The short answer
A Cyber Essentials assessor works for an IASME-licensed certification body and marks your self-assessment or, for Cyber Essentials Plus, audits your devices and accounts. You choose the certification body. Sovereign Secure is one: packages start at £320 + VAT, Gold submissions are marked within one working day, and CE+ audits run remotely or on site.
On this page
- Who are Cyber Essentials assessors?
- How do I choose a Cyber Essentials certification body?
- Who is the Cyber Essentials Plus assessor?
- How quickly can we be certified?
- Who will assess you at Sovereign Secure?
- What happens after you submit?
- Can the same company advise and assess you?
- Can we switch certification body?
- How do you become a Cyber Essentials assessor?
- Why Sovereign Secure
- Start your assessment
A Cyber Essentials assessor is the person at a certification body licensed by IASME who decides whether you meet the scheme’s requirements. For basic Cyber Essentials they mark your answers; for Cyber Essentials Plus they also test a sample of your devices and accounts. You can’t hire an assessor on their own: you choose a certification body, and its assessors do the work. Sovereign Secure is an IASME-licensed certification body. Our packages start at £320 + VAT, Gold submissions are marked within one working day, and we run Cyber Essentials Plus audits remotely or on site.
Who are Cyber Essentials assessors?
Every IASME Cyber Essentials assessor works for a certification body licensed by IASME, which delivers the scheme on behalf of the NCSC. Only a licensed certification body can assess your submission and issue a Cyber Essentials or Cyber Essentials Plus certificate. Consultants, IT providers and resellers can help you prepare or sell you a package, but the certificate always comes from a certification body.
That gives you two quick checks before you buy:
- Who will assess us and issue the certificate? If a website sells Cyber Essentials, ask which certification body will do the assessment. With us there is no reseller in between: we assess your submission and issue your Cyber Essentials certification ourselves.
- Is the body licensed for what we need? Not every certification body delivers Cyber Essentials Plus, so confirm that it covers the audited level if a contract asks for it.
How do I choose a Cyber Essentials certification body?
Every certification body applies the same NCSC requirements, so the standard you are marked against does not change from one to the next. What changes is speed, support, resubmission terms and how Cyber Essentials Plus is delivered. Compare them on these points:
| What to check | Why it matters | Sovereign Secure |
|---|---|---|
| IASME licence | Only licensed bodies can assess you and issue certificates | IASME-licensed for Cyber Essentials and Cyber Essentials Plus |
| Published prices | The basic fee follows IASME’s published bands, but extras vary | Packages from £320 to £750 + VAT, published in full |
| Marking time | Decides how fast you can meet a contract deadline | 1 working day (Gold), 2 (Silver), 3 to 5 (Bronze) |
| Resubmissions | Decide what happens if an answer fails | 1, 3 or unlimited by package; extras £100 + VAT |
| Help before you submit | Catches failing answers before they are marked | Pre-assessment check and a support call of up to an hour in every package |
| Cyber Essentials Plus delivery | Remote audits cut travel and disruption for multi-site and home-working teams | Remote audits as standard, on site when remote access is not practical |
| Cyber Essentials Plus retests | Failed tests must be fixed and retested within 30 days | Free remote retest of up to an hour within a month, otherwise from £400 + VAT |
| Wider security work | Tenders and customers often ask for more than Cyber Essentials | PCI DSS, ISO 27001 and penetration testing from the same company |
IASME publishes the basic assessment fee for each organisation size in its Cyber Essentials FAQs: £320 for 0 to 9 employees, £440 for 10 to 49, £500 for 50 to 249 and £600 for 250 or more, all + VAT. Our Bronze packages match those bands, and Silver and Gold add faster marking and more resubmissions. The full price table is on our Cyber Essentials cost page.
Who is the Cyber Essentials Plus assessor?
Your Cyber Essentials Plus assessor comes from a certification body licensed for the audited level, and the audit starts once you hold a basic Cyber Essentials certificate. Because the audit must be completed within three months of that certificate, using one certification body for both stages keeps the timetable in one set of hands. With us, the basic assessment is included in every Cyber Essentials Plus quote, and one team plans the audit date, the device sample and any retest.
Most of our audits are remote: your IT lead or managed service provider shares the screen of each sample device and runs a scanning tool we provide. We audit on site when remote access is not practical, anywhere in the UK, as our page on Cyber Essentials Plus in London explains for London offices. To price an audit, use our Cyber Essentials Plus quote request.
How quickly can we be certified?
