Cyber Essentials Certification for UK Businesses

£250 + VAT per month, all-in for standard scope (up to 49 employees): gap analysis, remediation done by our engineers, questionnaire submission with the official IASME assessment fees included, and annual re-certification. Larger organisations are tiered from the same floor and quoted before commitment.

Typically 30–45 days from signup to certificate for standard scope: about a week of gap analysis, two to four weeks of remediation depending on what we find, then submission. A clean, modern estate can be faster; heavy legacy software is the usual thing that extends it - and we tell you at gap-analysis stage, not at week six.

Firewalls (every device behind a correctly configured boundary or software firewall), secure configuration (default passwords changed, unused software and accounts removed), user access control (least privilege, restricted admin rights, MFA on cloud services), malware protection (anti-malware or allow-listing on every in-scope device), and security update management (supported software only, high and critical patches within 14 days).

No - it's voluntary certification. But it's contractually required for certain UK government and MoD work, increasingly demanded down supply chains by prime contractors, and asked about by cyber insurers at proposal and renewal. For many businesses the commercial pressure makes it effectively mandatory even though no law does.

Both certify the same five controls. CE is a verified self-assessment - you answer the questionnaire, a qualified assessor reviews it. CE Plus adds an independent technical audit with tests run against your actual systems, which carries more weight with enterprise buyers, insurers and government. With AMVIA, CE is £250+VAT/month and Plus is £400+VAT/month.

Certification is issued through the official IASME scheme. AMVIA delivers the service - gap analysis, remediation, submission, renewals - in partnership with an IASME-accredited certification body, so the certificate you receive is the standard, register-verifiable Cyber Essentials certificate. You can confirm any certificate, including ours, with our free certificate checker.

Our model makes that unlikely by design: we don't submit until the gap analysis says the controls genuinely pass, because we did the remediation ourselves. If an assessment does surface something, fixing it and resubmitting is part of the service - not a new invoice.

No - the official assessment fees (£320+VAT for micro organisations, £440+VAT for small, rising to £600+VAT for large enterprises; verified August 2026) are included in the monthly price. There is nothing to pay on top for standard scope.

Up to 49 employees with a typical single-organisation estate - the shape most UK SMEs are. More employees, multiple legal entities or unusually complex estates are tiered from the same £250/£400 floors, with the exact price confirmed on a 15-minute call before you commit to anything.

Basic Cyber Essentials certification through IASME includes cyber liability insurance (£25,000 indemnity) for eligible UK organisations with under £20 million turnover, at no extra cost. It's a useful baseline - not a substitute for a standalone cyber policy sized to your actual risk.

Considerably, if it's configured properly: MFA enforcement, access control and patching are all natively manageable. Misconfigured tenants are also one of the most common gap sources - our free Microsoft 365 security baseline check shows where yours stands, and tenant hardening is part of our remediation work.

Yes - devices used for business, wherever they are, are in scope, including home-worker laptops and BYOD phones accessing company data. This is one of the most commonly misunderstood scope areas and a routine gap-analysis finding; our remediation covers bringing remote devices under control.

The service keeps running: monthly control checks, drift fixed as it appears (new starters, new software, expiring configurations), and the annual re-certification handled on schedule. That continuity is the point of the monthly model - the certificate never lapses and renewal never becomes a project.

Yes - co-managed certification is common. We coordinate the remediation with your incumbent IT provider, or handle just the certification layer while they run day-to-day support. The responsibility split is agreed at gap-analysis stage so nobody's stepping on anyone.

We don't sell certification-only, because submitting an estate we haven't verified would put our name on something we can't stand behind. If you genuinely just need the assessment, the DIY route through IASME costs £320–£600+VAT - and our free readiness assessment will tell you honestly whether you're ready for it.

Search the official register operated by IASME on behalf of the NCSC - free, no account needed. Our certificate checker takes you straight there with the company name ready to search. Certificates expire after 12 months, so a supplier who 'has Cyber Essentials' from two years ago is not currently certified.

It materially reduces the risk from commodity attacks - the automated, untargeted kind that make up most of what UK SMEs face - because the five controls close the doors those attacks use. It is not a complete security programme: it doesn't cover detection, response or user training, which is where managed detection and response picks up.

When a contract, insurer or customer names it specifically; when you handle data sensitive enough that self-assessment won't satisfy your stakeholders; or when you want the independent audit as genuine assurance rather than paperwork. The controls are identical - Plus proves them harder. If in doubt, start the conversation at CE and upgrade; the work transfers.

For many, yes - UK government procurement policy requires suppliers to hold Cyber Essentials for central government contracts involving personal information or certain ICT services, and MOD contracts routinely require it (often Plus). Check the tender documents for which level, and start early: standard-scope certification typically runs 30–45 days end to end.

The five control areas: firewalls and internet gateways, secure configuration, access control, malware protection, and security update management (supported software patched within 14 days for high/critical updates) - applied across every in-scope device, including home workers and cloud services. The assessment is a self-assessment questionnaire verified by an IASME assessor; Plus adds an independent technical audit of the same controls.