Cyber Essentials Readiness
Need Cyber Essentials for a contract, tender or insurer?
We check your setup against the five Cyber Essentials controls, help you fix the gaps and prepare the question set, and submit through a partner IASME certification body — with a path on to Cyber Essentials Plus.
Fixed-price packages — ask for a quote.
Who needs Cyber Essentials
UK public-sector suppliers
Under Procurement Policy Note 014, central government contracts that involve handling personal information or supplying certain ICT products and services require Cyber Essentials, renewed every year. GOV.UK: PPN 014
Suppliers in a customer’s supply chain
Larger customers increasingly ask suppliers for Cyber Essentials as a baseline in security questionnaires and contract terms. NCSC: Cyber Essentials
Organisations asked by an insurer or broker
Insurers use Cyber Essentials as evidence of basic controls, and eligible certifications come with cyber liability insurance from IASME (see below).
What we do
Cyber Essentials covers five technical control areas: Firewalls, Secure configuration, Security update management, User access control and Malware protection.
Gap check against the five control areas
We scope the assessment with you and check your devices, cloud services and network against the current Cyber Essentials requirements.
Remediation guidance
A prioritised, plain-English fix list for your team or IT provider, with support while each gap is closed.
Question-set preparation
Help drafting accurate answers to the self-assessment question set, so it is right before it is submitted.
Submission through a partner IASME certification body
Certification is assessed and issued by a partner IASME-licensed certification body; we prepare you and handle the submission with you.
Cyber Essentials Plus preparation
Technical preparation for the hands-on Plus audit, including internal checks of the sample devices the assessor will test.
Three steps: Check → Fix → Certify
- Step 1
Check
Scope the assessment and check your setup against the five control areas.
- Step 2
Fix
Work through a prioritised remediation list and prepare the question set.
- Step 3
Certify
Submit to a partner IASME certification body; move on to Cyber Essentials Plus if you need it.
Included cyber liability insurance
IASME includes £25,000 of cyber liability insurance with Cyber Essentials for eligible organisations: the certification must cover the whole organisation, and the organisation must be UK-domiciled with an annual turnover under £20m. Cover and terms are set by IASME and its insurer, not by us — check the current conditions at IASME: cyber liability insurance. The scheme itself is backed by the NCSC.
Frequently asked questions
What does Cyber Essentials cost?
Two parts drive the cost. IASME, which runs the scheme, sets the certification fee by organisation size (source: IASME Cyber Essentials FAQ):
| Organisation size | IASME fee |
|---|---|
| Micro (0–9 employees) | £320 + VAT |
| Small (10–49 employees) | £440 + VAT |
| Medium (50–249 employees) | £500 + VAT |
| Large (250+ employees) | £600 + VAT |
The rest depends on how much preparation and remediation your environment needs: the number of devices and cloud services in scope, how many gaps the check finds, and whether you also want Cyber Essentials Plus. We offer fixed-price packages — ask for a quote.
Cyber Essentials, Cyber Essentials Plus or ISO 27001?
Cyber Essentials is a self-assessment of five technical controls, verified by a certification body. Cyber Essentials Plus covers the same controls but adds a hands-on technical audit of a sample of your devices by an assessor. ISO 27001 is a much broader information security management system standard — risk management, policies and continual improvement — audited by an accredited body, and a larger, longer project (see our ISO 27001 service). Many organisations start with Cyber Essentials and build towards ISO 27001.
How long does it take?
Mostly it depends on how many gaps the check finds and how quickly they can be fixed: an environment that already meets most requirements moves quickly, one that needs device or account changes takes longer. The certificate is valid for 12 months, so it needs renewing every year. If you also want Cyber Essentials Plus, its audit has to be completed within three months of your Cyber Essentials certification (IASME FAQ).
Is Pyramid Ledger a certification body?
No. We prepare you for the assessment and handle the submission with you; the certificate is assessed and issued by a partner IASME-licensed certification body.
Fixed-price packages — ask for a quote
Tell us your organisation size and what the certificate is for, and we will come back with a fixed price for readiness and certification through our partner certification body.