Basic Cyber Essentials can be certified within days of submission; most of the time goes on preparing answers and closing gaps first. Once you submit, marking time depends on your package:
| Package | Marking time | Resubmissions included | Time to pass after first clarification |
|---|---|---|---|
| Bronze | 3 to 5 working days | 1 | 10 working days |
| Silver | 2 working days | 3 | 1 month |
| Gold | 1 working day | Unlimited | 3 months |
Each extra resubmission beyond your package limit costs £100 + VAT.
For Cyber Essentials Plus, allow a few weeks. The asset declaration is due at least two weeks before the audit and the basic assessment at least one week before, and most small organisations finish the audit itself in a day. If a customer deadline is close, give us the date when you order so we can plan around it.
Who will assess you at Sovereign Secure?
Assessors working under Sovereign Secure’s IASME licence mark your answers and carry out your Cyber Essentials Plus audit. The support call in each package is also with an assessor, so questions about scope, MFA on cloud services, unsupported software or home workers are answered by the people who assess against the requirements, not by a sales team.
Our assessors work inside a wider security company. Sovereign Secure is a PCI SSC Qualified Security Assessor (QSA) company, a member of the PCI SSC Global Executive Assessor Roundtable for 2026 to 2028, ISO 27001 certified and a penetration testing provider. When a customer asks for more than Cyber Essentials, you don’t need to start again with a new supplier.
What happens after you submit?
Your assessor marks each answer against the NCSC requirements, asks for clarification where an answer is unclear, then either issues your certificate or explains what failed so you can fix it and resubmit. Our guide to the Cyber Essentials assessment walks through each step from the assessor’s side.
Can the same company advise and assess you?
Within limits. IASME’s independence rules for certification bodies govern how advice and assessment can be combined for the same client, and we explain how they apply to you before any consultancy starts. Help with preparation never changes the standard: every applicant is marked against the same requirements, and no one is promised a pass. Our Cyber Essentials consultancy page explains how advice and assessment are kept separate.
Can we switch certification body?
Yes. When your certificate is due for renewal, any IASME-licensed certification body can assess you, and because a renewal is a new assessment either way, there is nothing to transfer. Our Cyber Essentials renewal page explains how to switch, including checking whether your current provider renews automatically.
How do you become a Cyber Essentials assessor?
You qualify through IASME and must work for an IASME-licensed certification body, based in the UK or the Crown Dependencies. Newcomers start as a Trainee Cyber Essentials Assessor. People with at least three years’ IT or security experience qualify as a Cyber Essentials Assessor, and qualified assessors can add the Cyber Essentials Plus Assessor qualification.
IASME’s Deliver this scheme page sets out the current requirements, and its Trainee Cyber Essentials Assessor page covers the entry-level route. In summary:
| Role | Who it suits | What IASME requires |
|---|---|---|
| Trainee Cyber Essentials Assessor | People with less than three years’ IT or cyber security experience, including none | A job or job offer at a certification body, a half-day Cyber Basics assessment and the one-day Cyber Essentials Assessor training, then assessing under the guidance of an experienced assessor who reviews your work |
| Cyber Essentials Assessor | People with at least three years’ IT or cyber security experience in the last five years | IASME’s free Assessor Skills Assessment exam (unless you hold a listed qualification such as CISSP, CISM or ISO 27001 Lead Auditor), then the one-day Cyber Essentials Assessor course and exam |
| Cyber Essentials Plus Assessor | Qualified Cyber Essentials assessors | A security testing qualification from IASME’s approved list or a pass in the Vulnerability Assessment Plus (VA+) exam developed by IASME and the NCSC, plus IASME’s Cyber Essentials Plus training course |
A company that is not yet licensed can apply to become a certification body once one of its staff has qualified. It must meet IASME’s security and quality requirements and hold the certifications it wants to deliver, which for Cyber Essentials means being certified itself. If you are buying certification rather than building a career, the sections above on choosing a certification body are the ones that matter.
Why Sovereign Secure
- We are the certification body. Sovereign Secure is IASME-licensed to issue Cyber Essentials and Cyber Essentials Plus certificates, so your questions go straight to the people who assess you.
- Prices you can see. Every basic package is published, from £320 + VAT, with resubmission and retest terms stated up front.
- Fast marking. Gold submissions are marked within one working day, Silver within two.
- Remote or on-site Cyber Essentials Plus. Remote audits keep disruption down, and we come on site when remote access is not practical.
- Established UK company. Sovereign Secure Ltd was incorporated in 2012 (Companies House 08334453) and is based at 16 Whalley Road, Accrington, Lancashire.
Start your assessment
Choose your package and order through the form on this page, or call +44 161 523 5276. For Cyber Essentials Plus, or if you are not sure what is in scope, send your details through the Cyber Essentials scoping questionnaire and we will come back with a fixed quote.
Last reviewed October 2026 by the Sovereign Secure assessment team.
