WHAT IS A CYBER ESSENTIALS CERTIFICATION BODY?
A Cyber Essentials certification body is an organisation directly licensed by IASME - the UK Government-appointed scheme owner for Cyber Essentials - to assess and certify businesses against the scheme's requirements. Only IASME Approved Certification Bodies can issue valid Cyber Essentials certificates and list certified organisations on the official IASME public register. They cannot be resellers or intermediaries: the licence is held directly.
The certification body sits between the applicant and IASME. They conduct the assessment, review the self-assessment questionnaire, make the pass/fail decision against the current requirements, and issue the certificate on IASME's behalf. For Cyber Essentials Plus, they also carry out the independent technical audit - scanning systems and verifying that controls are genuinely working, not just documented.
IASME itself does not carry out assessments. It maintains the scheme, publishes the requirements, licenses certification bodies, and operates the public register. The NCSC (National Cyber Security Centre) is the scheme's originator and provides Government backing, but day-to-day delivery runs through IASME and its approved network.
HOW MANY CERTIFICATION BODIES ARE THERE?
There are over 100 IASME Approved Certification Bodies in the UK, ranging from large IT consultancies that offer Cyber Essentials alongside many other services, to specialist bodies like Vincent Cyber Defence that focus exclusively on cyber security assurance. All are licensed by IASME and all issue the same Government-backed certificate. What differs substantially between them is price structure, support quality, and the depth of guidance they provide throughout the process.
WHY YOUR CHOICE OF CERTIFICATION BODY MATTERS
Once issued, a Cyber Essentials certificate carries the same Government-backed status and IASME public register listing no matter which Approved Certification Body assessed you. There is no premium tier of the certificate itself.
What varies enormously between providers is price, turnaround time, and support quality. Getting this choice right saves money and reduces the risk of a failed first assessment.
HOW CERTIFICATION BODIES DIFFER: A QUICK COMPARISON
These are the differences that buyers typically only discover after they have already started. Check all six before you commit.
| What to check | Most CBs | Vincent Cyber Defence |
|---|---|---|
| Prices published upfront | No - quote required | Yes - all prices shown |
| Gap review before formal submission | Not included | Included as standard |
| Direct access to your assessor | Via helpdesk or account manager | Direct from day one |
| Resubmission support if not compliant | Often charged extra | No extra charge |
| CE Plus rescan included | Usually charged extra | Free 30-day rescan |
| Assessment turnaround | Variable | Typically 1-2 business days |
| Cyber Essentials price (micro, 0–9) | From £320 + VAT (IASME-set) | £320 + VAT, all-in |
"Most CBs" reflects common market practice among IASME Approved Certification Bodies as of 2026; individual providers vary.
STEP ONE: CONFIRM THEY ARE IASME APPROVED
IASME is the UK Government-appointed scheme owner for Cyber Essentials. Only organisations directly licensed by IASME as an Approved Certification Body can issue valid certificates.
Do not take a provider's word for it. Check the IASME Network Directory directly and confirm the organisation is listed as a current Approved Certification Body. A genuine body will have no issue pointing you to their own listing - if a provider is vague or evasive about this, treat it as a warning sign.
Vincent Cyber Defence is a directly licensed IASME Approved Certification Body for Cyber Essentials, Cyber Essentials Plus, and DCC Level 0 - verifiable on the IASME public registry.
STEP TWO: CHECK THE PRICING STRUCTURE
Cyber Essentials pricing should be transparent and fixed, scaled by organisation size. Watch for:
- The IASME fee should be included - not added as a surprise extra once you have already started the process
- Fixed pricing by organisation size - not vague "starting from" prices with significant add-ons revealed later
- No hidden resubmission fees - ask upfront what happens, and what it costs, if you do not pass first time
STEP THREE: ASK WHO ACTUALLY REVIEWS YOUR SUBMISSION
Some larger providers operate at high volume with limited direct contact - your submission may be reviewed by whoever is available, with little continuity if you have follow-up questions.
Ask whether you get a named point of contact, whether you can ask questions before formally submitting, and whether gaps in your controls will be flagged before assessment rather than after a failure. This single factor is one of the strongest predictors of a smooth, first-time pass.
STEP FOUR: CHECK TURNAROUND TIME AND DEADLINE FLEXIBILITY
If you are working to a tender deadline or contract renewal date, ask directly how quickly the provider can turn around an assessment, and whether they can prioritise urgent cases. A good certification body will give you a clear, realistic timeline rather than vague reassurance. At Vincent Cyber Defence, assessments are typically completed within 1-2 business days of submission - once your controls are in place, the process moves quickly.
RED FLAGS TO WATCH FOR
- Cannot confirm their IASME Approved Body status when asked directly
- Pricing only available after a sales call rather than published transparently
- No mention of the IASME fee in their pricing - it may be added later as a surprise
- Generic, templated communication suggesting high-volume processing with little individual review
- No clear answer on what happens if you fail the assessment first time
QUESTIONS TO ASK BEFORE YOU COMMIT
- Are you an IASME Approved Certification Body, and what is your Approved Body number?
- Is the IASME certification fee included in your quoted price?
- Who will actually review my submission, and can I speak to them directly?
- What is your typical turnaround time?
- What happens, and what does it cost, if I do not pass first time?
- Do you offer guidance to identify gaps before formal submission, or do I submit blind?
WHY CHOOSE VINCENT CYBER DEFENCE?
- IASME Approved Certification Body - directly licensed, not a reseller.
- All prices published upfront - no quotes required, no surprises.
- Gap review before formal submission - included as standard, not charged separately.
- Direct access to your assessor - not routed through a helpdesk or account manager.
- Resubmission support included - if you are not compliant first time, we guide you through at no extra charge.
- Free 30-day rescan with CE Plus - the additional scan required for certification is covered in your price.
- Fast turnaround - assessments typically completed within 1-2 business days of submission.
Looking for a certification body? Vincent Cyber Defence is a UK-based, directly licensed IASME Approved Certification Body. Fixed, transparent pricing with the IASME fee included, direct access to your assessor, and a first-time pass focus. Get in touch for a clear, no-obligation quote.
