Cyber Essentials and Cyber Essentials Plus Certification in London

Cyber Essentials in London works exactly as it does anywhere else in the UK. You answer the self-assessment questionnaire online and an IASME-licensed certification body reviews it remotely, so you don’t need a provider with a London office. Sovereign Secure is an IASME-licensed certification body based in Accrington, Lancashire. We certify London organisations from £320 + VAT and assess Gold submissions within 24 hours. Most of our Cyber Essentials Plus audits are remote, and on-site audits in London are available on request.

Do you need a London-based Cyber Essentials provider?

No. Every Cyber Essentials certification body is licensed by IASME, and any of them can certify an organisation anywhere in the UK. The NCSC Cyber Essentials overview sets out one national scheme with two levels. Whoever issues it, the certificate lasts 12 months and appears in the same public search.

So compare what does differ between providers: assessment speed, help before you submit, retest terms and whether the Plus audit fits around your team.

How does remote Cyber Essentials certification work for London firms?

It runs entirely online, and most of the time goes on preparing your answers, which usually takes a few days to a few weeks:

1. Scope and quote. Complete our Cyber Essentials scoping questionnaire and we aim to send a fixed quote within one working day.
2. Portal and pre-assessment check. You answer the questions in the assessment portal, and we review them before formal submission and flag anything likely to fail.
3. Support call. Up to an hour on a video call with an assessor, covering the usual sticking points: scope, multi-factor authentication, unsupported software and personal devices.
4. Assessment. Gold submissions are assessed within 24 hours, Silver within 48 hours and Bronze within 3 to 5 working days.
5. Certificate. Valid for 12 months and listed in the public certificate search.

Hybrid working doesn’t change the process. Home workers’ laptops, and personal phones that reach company email or data, are in scope. Our Cyber Essentials certification page explains the five technical controls you are assessed against.

Cyber Essentials Plus certification in London: remote or on-site audit?

Cyber Essentials Plus in London is the same audit as anywhere else in the UK, and we run it remotely by default. An assessor tests a sample of your devices over a screen share, while a scanning tool we provide checks them for missing security updates. On-site audits in London are available on request, for when remote testing isn’t practical.

If you choose an on-site audit at a London office, arrange these before the day:

• building and visitor access for the assessor, booked in advance with your reception or building management;
• a desk with power and a network connection that can reach the sample devices;
• the people who use the sampled laptops and phones, on site and able to sign in, including to your cloud services for the MFA test;
• a plan, agreed on the preparation call, for any sample devices that sit at another site or with home workers.

The timeline rules are the same either way. You must pass basic Cyber Essentials first and complete the Plus audit within three months of that certificate. Return the asset declaration form at least two weeks before the audit, and submit your basic assessment at least one week before it. Most small organisations finish the audit itself in a day.

The number of devices tested depends on how many of each operating system version you run, not on where they are:

If something fails, you fix it and are retested within one month. Remote retests of up to one hour are free; other retests start at £400 + VAT. Our CE+ remote testing checklist lists what to have ready on the day, and our Cyber Essentials Plus audit page explains each test.

What does Cyber Essentials cost for a London organisation?

The same as anywhere in the UK, with no London premium. Our Cyber Essentials packages cost £320 to £750 + VAT, depending on employee numbers and how quickly you want to be assessed.

All prices exclude VAT, and Bronze matches the fee bands IASME publishes. Every package includes the pre-assessment check, the support call, portal access and six months’ access to our guide (normally £85 + VAT). An extra resubmission beyond your package limit costs £100 + VAT. Full details are on our Cyber Essentials cost page.

Cyber Essentials Plus is quoted on your devices, sites and cloud services, and our quote always includes the basic assessment. See Cyber Essentials Plus cost for published UK price ranges.

Why do London organisations need Cyber Essentials?

Usually because a customer or contract asks for it. The GOV.UK Cyber Essentials scheme overview explains that central government requires Cyber Essentials from suppliers bidding for contracts that involve handling certain sensitive and personal information or providing certain technical products and services.

Other London buyers may ask for it too: the Greater London Authority and Transport for London, the 32 London boroughs and the City of London Corporation, NHS trusts, universities, and the banks and professional firms of the City and Canary Wharf. Each sets its own supplier requirements. Check the tender or contract for three things: the level required, the date it must be in place, and whether it must cover your whole organisation or only the part delivering the work.

For free help first, small businesses and charities can try the London Cyber Resilience Centre, a police-backed not-for-profit that offers free guidance and resources to London SMEs and third-sector organisations. We are not affiliated with it.

Why choose Sovereign Secure for Cyber Essentials in London?

Sovereign Secure Ltd is an IASME-licensed Cyber Essentials certification body, established in 2012 and based at 16 Whalley Road, Accrington, Lancashire. We don’t have a London office: we certify London organisations remotely and travel for on-site audits when you need one.

• We issue the certificate. There is no reseller between you and the assessor.
• Fast, clear terms. Gold submissions assessed within 24 hours, published packages from £320 + VAT and free remote CE+ retests of up to one hour within a month.
• More than Cyber Essentials. We are a PCI SSC Qualified Security Assessor (QSA) company, a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) for 2026 to 2028 and ISO 27001 certified, and our penetration testing team can go further than CE+ when a customer asks.

Get a fixed Cyber Essentials quote for your London organisation

Complete the scoping questionnaire and we aim to send a fixed quote within one working day, including travel costs if you want an on-site Cyber Essentials Plus audit. Rough numbers are fine. Not sure you would pass yet? Our free Cyber Essentials readiness check takes about five minutes and flags the answers that fail automatically. Prefer to talk it through? Call +44 161 523 5276 or email [email protected].