Cyber Essentials Certification

Cyber Essentials is a UK government-backed certification scheme overseen by the National Cyber Security Centre (NCSC) and delivered by IASME through licensed certification bodies. You answer an online self-assessment questionnaire about your IT, a qualified assessor at a certification body reviews it, and if you meet the requirements you are certified for 12 months and listed on the public certificate search.

Why use an IASME-licensed certification body? Only licensed certification bodies can assess and issue Cyber Essentials and Cyber Essentials Plus certificates. Sovereign Secure is one of them, so there is no reseller between you and the assessor: your questions go straight to the certification body that assesses your submission. Anyone can confirm a certificate we issue on the IASME certificate search; see certified clients and certificate verification. Before you pick a Cyber Essentials company, check that it is a licensed certification body rather than a reseller: our guide to choosing a Cyber Essentials certification body lists what to ask.

Cyber Essentials accreditation or certification? Buyers use both words for the same thing. Your organisation is certified; certification bodies are the ones licensed by IASME to assess you. If a tender asks for "Cyber Essentials accreditation", a current Cyber Essentials certificate is what it means.

The 2026 question set (Danzell). Assessment accounts opened from 27 April 2026 use IASME’s Danzell question set, based on version 3.3 of the NCSC Requirements for IT Infrastructure. Cloud services cannot be left out of scope, and missing multi-factor authentication (MFA) on a cloud service that offers it is now an automatic fail. Our Cyber Essentials requirements and checklist covers every rule, and our Cyber Essentials questionnaire page explains each section of the questions.

What does it cost? Our Bronze packages match IASME’s published fee bands: £320 (0-9 employees), £440 (10-49), £500 (50-249) and £600 (250+), all + VAT. Silver and Gold add faster assessment and more resubmissions, up to £750 + VAT. See the full Cyber Essentials cost table, or Cyber Essentials Plus cost for the audited level.

What you receive. A certificate valid for 12 months, an entry on the public certificate search that customers and procurement teams can check (see how to check a Cyber Essentials certificate), use of the Cyber Essentials logo under the scheme’s rules and, if you are eligible and opt in, IASME’s included Cyber Essentials insurance: cyber liability cover with a £25,000 limit at no extra cost.

Cyber Essentials and PCI DSS for merchants. If you take card payments, Cyber Essentials does not replace PCI DSS, but the controls overlap: firewalls, secure configuration, patching, access control and malware protection appear in both. We are a PCI SSC-approved QSA company as well as a certification body, so we can scope both and reuse the same evidence. See our PCI DSS compliance services.

Need help first? Our Cyber Essentials services run from a free check to hands-on support. Try the free Cyber Essentials readiness check, or ask about Cyber Essentials consultancy and support. Certified with another body? Cyber Essentials renewal with us is priced the same as a first certificate. Weighing up a bigger standard? Compare Cyber Essentials vs ISO 27001.

Guides for your sector. Cyber Essentials for schools, Cyber Essentials for law firms, Cyber Essentials for charities and Cyber Essentials for financial services cover the contract rules and scope questions each sector asks us about. For other sectors, see cyber security by industry.

How the Cyber Essentials scheme works: NCSC, IASME and certification bodies

The UK Cyber Essentials scheme has three layers. The National Cyber Security Centre (NCSC) developed the scheme and sets its technical requirements, which is why buyers often call it NCSC Cyber Essentials (or, after the body that delivers it, IASME Cyber Essentials). IASME, the NCSC’s Cyber Essentials Delivery Partner, runs the scheme and licenses certification bodies, and a certification body’s assessors assess your organisation and issue the certificate.

Two routes to the same certificate. The NCSC Cyber Essentials overview describes a self-led route, where you register and pay through IASME, and a supported route, where you hire a certification body licensed by IASME to help you understand the questions. Either way, a board member or equivalent signs off your answers, an assessor marks them, and the certificate appears on the same certificate search. Sovereign Secure is a certification body, so our packages follow the supported route, with a pre-assessment check and a support call included.

Where Cyber Essentials Plus fits. Plus is part of the same scheme and builds on basic Cyber Essentials (often called Cyber Essentials basic). The NCSC publishes the Cyber Essentials Plus test specification, and an assessor from a licensed certification body runs the tests on a sample of your devices within three months of your basic certificate; see Cyber Essentials Plus. For more on the organisation that licenses certification bodies and runs the portal, read our guide to IASME.

Sovereign Secure Ltd (company no. 08334453, est. 2012, Accrington, Lancashire, UK) is a PCI SSC-approved Qualified Security Assessor (QSA), Qualified PIN Assessor (QPA), Card Production Security Assessor (CPSA), P2PE Assessor (Europe and USA) and 3DS Assessor company, a member of the PCI SSC Global Executive Assessor Roundtable 2026 to 2028, an IASME-licensed certification body for Cyber Essentials, IASME Cyber Assurance and Defence Cyber Certification Levels 0 and 1, and an ISO 27001-certified firm, with offices in Los Angeles, Singapore, Dubai and Dhaka.