The short answer
Cyber Essentials consultancy is help to scope your IT, find the gaps against the five technical controls and close them before assessment. Our Cyber Essentials certification consultants work for an IASME-licensed certification body, and Cyber Essentials help comes with every package from £320 + VAT: a pre-assessment check, a support call of up to an hour and six months of guide access.
On this page
- What does Cyber Essentials consultancy include?
- What Cyber Essentials certification support is included in each package?
- How does included support compare with paid add-ons?
- What does a Cyber Essentials gap assessment include?
- How are advice and assessment kept separate?
- Who is Cyber Essentials support for?
- How long does Cyber Essentials preparation take?
- Cyber Essentials Plus support: getting audit-ready
- Why Sovereign Secure
- Get help with Cyber Essentials
Cyber Essentials consultancy is hands-on help to scope your IT, find the gaps against the five technical controls and fix them before you submit, giving you the best chance of passing first time. Every Sovereign Secure package from £320 + VAT includes a pre-assessment check, a support call of up to an hour and six months of guide access. Gap analysis, remediation guidance and readiness help are added at a fixed price.
As an IASME-licensed certification body for Cyber Essentials certification, we know what assessors look for, and we explain up front how advice and assessment are kept apart.
What does Cyber Essentials consultancy include?
The first three services below come with every package; the rest are added as needed.
| Service | What you get | Best for | Price |
|---|---|---|---|
| Pre-assessment check | We review your draft answers and flag anything likely to fail | Everyone | Included |
| Support call | Up to an hour on scope, cloud MFA, BYOD and unsupported software | Everyone | Included |
| Guide access | Six months of our guidance, normally £85 + VAT | First-time applicants | Included |
| Gap analysis and readiness review | A control-by-control review with a written, prioritised gap list | No in-house IT, bid deadlines, failed attempts | Fixed quote |
| Remediation guidance | What to change, in what order, and the evidence the assessor expects | Anyone with gaps to close | Fixed quote |
| Cyber Essentials Plus readiness | The CE+ tests walked through on your own sample devices | First-time CE+ | Fixed quote |
What Cyber Essentials certification support is included in each package?
Every package includes the pre-assessment check, support call, guide access, portal access and the certification fee. Prices by package and company size:
| Package | Micro (0 to 9 staff) | Small (10 to 49) | Medium (50 to 249) | Large (250+) |
|---|---|---|---|---|
| Bronze | £320 | £440 | £500 | £600 |
| Silver | £410 | £520 | £575 | £650 |
| Gold | £510 | £620 | £675 | £750 |
Packages differ in assessment speed, the number of resubmissions and how long you have to pass:
| Package | Assessed within | Resubmissions | Time to pass |
|---|---|---|---|
| Bronze | 3 to 5 working days | 1 | 10 working days |
| Silver | 2 working days | 3 | 1 month |
| Gold | 1 working day | Unlimited | 3 months |
Prices exclude VAT. Bronze matches IASME’s published fee for each size band, so the support costs nothing extra. Extra resubmissions cost £100 + VAT each. See the full Cyber Essentials cost breakdown.
How does included support compare with paid add-ons?
Several UK providers sell the assessment at the IASME fee and charge extra for help. Published prices from UK providers we reviewed in September 2026:
| Support item | Sovereign Secure | Add-on prices elsewhere (ex VAT) |
|---|---|---|
| Review of your answers before submission | Included | +£150 |
| Extra help with your answers | Support call of up to an hour included | +£300, or “supported” packages from £640 |
| Assessment within one working day (Micro) | Gold at £510, unlimited resubmissions | £520 to £620 |
| CE+ pre-assessment or mock audit | Readiness review, fixed quote | +£300 to +£1,000 |
What does a Cyber Essentials gap assessment include?
A Cyber Essentials gap analysis compares your IT today with the NCSC requirements and gives you a written, prioritised list of what to fix before you submit. We start with scope, because every other answer depends on it.
| Area | What we review | Common gap |
|---|---|---|
| Scope | Offices, home workers, BYOD, servers, cloud services | Devices left out that still access email or data |
| Firewalls | Boundary firewalls, software firewalls on home-working devices, admin interfaces | Default passwords; admin interfaces open to the internet |
| Secure configuration | Unused accounts and software, auto-run, device locking | Old accounts still active; no screen lock on phones |
| Security update management | Vendor support, automatic updates, the 14-day window for high and critical fixes | Unsupported operating systems or applications |
| User access control | MFA on cloud services, separate admin accounts, passwords | One cloud service without MFA; admin accounts used for email |
| Malware protection | Anti-malware or allow-listing on every capable device | Protection missing or switched off |
The gap list follows the question set and shows the evidence an assessor expects for each answer. To test yourself first, try the free Cyber Essentials readiness check or the Cyber Essentials requirements checklist. The requirements are published by the NCSC. To write down the rules your team will follow, adapt our free cyber security policy template, whose sections map to the five controls.
