Your Path to Cyber Essentials Certification
Certification is five steps, and with the agent doing the evidence-gathering most of them take minutes rather than days. We regularly take organisations from quote to certificate in a single working day. Here is what happens at each step and what tends to go wrong.
The Route to Certification
Get a Quote
Your fee is set by headcount and certification level. The quote takes a minute and commits you to nothing.
Agree the Scope
Whole organisation, or a defined part of it behind its own firewall or VLAN. Every device your people use, including their own, and every cloud service you rely on is in scope. The agent maps this in under 15 minutes.
Check the Five Controls
Firewalls, secure configuration, security update management, user access control and malware protection. The agent checks each against the current question set and tells you what would fail before you answer anything.
Answer and Attest
Answer the official question set with the evidence to hand, then a board member attests that the answers are accurate. Two or fewer non-compliances still certify. You need none if you intend to go on to Plus.
Marking and Certificate
Our licensed assessors mark your assessment, usually within 24 hours and the same day when it's urgent. On a pass, IASME issues your certificate, valid for one year, and your organisation appears on the public register of certified organisations.
What Stops Most Applicants
- An operating system no longer supported by its vendor on any device in scope.
- High-risk or critical updates not applied within 14 days of release, on operating systems or applications.
- Multi-factor authentication not enabled for every user and administrator of a cloud service that offers it.
- Devices and cloud services nobody declared: personal phones reading company email, a home worker's laptop, a SaaS tool one team signed up for.
- Administrator accounts used for everyday work instead of a separate standard account.
Two or fewer non-compliances still certify. A single automatic fail does not.
Check Before You Answer
The agent reviews your environment against the current question set before you submit a single answer.
- Maps your scope. Every device and cloud service, including the ones nobody thought to declare.
- Checks the five controls. Each one tested against the live question set, not a generic checklist.
- Flags fails and non-compliances. You see exactly what would be marked down, and why, while there is still time to fix it.
- Gathers the evidence. Each answer is backed by what the agent found, not by memory.
Nothing reaches an assessor that you have not already seen.
Start With the Agent
Scope your environment and check your controls now. It takes under 15 minutes.