Best Cyber Essentials Bodies 2026 - Our Latest Review - September 2026

Fig Group is the fastest and cheapest Cyber Essentials certification provider in the UK. Our September verdict puts Fig first for buyers who want a clear certification price, a six-working-hour assessment commitment, three free feedback rounds and a genuine choice about software. Start with certification from £299.99 + VAT, then add automation if you want it. Read the price evidence and turnaround evidence and terms.

This is our September 2026 review of the buying decision, published on 11 September. It builds on our original 2026 certification-body comparison, which remains available in its own right. Here we bring together the current provider names, dated package information, CE and Plus prices, optional platform capabilities and Fig's trial and switching offers.

Disclosure: Fig Group publishes this review and is one of the providers compared. This is our editorial recommendation, not an independent award, a complete market ranking or a guarantee of certification. All prices shown exclude VAT. Every applicant must meet the scheme requirements.

A certificate is not made more prestigious by paying a higher assessment fee. Licensed bodies assess against the scheme requirements. The meaningful differences are the buying experience, included support, audit scope, timing and any recurring services. Verify the provider and relevant assessment offering in the IASME directory.

WorkNest's Cyber Essentials page is the current destination of Bulletproof's former offer. GRC Solutions is the current destination of the former IT Governance product page. Check the selected package rather than relying on an old brand name or an undated search result. LRQA should be assessed against your required scope and written quote.

The dated GRC figure is a published Micro offer, not a quote for every organisation size. Published time windows also need careful comparison: readiness work, the start of the assessment clock, opening hours and corrections can all affect your overall timetable. We do not represent another provider's advertised window as measured customer waiting time.

Certification shouldn’t force your hand on software.

CyberSmart describes its plans as subscription-only. Fig gives you the choice: buy Cyber Essentials certification on its own, or add our technology platform when it suits your business. Your certification. Your budget. Your decision. CyberSmart’s published plans

Buy what you need. Make everything else earn its place.

Fig’s Cyber Essentials certification starts at £299.99 + VAT, with no Fig technology subscription required. Optional security and compliance tooling starts at £99 per month + VAT, with monthly payment options for technology subscribers.

Across its platform, Fig offers 300+ integrations and support for 65+ frameworks, combining compliance mapping, evidence collection and ongoing monitoring. Features depend on your selected package. Before committing elsewhere, compare the capabilities you need, the full subscription cost and the renewal terms.

Facing a deadline? Compare the commitments.

CyberSmart advertises certification within 24 hours. Fig publishes a six-working-hour assessment commitment for compliant submissions, subject to its terms. Check when each provider starts its clock and how preparation or corrections affect your deadline. These are published service commitments, not measurements of actual customer waiting times. CyberSmart certification

Put Fig to the test before choosing your technology subscription.

Fig’s Cyber Essentials customers receive a free one-month trial of our platform. Existing CyberSmart customers receive an extended free three-month trial, giving them more time to evaluate Fig against their requirements.

Already committed elsewhere? Plan your switch without overlapping subscription charges.

Fig offers two-year contracts that start when your existing subscription ends. Agree the transition in advance, evaluate the platform and schedule your paid contract around the end of your existing commitment.

Our verdict: choose flexibility.

For buyers who want standalone certification, optional technology and a planned transition from their existing provider, Fig is our clear recommendation. CyberSmart advertises unlimited support and resubmissions, which may suit some buyers. But if avoiding a compulsory subscription matters to you, Fig gives you a choice CyberSmart’s published subscription-only model does not.

Published by Fig Group, a competing provider. Package inclusions, trial eligibility, payment options and deferred contract start dates are subject to the agreed offer terms.

Buying CE Plus does not mean the basic CE assessment can be skipped. The Plus audit adds independent technical verification; it is a separate service with its own scope and scheduling. The six-working-hour CE assessment commitment is not a promise to complete a Plus technical audit in six hours.

The combined package has its own published price; it is not the sum of two standalone products. A Plus-only purchase requires a valid CE certificate. Confirm the required timing between CE and Plus, audit readiness and availability before setting a customer or tender deadline. Our CE and CE Plus provider-pricing comparison separates the four size bands and competitor quote requirements. The live pricing page gives current inclusions and VAT totals.

