HOW TO CHOOSE A CYBER ESSENTIALS CERTIFICATION BODY

WHY YOUR CHOICE OF CERTIFICATION BODY MATTERS

Once issued, a Cyber Essentials certificate carries the same Government-backed status and IASME public register listing no matter which Approved Certification Body assessed you. There is no premium tier of the certificate itself.

What varies enormously between providers is price, turnaround time, and support quality. Getting this choice right saves money and reduces the risk of a failed first assessment.

STEP ONE: CONFIRM THEY ARE IASME APPROVED

IASME is the UK Government-appointed scheme owner for Cyber Essentials. Only organisations directly licensed by IASME as an Approved Certification Body can issue valid certificates.

Do not take a provider's word for it. Check the IASME Network Directory directly and confirm the organisation is listed as a current Approved Certification Body. A genuine body will have no issue pointing you to their own listing - if a provider is vague or evasive about this, treat it as a warning sign.

STEP TWO: CHECK THE PRICING STRUCTURE

Cyber Essentials pricing should be transparent and fixed, scaled by organisation size. Watch for:

• The IASME fee should be included - not added as a surprise extra once you have already started the process
• Fixed pricing by organisation size - not vague "starting from" prices with significant add-ons revealed later
• No hidden resubmission fees - ask upfront what happens, and what it costs, if you do not pass first time

STEP THREE: ASK WHO ACTUALLY REVIEWS YOUR SUBMISSION

Some larger providers operate at high volume with limited direct contact - your submission may be reviewed by whoever is available, with little continuity if you have follow-up questions.

Ask whether you get a named point of contact, whether you can ask questions before formally submitting, and whether gaps in your controls will be flagged before assessment rather than after a failure. This single factor is one of the strongest predictors of a smooth, first-time pass.

STEP FOUR: CHECK TURNAROUND TIME AND DEADLINE FLEXIBILITY

If you are working to a tender deadline or contract renewal date, ask directly how quickly the provider can turn around an assessment, and whether they can prioritise urgent cases. A good certification body will give you a clear, realistic timeline rather than vague reassurance.

RED FLAGS TO WATCH FOR

• Cannot confirm their IASME Approved Body status when asked directly
• Pricing only available after a sales call rather than published transparently
• No mention of the IASME fee in their pricing - it may be added later as a surprise
• Generic, templated communication suggesting high-volume processing with little individual review
• No clear answer on what happens if you fail the assessment first time

QUESTIONS TO ASK BEFORE YOU COMMIT

• Are you an IASME Approved Certification Body, and what is your Approved Body number?
• Is the IASME certification fee included in your quoted price?
• Who will actually review my submission, and can I speak to them directly?
• What is your typical turnaround time?
• What happens, and what does it cost, if I do not pass first time?
• Do you offer guidance to identify gaps before formal submission, or do I submit blind?