Two NCSC-backed certificates from one IASME-licensed body. Self-assessed Cyber Essentials starts at £299.99 + VAT with a six-hour SLA on compliant submissions. Cyber Essentials Plus adds independent third-party verification - external vulnerability scanning and a remote technical audit - from £1,499 + VAT, with a 1-3 working day turnaround.
Self-assessed
You complete an IASME questionnaire covering the five core controls. An IASME-licensed Fig assessor reviews your submission and the certificate is issued - guaranteed within six hours of a compliant submission.
Independent audit
Adds an independent technical layer on top of the same five controls. An assessor runs an external vulnerability scan and a remote audit of a sampled set of in-scope devices, verifying that the controls actually work in practice.
Shared by both certificates
| Feature | Cyber Essentials | Cyber Essentials Plus |
|---|---|---|
| Assessment type | Self-assessed questionnaire | Independent third-party audit |
| External vulnerability scan | - | |
| Remote technical audit of devices | - | |
| NCSC-backed certificate | ||
| Certificate validity | 12 months | 12 months |
| v3.3 compliant (mandatory MFA) | ||
| Turnaround | 6-hour SLA on compliant submissions | 1-3 working days |
| Starting price (Micro) | £299.99 + VAT | £1,499 + VAT |
| Three free feedback rounds | ||
| £25k cyber liability insurance | ||
| Best for | Foundational proof, supplier panels, PPN 014/21 | Enterprise procurement, regulated counterparties, high-value bids |
Cyber Essentials from £299.99 + VAT, six-hour SLA on compliant submissions. Cyber Essentials Plus from £1,499 + VAT, 1-3 working days. Both fixed-fee, both IASME-licensed, both valid for 12 months.