Cyber Essentials certification. We do the questionnaire.
We draft every answer in your Cyber Essentials self-assessment from a short intake form and one call. You check and sign; we submit to IASME and handle the assessor's questions. Fixed fee, no hourly rates, no technical homework.
A certificate is now a condition of the contract, not a nice-to-have.
Cyber Essentials is the minimum cyber security standard the UK government recommends for every organisation. For these three groups it is mandatory, and the people asking will check the IASME register.
Criminal legal aid contracts
Since 1 October 2025 the Legal Aid Agency requires every firm holding a Criminal Legal Aid contract to hold a valid Cyber Essentials certificate, at award and at renewal. A lapsed certificate puts the contract at risk.
Start a legal aid application →MOD and the defence supply chain
Suppliers handling MOD identifiable information must hold Cyber Essentials by the contract start date and renew it annually. The requirement flows down the supply chain; higher-risk contracts call for Cyber Essentials Plus.
Start an MOD supplier application →Government tenders and G-Cloud
Central government contracts that involve personal data or ICT have required Cyber Essentials since 2014, updated by PPN 014 in February 2025. G-Cloud 15 suppliers now need it too. Councils and NHS trusts increasingly ask for it in their own tenders.
Start a tender application →Also used by FCA-authorised firms as evidence for the IT and cyber sections of an authorisation application, and by anyone whose largest customer has just sent a supplier security questionnaire.
Three steps to your certificate
Tell us about your IT
A 20-minute intake form written for business owners, not engineers. Where a question needs your IT provider, tick "ask my IT provider" and we go to them directly. Then a 45-minute call to close the gaps.
We draft every answer
Within 3 business days you get the complete self-assessment, drafted and checked against the IASME requirements, plus a readiness report: anything that would fail, in plain English, with the exact fix for your IT provider.
You sign, we submit
Nothing is submitted without the written approval of a board-level signatory. We enter the answers on the IASME portal, handle every assessor query and the free resubmission if one is needed. Your certificate and badge arrive by email.
£995. Fixed. Paid in two parts.
The fee does not change with the size of your network or the number of assessor queries. The only other cost is IASME's own certification fee, which depends on your headcount.
- All 106 questions drafted, across the eight sections of the Danzell question set
- Device, software and cloud-service inventory compiled and formatted the way the assessor expects
- Readiness report: every would-be fail, with the fix, before anything is submitted
- Registration and submission on the IASME portal, with you as the certified organisation
- Every assessor query answered, and the one free resubmission handled if needed
- Certificate, Cyber Essentials badge and a one-page summary for tenders and client questionnaires
- Opt-in to IASME's included cyber liability insurance handled in the submission
- Renewal reminder at 11 months, and a lower renewal fee when your estate has not changed
| Your headcount | IASME certification fee |
|---|---|
| 0 to 9 | £320 + VAT |
| 10 to 49 | £440 + VAT |
| 50 to 249 | £500 + VAT |
| 250 and over | £600 + VAT |
IASME fees as published at iasme.co.uk. Headcount includes contractors, volunteers and agency staff with access to your data.
The assessor fails the same six things, every week.
None of them is about how the questionnaire is written. They are about the state of your devices and accounts, which is why we check them before anything is submitted.
A6.1Windows 10 left vendor support on 14 October 2025. Any Windows 10 device in scope must be enrolled in Microsoft's Extended Security Updates, or replaced, or the assessment fails.
A7.15–17Multi-factor authentication must be on for every user, not only administrators, on every cloud service that offers it: Microsoft 365, Google Workspace, Xero, Dropbox, your CRM. One account without it is an automatic fail.
A6.4–6.5High and critical security updates for operating systems, router firmware and applications must be installed within 14 days of release, in all circumstances. "Automatic updates are on" is the answer the assessor wants to hear, and see.
A7.6–7.7Day-to-day work, browsing and email must happen on standard accounts. Anyone with administrator rights needs a separate admin login used only for admin tasks.
A4.2The admin password on the office router or firewall must have been changed from the factory default, and be protected by MFA, 12 or more characters, or a block on common passwords.
A7.2A shared "reception" or "accounts" login, or a password written on a card by the printer, fails the unique-credentials question. Shared mailboxes are fine; shared passwords are not.
An independent service, run by compliance people.
CyberEssentialsCertificate is part of the Regetus group, which has prepared regulatory applications for UK and European firms since 2016. We do the same thing here: turn a questionnaire that was written for IT departments into something a business owner can sign with confidence.
- Are you the NCSC or IASME?
- No. Cyber Essentials is owned by the National Cyber Security Centre and delivered by IASME. We are an independent consultancy. Your certificate is issued by IASME and appears on the public register under your name.
- Do you need access to our systems?
- No. We work from your answers, screenshots where they help, and a conversation with whoever looks after your IT. We never log in to your devices or cloud accounts.
- Will you fix things for us?
- We tell you and your IT provider exactly what to change, and why. The changes themselves are made by whoever manages your IT. If you have no IT provider, we can introduce one.
- What about Cyber Essentials Plus?
- Plus adds a hands-on technical audit by an IASME-licensed Certification Body, within three months of your basic certificate. We prepare you for it and arrange the audit; the audit itself is carried out by the Certification Body.
Before you begin
How long does the whole thing take?
Your drafted answers arrive within 3 business days of the completed intake form and call. If the readiness report finds nothing to fix, we submit on your approval and IASME marks the assessment; it says resubmissions are reviewed within three working days. Allow two to three weeks end to end, longer if your IT provider has fixes to make first.
What happens if we fail?
IASME gives one further assessment free of charge if the resubmission is made within 48 hours of its notice. We handle that resubmission as part of the fee. If you are still not certified, and the fixes in your readiness report had been made before submission, we refund our £995.
Do home workers and personal phones count?
Yes. Every laptop, desktop, phone and tablet that accesses your organisation's data is in scope, including staff-owned devices and home workers. Cloud services cannot be excluded either. We build the inventory so nothing is missed and nothing unnecessary is dragged in.
Is insurance really included?
Organisations domiciled in the UK or Crown Dependencies with turnover under £20 million, certified for the whole organisation, can opt in to cyber liability insurance arranged by IASME with a £25,000 limit of indemnity and 24/7 incident response. There is no extra cost; you opt in within the assessment and we handle it.
Our IT is looked after by an outside company. Who do you talk to?
Them, with your permission. Most of the technical answers come from your IT provider in one call. You stay the client and the signatory; they stay the people who manage the devices.
We were certified last year. Is renewal cheaper?
Yes. Certificates last 12 months. For a renewal where your devices, software and cloud services have not materially changed, we update last year's answers against the current question set for a reduced fee. The IASME fee applies again each year.
Which question set will we be assessed against?
Anyone purchasing from 27 April 2026 is assessed against the Danzell question set and version 3.3 of the Requirements for IT Infrastructure. We draft to that set. The assessment must be submitted within six months of IASME issuing the questionnaire.
Begin an application
Twenty minutes on the intake form. A call with us. Drafted answers in your inbox within three business days. £495 to begin, refundable until then.