract depends on it rather than because a regulator demands it.

Cyber Essentials is a self-assessment: the organisation answers the questionnaire, a board-level representative signs a declaration of accuracy, and a licensed assessor reviews the responses. Cyber Essentials Plus covers the same five controls but adds independent technical verification — an assessor tests a sample of devices, checks patch levels, attempts to deliver test malware and confirms multi-factor authentication is enforced. The controls required are identical; the difference is the level of assurance. Cyber Essentials Plus must be applied for within three months of achieving the base certification.

Certification is valid for twelve months from the date of issue and must be renewed annually. Renewal is a fresh assessment against the current version of the requirements, not an administrative rollover. The requirements are periodically revised — changes in recent years have covered cloud services, home working, multi-factor authentication and unsupported software — so an organisation that passed comfortably one year may find new questions apply the next. Treating the controls as ongoing operational standards, rather than an annual exercise, makes each renewal straightforward.

Yes. There is no minimum organisation size, and sole traders and micro businesses certify regularly, often because a client contract requires it. The questionnaire is the same, but the scope is smaller and usually simpler: a handful of laptops, a Microsoft 365 or Google Workspace tenant, and a small number of cloud applications. Certification fees are lowest in the micro band. The most common obstacles for very small organisations are personal devices used for work, missing multi-factor authentication and unsupported operating systems on older hardware.