In short
A Cyber Essentials certification body is an organisation licensed by IASME, the NCSC's Delivery Partner, whose qualified assessors mark verified self-assessments, carry out Cyber Essentials Plus testing and issue certificates. You can buy the self-assessment from IASME directly or through a certification body, while Cyber Essentials Plus is quoted individually by certification bodies.
Get a quote for Cyber Essentials certification support
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
What a certification body does
Certification Bodies are licensed by IASME, the NCSC's Cyber Essentials Delivery Partner. Their qualified assessors:
- mark verified self-assessments against the NCSC requirements, and can ask questions or request more detail before deciding
- carry out the hands-on Cyber Essentials Plus audit, following the NCSC's test specification so that the result should be the same whichever body you use
- issue the certificate when you pass
The question set, the marking standard and the certificate are the same whichever route or body you use. What differs is the service around it: how much guidance you get, how Plus testing is delivered and the price.
Self-led or supported route
| Self-led route | Supported route | |
|---|---|---|
| Who you register and pay | IASME directly, at its fee banded by organisation size | An IASME-licensed Certification Body; ask what its price includes |
| Help during the assessment | IASME's free resources and Knowledge Hub | The Certification Body can guide you through the questions |
| Best for | Organisations confident they already meet every control | Organisations that want guidance while they answer |
| Cyber Essentials Plus | Quoted individually by a Certification Body | Quoted individually by a Certification Body |
You are not tied to one body. At renewal you can use the self-led route or any IASME-licensed Certification Body, whichever you used last year. See how to get Cyber Essentials certification for the full route.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
What to ask before you choose
- Is it currently licensed by IASME? Check on IASME's own website rather than relying on a logo
- Which levels does it assess: Cyber Essentials only, or Cyber Essentials Plus as well?
- For Plus, does it test remotely, on site or both, and what will it need from you on test day?
- What is included in the price: guidance on the questions, help with assessor queries, any retests?
- How soon can it test, so that Plus falls inside the three-month window after your Cyber Essentials certificate?
- What information does it need to quote for Plus: device counts, builds, cloud services and sites?
For what the audit fee depends on, see Cyber Essentials Plus cost.
Certification bodies, consultants and IT providers
Certification Bodies assess and certify. Consultants and IT providers, often described as Cyber Essentials consultants or providers, help you get ready: they review your IT, fix gaps and help you answer accurately. Only an IASME-licensed Certification Body can issue a certificate, so check which role any provider is playing.
The NCSC's Cyber Advisor scheme is different again. It assures individuals who give small and medium-sized organisations hands-on help with the controls; a Cyber Advisor helps you prepare but is not your assessor.
Is Cyber Essentials certification support the right fit for you?
We will check it against your systems and requirements and recommend the right option, with no obligation.
How Forever Systems works alongside a certification body
Forever Systems Ltd is an IT and cyber security provider and part of Forever Group, whose wider cyber security services go beyond Cyber Essentials. Forever Systems is not a Certification Body and does not issue certificates. We prepare you for certification and work alongside an IASME-licensed Certification Body, which carries out the assessment independently.
In practice that means a gap analysis against the current question set, fixing what we find, help agreeing a scope and drafting accurate answers, and a rehearsal before any Plus audit. Keeping preparation and assessment separate keeps the assessment independent. Contact us to get started.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Frequently asked questions
What is a Cyber Essentials certification body?
An organisation licensed by IASME to assess Cyber Essentials applicants. Its qualified assessors mark verified self-assessments, carry out Cyber Essentials Plus testing and issue certificates when you pass.
Can I choose any certification body?
Yes, as long as it is licensed by IASME. The question set, marking standard and certificate are the same whichever you use, and you can switch at renewal.
Do certification bodies charge different prices?
They can. On the self-led route you pay IASME's fee, banded by organisation size. On the supported route, and for Cyber Essentials Plus, which the NCSC lists as quoted, ask each Certification Body what its price includes.
Is a Cyber Essentials assessor the same as a consultant?
No. An assessor works for a Certification Body and decides whether you meet the requirements. A consultant or IT provider helps you prepare and fix gaps, but only a licensed Certification Body can issue the certificate.
Is Forever Systems a certification body?
No. Forever Systems prepares organisations for Cyber Essentials and Cyber Essentials Plus and works alongside an IASME-licensed Certification Body, which carries out the assessment and issues the certificate.
Still have a question about Cyber Essentials certification support?
Ask us and a member of our team will reply by email.