Frequently asked questions

It isn't a legal requirement for most businesses, but you may need it to win work. Central government requires it for contracts that involve handling personal or sensitive information or supplying certain IT services, and many councils, NHS suppliers, larger customers and insurers ask for it too. Our 60-second checker gives you a quick answer for your business.

The certificate fee is set centrally by IASME according to business size: £320 + VAT for micro businesses (0–9 staff), £440 + VAT for small (10–49) and £500 + VAT for medium (50–249). Eligible businesses can get 75% off. Cyber Essentials Plus is priced by each certification body and typically costs £1,500 to £3,000 + VAT for a small business. See our cost guide.

Probably, if you're a UK micro, small or medium-sized business and haven't held Cyber Essentials in the past four years. The government's First Step Fund runs until March 2027 or until the money runs out, first come first served. The discount is applied by the certification body you choose. See how to get 75% off.

Both cover the same five controls. Cyber Essentials is an online self-assessment checked by an assessor. Plus adds a hands-on technical audit of your systems, and you need Cyber Essentials first. See Cyber Essentials Plus explained.

The assessment itself is quick: once you submit the questionnaire, an assessor usually marks it within a few working days. Most of the time goes on getting ready, such as turning on multi-factor login, installing updates and replacing devices that no longer get security updates. For most small businesses that takes anywhere from a few days to a few weeks. You have six months from buying your assessment to submit it.

The assessor tells you what needs fixing, and you normally get two working days to fix it, update your answers and resubmit at no extra cost. If you can't fix everything in that time, you usually have to start a new assessment and pay again. The most common reasons for failing are missing multi-factor login on cloud services, updates not installed within 14 days and unsupported software. See what changed in April 2026.

Yes. Since April 2026, cloud services such as Microsoft 365 and Google Workspace are always in scope. Laptops and phones that staff use to reach work email or data are usually in scope too, even if they're working from home or using their own device. See what changed in April 2026.

A certificate is valid for 12 months, then you renew.

Yes, for businesses. Certification bodies may pay us to be listed or introduced. That never affects the facts in our guides.

No. We're an independent guide. Certification is carried out by certification bodies licensed by IASME, the NCSC's delivery partner. Browse our directory of certification bodies.