How to Choose a Cyber Essentials Certification Body in the UK

Choosing a Cyber Essentials certification provider involves more than comparing prices. Here is what UK businesses should look for when deciding who to use for Cyber Essentials or Cyber Essentials Plus.

There are hundreds of organisations offering Cyber Essentials certification in the UK. Some focus on certification, others provide wider cyber security services, and some offer additional support to help businesses prepare for an assessment.

With so many options available, it can be difficult to know which provider to choose.

Price is an obvious starting point, but it is worth looking at what is included, how the assessment works and what happens if your organisation does not meet the requirements first time.

It is also important to check that the information you are relying on reflects the current Cyber Essentials scheme. The requirements change periodically, and guidance that was accurate a year ago may no longer tell the whole story.

This guide explains what to look for when choosing a Cyber Essentials Certification Body and the questions worth asking before you commit.

What is a Cyber Essentials Certification Body?

A Cyber Essentials Certification Body is an organisation licensed by IASME to assess businesses against the Cyber Essentials requirements and issue certificates where the requirements have been met.

IASME delivers the Cyber Essentials scheme on behalf of the National Cyber Security Centre (NCSC).

Certification Bodies work to the same scheme requirements, but the service they provide can differ. Some offer a straightforward assessment service, while others provide guided support, technical consultancy or additional testing.

You can verify providers through the official IASME Certification Body directory.

When comparing providers, confirm that they are appropriately licensed and that the service being offered covers the certification you need.

Cyber Essentials and Cyber Essentials Plus: Which do you need?

Before comparing providers, establish whether you need Cyber Essentials or Cyber Essentials Plus.

Cyber Essentials

Cyber Essentials is based on a self-assessment questionnaire covering five technical control areas:

• Firewalls

• Secure configuration

• Security update management

• User access control

• Malware protection

  
  

Your organisation completes the questionnaire, which is assessed by a qualified assessor working for a licensed Certification Body.

It is designed to help organisations demonstrate that they have implemented the basic technical controls needed to protect against common cyber attacks.

Cyber Essentials is often required by customers, suppliers or organisations bidding for particular contracts. It can also provide a useful baseline for businesses looking to improve their cyber security.

Read our blog on this here: Is Cyber Essentials Mandatory in the UK

Cyber Essentials Plus

Cyber Essentials Plus requires a valid Cyber Essentials certificate, issued within the last 3 months, and involves an independent technical audit.

The assessor carries out technical testing to check that the relevant controls are working in practice, verifying the answers provided in your Cyber Essentials questionnaire. The scope and testing depend on the organisation's IT environment and the requirements of the scheme.

This provides additional assurance beyond the self-assessment alone. A useful analogy is the difference between checking your own car and having its MOT carried out by a qualified professional.

Cyber Essentials Plus is commonly required where a contract specifies the higher level of certification or where an organisation wants independent verification of its technical controls.

The two certifications are based on the same underlying requirements, but the assessment process is different. You should confirm the required certification level before requesting a quote.

Check that the provider understands the current requirements

Cyber Essentials is reviewed and updated periodically to reflect changes in technology and the way organisations use IT.

In April 2026, the scheme moved to version 3.3 of the Requirements for IT Infrastructure and introduced a new self-assessment question set known as Danzell.

The Danzell question set applies to new assessment accounts created from 27 April 2026. Existing assessments may remain subject to transitional arrangements, depending on when the assessment account was created.

This distinction matters when reading online guidance or preparing for certification. Older articles may describe requirements or assessment arrangements that applied to previous versions of the scheme.

For example, the 2026 update introduced a stricter marking requirement for multi-factor authentication (MFA). MFA is now mandatory for cloud services where it is available, and failure to implement it can result in an unsuccessful assessment.

Businesses preparing for certification should therefore use current guidance rather than relying solely on older checklists or articles.

The latest documents are available through the official IASME Cyber Essentials question set and requirements page.

A provider should be able to explain which requirements apply to your assessment and help you understand what you need to do before submitting your questionnaire.

How much does Cyber Essentials certification cost?

The cost depends on the size of your organisation, the certification level and the amount of support required.

Cyber Essentials is generally less expensive, starting at £320+VAT, than Cyber Essentials Plus, £1,100+VAT, because it does not include the additional technical audit.

When comparing quotes, check whether the price includes:

• The assessment and certification fees.

• Support with completing the questionnaire.

• Guidance on addressing gaps in your security controls.

• Any additional assessment or resubmission charges.

• The technical audit required for Cyber Essentials Plus.

• Any additional consultancy or remediation work.

  
  

A low headline price does not necessarily represent the lowest overall cost. If the service provides little support, you may need to arrange additional consultancy or spend more time preparing internally.

Equally, a more expensive package is not automatically better. The important point is to understand what you are paying for and whether it meets your requirements.

Ask the provider for a clear breakdown of its fees before proceeding.

What happens if you do not pass first time?

This is one of the most useful questions to ask before choosing a Certification Body.

If your organisation does not meet the requirements, you need to understand why, what action is required and whether you will incur additional costs to complete the process.

Ask the provider:

• Will you explain the reasons for an unsuccessful assessment?

• Will you receive guidance on the corrective action required?

• Are resubmissions included in the quoted price?

• Are there time limits for addressing the issues?

• Will additional consultancy be charged separately?

  
  

The answers will help you understand how much support you can expect throughout the process.

