Cyber Essentials Certification for UK Businesses

It's a UK government-backed certification showing your business has the core technical controls in place against the most common attacks. Five areas: firewalls, secure configuration, access control and multi-factor authentication, malware protection, and keeping software updated. It's widely recognised, increasingly required to win work, and a practical baseline that stops most everyday threats. We help you achieve it and, just as importantly, stay compliant with it all year.

Cyber Essentials is a verified self-assessment: you complete a questionnaire confirming the controls are in place, and it's the faster route. Cyber Essentials Plus covers the same five controls but adds an independent hands-on technical audit, where an assessor checks your systems directly. More assurance, longer to arrange. CE Plus is often what larger contracts and defence or NHS-adjacent supply chains ask for. Not sure which you need? That's what the readiness call is for.

It depends on your size and the state of your systems today, so we scope it per business rather than quote a headline figure. There's a certification assessment fee set by IASME, tiered by organisation size, and then whatever remediation is needed to get the controls passing. After a short readiness call you'll know what's required before committing to anything, so the bill doesn't arrive as a discovery.

Increasingly, yes. Under the government's procurement rules (PPN 014) it's required on many public-sector contracts, and that cascades down supply chains to subcontractors. Ministry of Defence suppliers face Defence Cyber Certification expectations that include it, NHS-data suppliers face related assurance requirements, and plenty of private-sector buyers now ask too. If you bid for work, expect to be asked for the certificate, and to be ruled out early without one.

The scheme's v3.3 requirements took effect on 27 April 2026. Multi-factor authentication is now mandatory across all cloud services, cloud can no longer be left out of scope, and scoping rules are tighter overall. In practice certification depends more than ever on how systems are set up and kept set up, and a lot of businesses that passed before will need work on MFA to pass the next renewal.

No, and we'd rather say so plainly. We're not the certification body. We prepare, harden and evidence your environment so you meet the standard, then your assessment and certificate are issued by an IASME-accredited body through our partner platform, CyberSmart. You get properly accredited certification, managed end to end by a UK team. We're the people who get you there and keep you there. The accredited body issues the certificate.

It depends on the state of your systems and which level you need, so we won't put a number on it before we've looked. As a guide, Cyber Essentials is a self-assessment and the quicker route, while Cyber Essentials Plus involves an independent technical audit and takes longer to arrange. Tell us your deadline on the readiness call and we'll tell you honestly whether it's reachable.

This is where we differ from a one-off certifier. A certificate is a snapshot of one day, and your real security drifts the moment a device is built wrong or a patch is missed. We hold the five controls in the passing state continuously, through the CyberSmart platform and the team running your IT, so renewal is a formality, your insurer and customers keep getting the answer they expect, and the certificate still holds up in month eleven.

Across UK sectors, with most of the pull coming from professional services (legal, accountancy, consultancy, architecture and engineering), finance, healthcare-adjacent organisations, and the defence and engineering supply chain where MOD requirements are a live driver. Those are the places contracts, regulators and insurers ask for it hardest. Not sure whether it applies to you? The readiness call will tell you.