How to Use the IASME Portal: A Guide for Cyber Essentials Applicants

The IASME portal is the online assessment platform where you answer the Cyber Essentials questions and submit them for marking. It is run by IASME, the NCSC’s Cyber Essentials delivery partner, at portal.iasme.co.uk. You get an account once you buy an assessment, either directly from IASME or through a licensed certification body, and you then have six months to complete it.

This page is written by Sovereign Secure, an IASME-licensed Cyber Essentials certification body, as onboarding for our own customers and anyone else using the portal. It is not an IASME page. Always type the portal address yourself or use a bookmark, and never enter your sign-in details on any other site, including this one.

Where is the IASME portal?

The portal is at portal.iasme.co.uk, and IASME links to it as “Assessment Portal” from its Cyber Essentials pages, which is why applicants often call it the IASME Cyber Essentials portal. There is no public area to browse: you need an assessment account, which is created when you buy an assessment.

If you only want to see the questions before you buy, you don’t need the portal. IASME publishes the question set as a free PDF and Excel file, and our Cyber Essentials questionnaire page explains how to use it to draft your answers offline. For background on IASME itself, see what IASME is.

How do you get access to the IASME portal?

You buy a Cyber Essentials assessment, and login details are emailed to the contact you register. Who sets up the account depends on where you buy.

With Sovereign Secure, every Cyber Essentials package includes portal access, a pre-assessment check of your answers before formal submission, a support call of up to an hour and six months’ guide access (normally £85 + VAT). Prices start at £320 + VAT for 0 to 9 employees; see our Cyber Essentials cost page for every package.

You sign in with your registered email address and password, then enter a two-factor (2FA) code that the portal sends to your email or phone. If the code doesn’t arrive, use the portal’s option to send a new one and check junk and quarantine folders. A forgotten password is reset from the sign-in page, and the reset link expires after 15 minutes.

How do you set up your portal account?

Spend ten minutes on set-up before answering any technical questions:

1. Confirm your organisation details. Your certificate and its public listing are built from what you enter, so use your registered legal name. Under the Danzell question set, which applies to assessment accounts created from 27 April 2026, you list every legal entity in scope with its name, address and company number.
2. Check the question set version. Your account uses the question set in force when it was created. Prepare with the matching download, or your drafted answers won’t line up with the portal’s numbering. Our guide to the Danzell changes explains what is new.
3. Invite helpers. You can invite a colleague or your IT provider as a helper. They accept the invitation and register with their own email address and password, so nobody needs to share a login.
4. Agree who edits. Decide who enters answers and when, so two people don’t overwrite each other’s changes.
5. Diarise the deadline. Six months from purchase, and you will need the board-level signatory near the end.

How do you answer and save your answers?

Draft offline first, then paste in. IASME recommends preparing your answers in a working document or spreadsheet before you use the assessment platform. The free question set comes as a PDF and an Excel file, so you can draft in the spreadsheet and paste each answer across. Save as you go and return as often as you need until you submit.

Three habits get answers accepted first time:

• Be specific. Name operating systems and versions, firewall and router models, and the cloud services you use. One-word answers usually come back with a request for more information.
• Answer for the whole scope. If a home worker, second office or cloud service appears in one answer, it must be covered by your scope and every related answer.
• Describe what is in place, not what is planned. The certificate reflects your position on the date it is issued, so a control you intend to add next month doesn’t count.

Never paste passwords, licence keys or personal data into an answer. Our guide on how to pass Cyber Essentials first time lists the usual reasons submissions fail.

Do you need to upload evidence?

Not for basic Cyber Essentials. It is a verified self-assessment, marked on your written answers and a declaration signed by a senior person, and IASME confirms it includes no scan or technical test. If an answer doesn’t say enough, the assessor returns that question asking for more detail, so the fix is a clearer answer rather than a document.

Cyber Essentials Plus is different. The evidence comes from the assessor’s own technical audit: internal and external vulnerability scans, then tests on a random sample of user devices plus your internet gateways and internet-facing servers. You arrange it with your certification body rather than uploading anything to the portal.

How do you submit your assessment?

Once every question is answered, a board member or someone of equivalent seniority confirms that the answers are accurate, and you submit. The assessment then locks while the assessor marks it.

IASME says an assessor reviews your answers within three working days, and reviews each resubmission within three working days. With Sovereign Secure, marking takes three to five working days on Bronze, two on Silver and one on Gold.

Can you edit answers after submitting?

Only when the assessor sends the assessment back. If an answer needs clarification or doesn’t meet a requirement, you get feedback against that answer, fix the underlying issue, update it and resubmit. How long you have depends on how you bought:

The IASME terms come from IASME’s Cyber Essentials FAQ. With us, each resubmission beyond your package limit costs £100 + VAT.

After you pass, your answers stand for that certificate. At renewal you enter everything again against the current question set, so IASME advises keeping a copy of what you submitted.

Where do you find your Cyber Essentials certificate?

In the portal. Once your assessment meets every requirement, the certificate is issued straight away, and you can download it along with your digital badge. The certificate is valid for 12 months, and your organisation appears on IASME’s public certificate search, which our Cyber Essentials certificate check guide explains. For how to display the badge, see our guide to the Cyber Essentials logo.

What are the most common IASME portal problems?

Why Sovereign Secure

• IASME-licensed certification body. We assess and certify Cyber Essentials and Cyber Essentials Plus, and set up your portal access when you order.
• Help before you submit. Every package includes a pre-assessment check and a support call of up to an hour, so problems are caught before the assessor sees them.
• Published prices. From £320 + VAT (Bronze, 0 to 9 employees) to £750 + VAT (Gold, 250+ employees). Sovereign Secure Ltd was incorporated in 2012, is ISO 27001 certified and is a PCI SSC Qualified Security Assessor company.

Next step

Ready to start? Use the form below, choose “First time Cyber Essentials (CE)” and tell us your organisation’s size, and we will set up your portal access. You can also call +44 161 523 5276.