In short
Cyber Essentials is owned by the NCSC and delivered by IASME. Assessors at IASME-licensed Certification Bodies mark your self-assessment, carry out Cyber Essentials Plus testing and issue certificates. Forever Systems prepares you: a gap analysis, remediation and support through assessment alongside a Certification Body. Scheme fees, outcomes and the included insurance are set by IASME and its partners.
Get a quote for Cyber Essentials certification support
Tell us roughly how many users or sites you have and we will reply by email with options and a quote.
Who does what
Getting certified involves several organisations, each with its own role:
| Who | Role |
|---|---|
| National Cyber Security Centre (NCSC) | Owns the Cyber Essentials scheme and writes *Cyber Essentials: Requirements for IT Infrastructure* (currently version 3.3) and the Cyber Essentials Plus Test Specification |
| IASME | The NCSC's Cyber Essentials Delivery Partner. Runs registration, the assessment portal, the question set, the fee bands and the certificate search, licenses Certification Bodies and arranges the included insurance |
| IASME-licensed Certification Body | Its assessors mark the verified self-assessment, carry out Cyber Essentials Plus testing and decide the outcome. The Certification Body issues the certificate |
| Forever Systems | An IT and cyber security provider. Prepares your organisation with a gap analysis, remediation and support through the question set and any assessor queries, including a rehearsal before a Plus audit |
Certificates for Cyber Essentials and Cyber Essentials Plus are issued only by IASME-licensed Certification Bodies, and Forever Systems is not a Certification Body. Assessments under related schemes, such as Defence Cyber Certification and ISO 27001, are carried out by the bodies each scheme appoints. See choosing a Cyber Essentials certification body and IASME and Cyber Essentials.
Not sure which option fits? Ask us
Tell us what you need and we will recommend the right option for your organisation, with a quote.
Fees and quotes
- Scheme fees. IASME sets a fixed fee for the Cyber Essentials verified self-assessment, banded by the number of employees, paid when you register through IASME or a Certification Body. Current figures are on IASME's website
- Cyber Essentials Plus is quoted individually by the Certification Body, based on the size and complexity of your network
- Our work (readiness review, remediation, assessment support and Plus rehearsal) is quoted separately for your organisation, with terms confirmed at quote. Your quote sets out what is included
- Remediation costs such as new devices or licences depend on what the gap analysis finds and are quoted separately
More detail is on Cyber Essentials certification cost and Cyber Essentials Plus cost.
Assessment outcomes and your declaration
The outcome of an assessment is decided by the Certification Body's assessor, against the requirements in force at the time. A few facts to know:
- A board member or equivalent signs a declaration that the answers are accurate. Under the Danzell question set, they also accept responsibility for keeping the organisation compliant for the whole certification period.
- If some answers fall short, you have two working days to amend them at no extra cost. After that, or where an automatic-fail question applies, a new assessment and fee are needed.
- An assessment account stays open for six months from registration.
- Certificates last 12 months. Renewal is a new assessment against the question set in force at the time, with a new fee.
- For Cyber Essentials Plus, testing must take place within three months of your Cyber Essentials certificate, and a second failed retest can lead to the self-assessment certificate being revoked.
Our common Cyber Essentials failures guide explains the automatic fails.
Is Cyber Essentials certification support the right fit for you?
We will check it against your systems and requirements and recommend the right option.
The included cyber insurance
IASME arranges cyber liability insurance for organisations domiciled in the UK or Crown Dependencies with turnover under 20 million pounds that certify their whole organisation and opt in. The insurer is American International Group UK Limited (AIG), and Sutcliffe & Co Insurance Brokers administer the policy. The cover, limits, excess and exclusions are set by the insurer and can change, so read the current terms on IASME's website.
Questions about the policy, claims or additional cover are for the insurer or an insurance broker; Forever Systems does not give insurance advice. See Cyber Essentials insurance.
About this website
Cyber Essentials UK is run by Forever Systems, part of Forever Group. It is not operated by, or affiliated with, the NCSC, IASME or any government department. The guidance on this site is general information about the scheme and related frameworks, checked against the official material, and does not replace the current official requirements.
- For sign-in, password and account help with the IASME portal, contact IASME or the Certification Body you registered with.
- The Cyber Essentials badge is for certified organisations and comes from the Blockmark platform with your certificate; this site does not display it.
- Pages on PPN 014, Defence Cyber Certification, the NHS Data Security and Protection Toolkit, the Cyber Assessment Framework and the Cyber Security and Resilience Bill are general guidance, not legal advice. Your contract, buyer or regulator sets what applies to you, and toolkit and framework submissions are completed by your own organisation.
- Free help such as IASME's Readiness Tool and the NCSC Cyber Advisor consultation is offered by those organisations on their own terms.
Frequently asked questions
Who issues Cyber Essentials certificates?
IASME-licensed Certification Bodies. Their assessors mark the self-assessment or carry out Cyber Essentials Plus testing, and the Certification Body issues the certificate. Forever Systems prepares you and supports you through assessment alongside a Certification Body.
Who runs Cyber Essentials UK?
Forever Systems, part of Forever Group, which prepares organisations for Cyber Essentials and Cyber Essentials Plus. For official scheme information and your assessment account, use the NCSC and IASME websites.
Are scheme fees part of your quote?
IASME's self-assessment fee and any Certification Body fee for Cyber Essentials Plus are set by those organisations. Your quote from us sets out exactly what is included.
Who decides whether we pass?
The Certification Body's assessor, against the requirements in force at the time. Preparation and a gap analysis beforehand help you submit answers you can stand behind.
Still have a question about Cyber Essentials certification support?
Ask us and a member of our team will reply by email.