It is also worth asking whether the provider offers a scoping or preparation call before the assessment begins. This can help establish the scope of your IT environment and identify potential issues before you submit your questionnaire.

A preparation call is not a substitute for meeting the requirements, but it can help you understand what will be involved.

How long does Cyber Essentials certification take?

There is no single turnaround time that applies to every organisation.

The time required depends on how quickly you complete the questionnaire, whether your systems meet the requirements and whether any corrective work is necessary.

The Certification Body's own workload and assessment arrangements will also affect the process.

In our experience, organisations can complete the process in as little as half a day, with the average customer taking four working days.

If you have a contractual deadline, tell the provider before starting. Ask about its current turnaround times, the availability of assessors and any deadlines that apply to your assessment.

You should also allow time to resolve any issues identified during the process. Leaving certification until the last minute can create unnecessary pressure, particularly where a contract depends on maintaining a valid certificate.

It's also worth noting that organisations are typically given up to six months to complete the Cyber Essentials self-assessment questionnaire.

Does the provider offer Cyber Essentials Plus testing itself?

If you require Cyber Essentials Plus, confirm who will conduct the technical audit and what the process involves.

The provider should explain how the testing will be arranged, what parts of your IT environment will be assessed and what you need to make available.

Depending on the scope, this may involve user devices, servers, network infrastructure and cloud services.

You should also establish whether the provider needs access to your premises, whether any testing can be completed remotely and how the assessment will affect your staff.

Do not assume that every provider offering Cyber Essentials also offers Cyber Essentials Plus directly. Confirm that both services are available and that the proposed assessment arrangements suit your organisation.

Should you choose a specialist certification provider or a wider cyber security consultancy?

Both approaches can work. The right choice depends on what you need.

A specialist certification provider may offer a straightforward route through the assessment process, particularly if your IT environment is relatively simple and already meets the requirements.

A wider cyber security consultancy may be useful if you need help understanding your security gaps, implementing technical controls or addressing issues that extend beyond the certification itself.

For example, an organisation preparing for Cyber Essentials Plus may identify weaknesses in device configuration, account security or patch management that need to be resolved before it can meet the requirements.

In these circumstances, it is useful to understand whether the provider can offer the necessary support or whether you will need to work with your existing IT support company.

Whichever approach you choose, establish what is included in the certification service and what would be charged separately.

Questions to ask before choosing a provider

Before committing to a Certification Body, we would recommend asking the following questions.

Question	Why it matters
Are you an IASME-licensed Certification Body?	Confirms that the provider is authorised to assess and certify organisations under the scheme.
Do you offer Cyber Essentials and Cyber Essentials Plus?	Establishes whether the provider can deliver the certification you require.
What is included in the quoted price?	Makes it easier to compare providers on a like-for-like basis.
What happens if we do not pass first time?	Clarifies the support available and whether additional fees apply.
What is your current turnaround time?	Helps you plan around contractual or renewal deadlines.
What do you need from our IT team?	Allows you to estimate the internal time and resources required.

You do not necessarily need a provider that offers every possible service. You need one that can deliver the required certification, explain the process clearly and provide the level of support your organisation needs.

Cyber Essentials certification with Delta Cyber Security

Delta Cyber Security has issued over 600 Cyber Essentials certificates and completed over 300 Cyber Essentials Plus assessments. Our certification team has a minimum of seven years' experience helping achieve Cyber Essentials certification per assessor.

We understand that the certification process can be unfamiliar, particularly for organisations without dedicated IT or cyber security teams. Our approach is to make the process as straightforward as possible, while ensuring customers understand the requirements and what they need to do to meet them.

Support before and during the assessment

We offer free scoping calls before the certification process begins. These allow us to understand your organisation's requirements, discuss the assessment process and identify any areas that may need attention before you start.

Once the process begins, we arrange a 30-minute setup session to help customers get started. Our assessors are also available to explain technical requirements and provide guidance on addressing issues identified during the assessment.

Turnaround times

We aim to keep the certification process moving without unnecessary delays.

Our assessors complete scoring within two working days, and we aim to respond to customer enquiries within one hour. Both service targets help customers understand what to expect and plan around their certification deadlines.

The overall time required to achieve certification will depend on how quickly your organisation completes the questionnaire and whether any corrective work is needed.

Cyber Essentials Plus technical assessments

Cyber Essentials Plus involves an independent technical audit to verify that the required security controls are working in practice.

Our assessors have a minimum of seven years' experience delivering Cyber Essentials certification. Before the audit, we offer preparation support to help customers understand the process, identify potential issues and prepare their systems for assessment.

This helps establish what is required before the audit takes place and gives customers a clearer understanding of the steps involved.

If you are considering Cyber Essentials or Cyber Essentials Plus, you can find out more about our services and request further information on our Cyber Essentials page.

Final thoughts

Choosing a Cyber Essentials Certification Body should involve more than finding the lowest price.

Check that the provider is licensed, understands the current requirements and can explain exactly what is included in its service. If you need Cyber Essentials Plus, make sure you understand the technical testing involved and how it will be arranged.

It is also worth checking the date of any guidance you use when preparing for certification. The move to Danzell in April 2026 is a good example of why current information matters.

Taking the time to compare providers properly can help you avoid unnecessary delays, understand the work required and make a more informed decision about your certification.

To discuss Cyber Essentials or Cyber Essentials Plus with Delta Cyber Security, visit our Cyber Essentials page.