In short
IASME is the NCSC's Cyber Essentials Delivery Partner. It runs registration, the online assessment portal, the question set and the public certificate search, and it licenses the Certification Bodies whose assessors mark self-assessments, carry out Cyber Essentials Plus testing and issue certificates. The NCSC owns the scheme and writes the requirements.
Want help with Cyber Essentials?
We can plan it with you or do it for you. Tell us where you are up to.
Who IASME is
IASME (IASME Consortium Ltd) is the organisation the National Cyber Security Centre has appointed as its Cyber Essentials Delivery Partner. The NCSC owns the scheme and writes the technical requirements; IASME turns those requirements into a working certification scheme and runs it day to day.
IASME also runs its own governance standard, IASME Cyber Assurance, which builds on Cyber Essentials, and it developed Defence Cyber Certification with the Ministry of Defence. It delivered the NCSC's Funded Cyber Essentials Programme from December 2022; see is Cyber Essentials certification free? for where that stands now.
What IASME does for Cyber Essentials
| Area | IASME's role |
|---|---|
| Question set | Writes the question set applicants answer (currently Danzell, which goes with Requirements v3.3) and publishes it free as a booklet in PDF and Excel formats |
| Registration and portal | Runs registration and the online assessment portal. You can register and pay through IASME directly (the self-led route) or through a Certification Body (the supported route) |
| Fees | Sets the fixed self-assessment fee, banded by employee count |
| Certification Bodies | Licenses the Certification Bodies whose assessors mark self-assessments, carry out Plus testing and issue certificates |
| Cyber Essentials Plus | As Delivery Partner, sets the method for calculating sample sizes and approves the scanning tools; it can use discretion where failures are marginal |
| Certificate search | Hosts the public certificate search and the Supplier Check tool for checking suppliers in bulk |
| Free help | Offers the Cyber Essentials Readiness Tool and Knowledge Hub, and books free 30-minute Cyber Advisor consultations for small and medium-sized organisations |
| Insurance | Arranges the cyber liability insurance included for eligible organisations that certify their whole organisation and opt in; see Cyber Essentials insurance |
Not sure which option applies to you? Ask us
Tell us about your organisation and we will point you to the right option.
What IASME does not do
- It does not write the requirements. The NCSC sets *Cyber Essentials: Requirements for IT Infrastructure* and the *Cyber Essentials Plus Test Specification*.
- Assessors at Certification Bodies do the marking. They read your answers, test your systems for Plus and issue the certificate. See choosing a Cyber Essentials certification body.
- It does not fix your IT. Getting devices, accounts and cloud services ready is your job, or your IT provider's. That is the part Forever Systems helps with.
How IASME fits into getting certified
- Read IASME's free question set booklet and use its Readiness Tool to see where you stand.
- Register through IASME (self-led) or a Certification Body (supported) to open an assessment account in the IASME portal.
- Answer and submit the question set; a director or equivalent signs the declaration.
- An assessor marks it, and the Certification Body issues your certificate.
- Your certificate appears in IASME's certificate search; see Cyber Essentials certification check.
- A renewal reminder arrives about a month before expiry, from IASME or, if you certified through one, your Certification Body, so you can renew.
The full route is on how to get Cyber Essentials certification.
Prefer a hand with this?
We can help you plan it and set it up, alongside your own team.
This site is independent of IASME
Cyber Essentials UK is run by Forever Systems Ltd. It is not operated by, or affiliated with, IASME, the NCSC or any government department, and Forever Systems is not a Certification Body. For official information, sign-in and help with your assessment account, go to IASME's website or the NCSC's Cyber Essentials pages.
What we do is prepare organisations for Cyber Essentials and Cyber Essentials Plus: a gap analysis, fixes for the gaps it finds, and support through assessment alongside an IASME-licensed Certification Body. Contact us if you would like help.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Frequently asked questions
What is IASME?
IASME is the NCSC's Cyber Essentials Delivery Partner. It runs registration, the assessment portal, the question set and the certificate search for Cyber Essentials, and licenses the Certification Bodies that assess applicants and issue certificates.
Is IASME the same as the NCSC?
No. The NCSC, part of GCHQ, owns the Cyber Essentials scheme and writes its requirements. IASME is the NCSC's appointed Delivery Partner and runs the scheme day to day.
Does IASME issue Cyber Essentials certificates?
Certificates are issued by Certification Bodies that IASME licenses, after their assessor has marked your self-assessment or tested your systems. You can register through IASME directly or through a Certification Body; the question set and certificate are the same either way.
Does IASME run Cyber Essentials Plus too?
Yes. IASME delivers both levels. Cyber Essentials Plus testing is carried out by assessors at IASME-licensed Certification Bodies, using the NCSC's test specification and IASME's method for sizing the sample.
Is this website run by IASME?
No. Cyber Essentials UK is an independent site run by Forever Systems Ltd, which prepares organisations for certification. For your assessment account and official guidance, use IASME's own website.
Still have a question about Cyber Essentials?
Ask us and a member of our team will reply by email.