How are advice and assessment kept separate?
IASME’s assessment independence rules apply to every certification body, including us. Before any consultancy starts, we explain how advice and assessment are kept separate for you.
| Aspect | Advice (consultancy) | Assessment (certification) |
|---|---|---|
| Purpose | Help you understand and meet the requirements | Decide whether you meet them |
| Who changes your systems | You or your IT provider, using our guidance | No one. The assessor reviews what you submit or, for CE+, tests a sample |
| What you receive | Gap list, remediation guidance, pre-assessment feedback | A pass or fail decision and, on a pass, your certificate |
| Standard applied | The current NCSC requirements | The same requirements, with no allowance for help received |
Advice does not guarantee a pass. If you prefer advice from a separate firm, IASME runs the NCSC-backed Cyber Advisor scheme, which lists assured advisers, and you can still certify with us.
How does that differ from consultancy here? Cyber Advisors are assured under the NCSC scheme to give hands-on help to micro, small and medium-sized organisations, but IASME notes that an adviser cannot certify you unless they are also a Cyber Essentials assessor. Consultancy from a certification body comes from a team that assesses against the same requirements, kept separate from your assessment under IASME’s independence rules. IASME explains the difference between an assessor and an advisor.
Who is Cyber Essentials support for?
- No in-house IT. We turn each question into plain steps for whoever looks after your laptops and Microsoft 365 or Google Workspace.
- IT run by an MSP. Your provider can join the call and receive the gap list, hearing each requirement first-hand.
- Bid deadlines. Finding gaps early avoids losing time to a failed attempt.
- First-time Cyber Essentials Plus. The audit tests real devices, so readiness work cuts the risk of retests.
- Failed or lapsed elsewhere. We start from your previous feedback.
How long does Cyber Essentials preparation take?
Preparation depends on your gaps; assessment time depends on your package. Turning on MFA or automatic updates can take days, while replacing unsupported hardware can take weeks.
| Step | What happens | Timing |
|---|---|---|
| 1. Scoping call | Agree scope, deadline and who does what | When you enquire |
| 2. Gap analysis | Review against the requirements; written gap list | Depends on size and sites |
| 3. Remediation | Your team or IT provider closes the gaps | Days to weeks |
| 4. Pre-assessment check | We review your draft answers | Before you submit |
| 5. Assessment | Formal marking by an assessor | 1, 2 or 3 to 5 working days |
| 6. Certificate | Issued on a pass; renew every 12 months | On a pass |
Our guide to passing Cyber Essentials first time covers the submission itself.
Cyber Essentials Plus support: getting audit-ready
Cyber Essentials Plus must be completed within three months of your Cyber Essentials certificate, and the audit tests a sample of your devices, external IP addresses and cloud accounts. A readiness review runs through those tests first: patching on each sample device, malware protection, browser warnings on downloads and MFA on every cloud service. It is the help most organisations want when they look for a Cyber Essentials Plus consultant, and here it comes from an IASME-licensed certification body that delivers the audit itself.
If a test fails, you fix the issue and are retested within the scheme’s time limits. A remote retest of up to an hour within a month is free; other retests start at £400 + VAT. See the Cyber Essentials Plus requirements for sample sizes, or our Cyber Essentials Plus service for how the audit runs.
Why Sovereign Secure
- IASME-licensed certification body. We issue Cyber Essentials and Cyber Essentials Plus certificates, so our advice reflects how assessments are marked.
- Support in the price. Pre-assessment check, support call and guide access with every package.
- Wider assurance. ISO 27001 certified, a PCI SSC Qualified Security Assessor company, a member of the PCI SSC Global Executive Assessor Roundtable (2026 to 2028), and penetration testing when you need more.
- UK company since 2012, based at 16 Whalley Road, Accrington, Lancashire.
Get help with Cyber Essentials
Send your setup through the Cyber Essentials scoping questionnaire for a fixed quote, or pick a package and use its included support. Prefer to talk? Call +44 161 523 5276.
Last reviewed October 2026 by the Sovereign Secure assessment team.