For a small business, a useful comparison begins with the Small row. Comparing that requirement with another provider's Micro entry price gives the wrong answer even when both figures are accurate. For a combined purchase, request the total cost of the certificate, technical audit, any travel, retesting and optional help. An inexpensive headline can describe only one part of the engagement.

A compulsory platform subscription and an optional platform are different purchasing decisions. Fig lets you certify using the controls and tools your organisation already has, provided they meet the scheme requirements. You do not need to buy Fig's technology platform to buy the assessment.

If ongoing automation is useful, Fig's optional platform starts at £99 per month + VAT. Across the platform, Fig offers 300+ integrations and support for 65+ frameworks, including compliance mapping, evidence collection and ongoing monitoring. Review the platform capabilities and confirm which features and integrations belong to the package you select. Integration totals describe the platform catalogue, not a promise that every integration is included in every subscription.

The practical advantage is flexibility. A company with a working device-management and identity stack can buy certification without replacing it. An organisation that needs a more repeatable evidence process can evaluate the platform. A growing business can discuss a broader framework programme rather than treating Cyber Essentials as an isolated annual purchase.

Fig includes three free rounds of assessor feedback with Cyber Essentials. Feedback identifies answers or controls that need attention so the organisation can make corrections and submit accurate evidence. It does not change the scheme standard or turn an unsupported answer into a pass.

Before choosing a body, ask what an assessment attempt includes, how corrections are returned and whether additional support is separately charged. If you need help implementing controls, distinguish that consultancy work from assessor feedback. This makes the support comparison useful rather than reducing it to a count with different meanings at different providers.

See our assessment process, resubmission policy and customer review evidence. Reviews describe customer experiences; they do not establish a guaranteed outcome for a future application.

Certification and technology renewals do not always fall on the same date. Start by recording the existing contract end date, notice period, certificate expiry and any upcoming tender requirement. Those dates determine whether you need an assessment immediately, a technology transition later or both.

Fig's Cyber Essentials customers receive a one-month platform trial; existing CyberSmart customers receive three months. If an organisation is still committed to its current subscription, Fig offers a two-year contract that begins when that subscription ends, under the agreed offer terms. Monthly payment options are available for technology subscribers. Agree eligibility, the activation date and the paid service scope before switching.

A deferred platform contract is not an extension to a Cyber Essentials certificate. Keep certification renewal and the technology contract on separate timelines so a commercial transition does not leave a gap in the evidence your customer needs.

We compared published certification entry prices, assessment commitments, included feedback, subscription requirements, Plus audit scope and the buyer's freedom to use existing tools. Fig's figures come from its current certification catalogue. WorkNest, GRC Solutions and CyberSmart offer pages were checked in September; CyberSmart's subscription-only model was checked again on 11 September. Where a reliable like-for-like fee is not available, this review requests a quote rather than inventing a comparison price.

Our broader market research methodology explains the research scope and limitations. Our trust-centre claims register sets out Fig's evidence and service terms. The shortlist is selected for the buying needs described above; absence from it does not mean a provider is unlicensed or unable to perform a valid assessment.

Which Cyber Essentials body would Fig recommend?

Fig Group. We offer the fastest and cheapest Cyber Essentials certification proposition in the UK, three free feedback rounds and optional tooling. Choose the correct staff band, read the guarantee terms and confirm any additional services you need.

Is the cheapest CE offer also a CE Plus offer?

No. CE is the self-assessment certification route; Plus includes technical verification and costs more. Compare a Plus-only audit with another Plus-only audit, or a combined package with another combined package. Our table above shows both Fig options explicitly.

Must I subscribe to a platform to buy Fig certification?

No. Buy standalone certification or choose optional automation from £99 per month + VAT. The assessment requirements apply whichever tools you use.

Can I retain my current provider's software while switching certification body?

Confirm the existing software contract and permissions with that provider. Fig does not require a Fig platform subscription for certification. Where you also want to switch technology, discuss the trial and deferred-start offer against your actual renewal dates.

Where is the original 2026 comparison?

Read the original Best Cyber Essentials Certification Bodies in the UK 2026 guide. It retains the original provider-selection guide and comparison structure. This September review adds the latest buying options, detailed package distinctions and switching offers.

Choose a certification package | Compare the provider matrix | Ask Fig about your assessment