Sound familiar?
- A contract or tender says you must hold Cyber Essentials by a set date
- Your certificate expires soon and the requirements have changed
- You started the questionnaire and stalled
- You failed and have two days to fix things
- You are not sure which devices and cloud services are in scope
Key facts
- Cyber Essentials is the UK Government-backed scheme from the NCSC, delivered by IASME
- dijitul prepares you and fixes gaps; the certificate comes from an IASME-licensed certification body, not dijitul
- IASME fees: £320 + VAT (0 to 9 staff), £440 (10 to 49), £500 (50 to 249), £600 (250+)
- Certificates last 12 months; you have 6 months from application to submit
- If you fail, IASME allows two working days to fix simple issues and update answers at no extra charge
- Current requirements v3.3 (Danzell question set) apply to new assessments from 27 April 2026
- Preparation: £45 an hour + VAT
Who does what
Cyber Essentials is a UK Government-backed scheme run by the National Cyber Security Centre (NCSC), with IASME as the delivery partner. IASME licenses certification bodies, and those certification bodies employ the assessors who mark your answers and issue the certificate.
dijitul is not a certification body and cannot issue a Cyber Essentials certificate. Our role is the work before and around the assessment:
- Working out your scope: every device, user account, cloud service and network that touches company data.
- Fixing what would fail: MFA, updates, admin rights, firewall settings, unsupported software.
- Helping you understand each question so your answers are accurate and match reality.
- Being on hand if the assessor comes back with queries or a fail.
You choose and pay the certification body yourself. Keeping the people who configure your systems separate from the people who certify them is how the scheme is meant to work.
The certification process, start to finish
- Readiness check. We review your setup against the current requirements. Our Cyber Essentials readiness page details the gaps we fix most often.
- Fix the gaps. Done remotely in most cases.
- Apply. You apply through IASME or directly with a certification body and pay the fee. IASME lists Cyber Essentials at £320 + VAT for micro organisations (0 to 9 employees), £440 + VAT for small (10 to 49), £500 + VAT for medium (50 to 249) and £600 + VAT for large (250+).
- Complete the questionnaire. IASME gives you 6 months from application to submit. We can sit with you on a call while you answer.
- Board-level sign-off. A director or equivalent signs a declaration that the answers are true.
- Marking. The assessor marks your answers. If you fail, IASME allows two working days to fix simple issues and update your answers without paying again. We keep time free for that window.
- Certificate. Valid for 12 months, after which you recertify.
What the current requirements check
The five technical controls are firewalls, secure configuration, security update management, user access control and malware protection. From 27 April 2026, new assessments use requirements v3.3 and the Danzell question set. The changes that catch small businesses out most:
- MFA must be on for every cloud service that offers it. Missing it is an automatic fail.
- High and critical security updates must be installed within 14 days of release.
- Unsupported software, such as Windows 10 without Extended Security Updates, cannot be in scope.
- Cloud services holding your data, and devices used for work including personal phones, are in scope unless properly excluded.
For a plain-English overview, read our guide Cyber Essentials explained.
Why businesses get certified
- Contracts. UK central government contracts that involve handling certain personal or sensitive information require Cyber Essentials, and many private sector customers now ask suppliers for it too.
- Insurance. IASME states that UK organisations with turnover under £20 million that certify their whole organisation can opt in to the cyber liability insurance included with the certificate. Check the current terms on IASME's site.
- Better security. The controls stop a large share of common, untargeted attacks such as password spraying and phishing that leads to account takeover.
For more assurance, Cyber Essentials Plus adds a hands-on technical audit.
Cost
Our preparation work is £45 an hour + VAT, 30 minutes minimum then 15-minute blocks. A tidy small office on Microsoft 365 might need a few hours; a business with old servers and no MFA needs more, and we estimate it after the first review. The certification fee is separate and paid to the certification body. On our Complete plan at £99 a month + VAT, the 3 included hours a month can go towards preparation and keeping controls in place for renewal.
What it costs
Support plans from £25 a month + VAT, or £45 an hour + VAT for one-off fixes. Pick a plan if you want it looked after every month, or pay by the hour for a one-off job.
Essential
Keep it updated, backed up and watched.
- Website software updates (core, plugins, themes) applied and checked
- Daily backups
- Uptime monitoring
- Security monitoring
Business
Updates plus an hour of fixes every month.
- Everything in Essential
- 1 hour of fixes or changes every month
- Priority support
Complete
Website and your team's IT, covered.
- Everything in Business
- 3 hours of fixes or changes every month
- IT and Microsoft 365 helpdesk for your team
No plan? The first 30 minutes are the minimum charge, then we bill in 15-minute blocks.
Frequently asked questions
Can dijitul issue our Cyber Essentials certificate?
No. dijitul is not a certification body. Cyber Essentials certificates are issued by certification bodies licensed by IASME, the NCSC's delivery partner. dijitul prepares your IT, fixes the gaps and helps you answer the questions accurately, then you submit to the certification body you choose.
How much does Cyber Essentials certification cost?
IASME lists the fee at £320 + VAT for organisations with 0 to 9 employees, £440 + VAT for 10 to 49, £500 + VAT for 50 to 249 and £600 + VAT for 250 or more. That goes to the certification body. dijitul preparation work is separate, at £45 an hour + VAT.
What happens if we fail Cyber Essentials?
IASME gives you two working days to review the assessor's feedback, fix simple issues and update your answers at no extra charge. After that, you would need to reapply and pay again. dijitul can make fixes quickly within that window, which is why we prepare before you submit.
How long is a Cyber Essentials certificate valid?
Certificates expire after 12 months, and IASME removes organisations from its certified list if they have not recertified within the year. dijitul recommends starting preparation for renewal a couple of months before expiry, especially when the question set has changed.
How long does it take to get Cyber Essentials?
If your IT is already in good shape, preparation and submission can take a week or two, and marking is usually quick once submitted. Replacing unsupported devices or rolling out MFA across every cloud service takes longer. dijitul gives you a realistic timeline after reviewing your setup.
Related
Get it fixed
One-off fixes are £45 an hour + VAT. You'll know the likely cost before we start.