IASME Cyber Essentials: A Practical Guide to Certification in 2026
If a customer has asked for your Cyber Essentials certificate, or you are preparing for a tender, you may be wondering where IASME fits into the process. What does certification involve, how much does it cost, and what should you prepare before applying?
This guide explains IASME Cyber Essentials certification, the current requirements and the difference between Cyber Essentials and Cyber Essentials Plus, helping you choose the right next step for your organisation.
What is IASME Cyber Essentials?
Cyber Essentials is a UK Government-backed certification scheme developed by the National Cyber Security Centre (NCSC). It focuses on five technical controls designed to reduce exposure to common internet-based attacks.
IASME is the NCSC’s official Cyber Essentials Delivery Partner and manages the network of licensed Certification Bodies. These organisations assess applications and award certification when the requirements are met.
The phrase “IASME Cyber Essentials” refers to Cyber Essentials delivered through this scheme. IASME Cyber Assurance is a separate certification with a broader scope.
For businesses, Cyber Essentials provides a recognised way to demonstrate that essential technical security controls have been implemented. It can support supplier assurance and help meet certification requirements in some contracts. Always check the specific tender conditions to confirm the level and scope required.
What are the five Cyber Essentials controls?
Your assessment examines five areas of technical security:
Firewalls
Control connections between your systems and the internet, restricting unnecessary access.
Secure configuration
Set up devices and software securely, removing unnecessary features and insecure defaults.
Security update management
Use supported technology and apply required security fixes within the scheme’s deadlines.
User access control
Give people the access they need, manage administrator privileges and protect accounts.
Malware protection
Implement appropriate measures to prevent malicious software from running.
These controls need to work together. Antivirus software alone cannot compensate for unsupported applications or poorly protected accounts.
Cyber Essentials requirements: what changed in 2026?
Assessment accounts created from 27 April 2026 use the Danzell question set and Requirements for IT Infrastructure version 3.3. Businesses renewing certification should review the current questions rather than copy last year’s answers.
Important points include:
● Cloud-service MFA: Multi-factor authentication must be implemented for cloud services where available, including where it requires a paid option. Failure to meet this requirement results in an automatic assessment failure.
● Security fixes: High-risk and critical security updates and vulnerability fixes must be installed within 14 days of release. The relevant questions cover operating systems, router and firewall firmware, and applications, including associated files and extensions.
● Clearer scope: Organisations must identify the legal entities being certified and explain exclusions. Cloud services storing or processing organisational data must be included.
● Ongoing responsibility: The signed declaration acknowledges responsibility for maintaining the controls throughout the certification period.
A useful preparation exercise is to list every cloud service your organisation uses, then check how MFA is enforced for its users. Remember services outside your main email platform, such as accounting, file sharing and customer management tools.
How much does Cyber Essentials certification cost?
The standard Cyber Essentials verified self-assessment fee depends on your organisation’s employee count:
|Organisation size|Employees|Certification fee, excluding VAT|
|-----------------|---------|--------------------------------|
|Micro |0–9 |£320 |
|Small |10–49 |£440 |
|Medium |50–249 |£500 |
|Large |250+ |£600 |
These are the standard assessment fees, rather than the total cost of any consultancy, remediation or optional support your business may need. Cyber Essentials Plus requires a separate technical audit and is priced according to the assessment scope and complexity.
View our Cyber Essentials certification options to choose your organisation size and review available services.
How does the Cyber Essentials assessment work?
1. Establish your scope
Identify the organisation or legal entities being certified, the relevant locations, and the devices, software and cloud services involved. Raise questions about remote workers, personally owned devices and outsourced IT before completing the questionnaire.
2. Review your controls
Download the current IASME Cyber Essentials question set and compare the requirements with your actual environment. Ask your IT team or managed service provider to confirm technical details.
3. Address gaps
Build a short action list with an owner for each item. For example, confirm MFA coverage, remove unused administrator access, and identify unsupported software that needs replacement. Resolve gaps before declaring that the requirements are met.
4. Complete and submit your questionnaire
Cyber Essentials uses a verified self-assessment. A board member or equivalent signs a declaration confirming the answers, and a qualified assessor reviews the submission. Clarification or changes may be needed before certification can be awarded.
5. Maintain the controls and plan renewal
Cyber Essentials certificates are valid for 12 months. Keep security controls operating as staff, devices and services change, and begin renewal preparations before your current certificate expires.
Cyber Essentials or Cyber Essentials Plus?
Both certifications assess the same five technical controls. Cyber Essentials Plus adds independent technical testing to verify that the protections work in practice.
|Feature |Cyber Essentials |Cyber Essentials Plus |
|------------------------|--------------------------------|--------------------------------|
|Verified self-assessment|Required |Required before the Plus audit |
|Technical testing |No technical audit at this level|Independent technical audit |
|Assurance |Assessor-reviewed answers |Controls also tested in practice|
|Pricing |Standard employee-based tiers |Quoted for the assessment scope |
The Plus audit includes vulnerability scanning and checks on a representative device sample, alongside other required tests such as cloud-service MFA verification. Your assessor will explain the evidence and access needed.
You must complete Cyber Essentials before the Plus audit, with Plus completed within three months of the underlying Cyber Essentials certification. If your customer requires Plus, plan both stages together.
Explore our Cyber Essentials Plus service or combined Cyber Essentials and Plus package.
Frequently asked questions
Is Cyber Essentials a legal requirement?
Cyber Essentials is generally voluntary, although some contracts require it. Check your customer’s procurement requirements, including whether they specify Cyber Essentials Plus.
How long does Cyber Essentials certification take?
Preparation depends on your environment and any changes required. Cyber Compliance’s standard service lists a five-working-day assessment turnaround, with priority options available. Allow time for clarification and remediation; a submission does not guarantee certification by a particular date.
Can a small business achieve Cyber Essentials?
Yes. The scheme is designed for organisations of all sizes, including sole traders and small businesses. The requirements still apply to the technology within the agreed scope.
Does Cyber Essentials include penetration testing?
The verified self-assessment does not include penetration testing. Cyber Essentials Plus includes technical checks against the scheme requirements. If you need a detailed assessment of application vulnerabilities, business logic or attack paths, discuss a separate penetration test.
Get Cyber Essentials support from Cyber Compliance
Whether you are applying for the first time, renewing your certificate or planning Cyber Essentials Plus, preparing clear and accurate information makes the process easier to manage.
Cyber Compliance offers Cyber Essentials certification with optional pre-assessment review and fast-track services. We can help you understand the questions and plan the appropriate assessment route for your organisation.
Start your Cyber Essentials application or contact Cyber Compliance to discuss your scope, support needs and deadlines.
Editorial sources
● NCSC: Cyber Essentials overview
● IASME: Cyber Essentials and standard pricing
● IASME: April 2026 scheme changes
● IASME: Current assessment questions
● IASME: Frequently asked questions
● IASME Knowledge Hub: How to certify to Cyber Essentials Plus