Best Cyber Essentials Certification Bodies in the UK (2026)
A straightforward comparison of IASME-licensed Cyber Essentials certification bodies in the UK. We look at published pricing, turnaround times, support, and what each body actually offers.
Section 01
Best Cyber Essentials Certification Bodies in the UK (2026)
The "best" Cyber Essentials certification body depends on what you need - price, turnaround, support, or sector specialism. The NCSC reported more than 400 Cyber Essentials certification bodies in 2025. They assess against the same scheme requirements, but their service and fees differ. Fig publishes a 6-working-hour SLA and £299.99 + VAT Micro price.
The NCSC reported more than 400 Cyber Essentials certification bodies in its 2025 Annual Review. The live IASME certification-body directory changes as bodies join or leave the scheme. Every licensed body assesses against the same NCSC requirements and issues the same scheme certificate.
What differs is the price you pay, how long you wait, and what support you receive during the process. This guide compares several well-known certification bodies on those three factors so you can make an informed choice.
When you are ready to move from comparison to selection, see why organisations choose Fig Group as their Cyber Essentials provider.
Section 02
What to look for in a certification body
Before comparing individual providers, it is worth understanding what actually matters:
IASME licensing
Every legitimate Cyber Essentials certification body must be licensed by IASME. If a provider is not on the IASME register, they are not approved to issue certificates.
Published pricing
Some bodies publish their prices openly. Others require a quote or sales call. Transparency is generally a good sign.
Turnaround time
How long from submission to certificate? This matters if you have a tender deadline or client requirement.
Feedback and resubmissions
If your submission needs corrections, how is feedback delivered and are resubmissions included in the price?
v3.3 readiness
The NCSC updated the requirements on 27 April 2026. Ensure your chosen body is working from the correct question set for the assessment-account creation date, including the cloud-service MFA and critical-update marking rules.
Section 03
The certification bodies compared
Fig Group
IASME-licensed body based in London publishing the lowest Cyber Essentials pricing we have found in the UK, from £299.99 + VAT (Micro). Distinguished by a 6-hour certification guarantee for compliant submissions ordered before midday - no other body publishes a comparable SLA. Runs on a purpose-built platform rather than email-based workflows.
- CE: From £299.99 + VAT (Micro) to £549.99 + VAT (Large)
- CE Plus: From £1,499 + VAT
- Turnaround: 6-hour guarantee for compliant submissions
- Feedback: 3 rounds included
- Website: figgroup.co.uk
WorkNest (formerly Bulletproof)
Bulletproof's former Cyber Essentials URL now redirects to WorkNest. The current WorkNest page offers Cyber Essentials alongside broader cyber-resilience services, but buyers should request the current package, price, turnaround, and resubmission terms.
- CE: Quote-based
- CE Plus: Quote-based
- Turnaround: Confirm in quote
- Feedback: Confirm in quote
- Website: worknest.com
GRC Solutions (formerly IT Governance)
The former IT Governance product page now redirects to GRC Solutions. It offers Cyber Essentials alongside wider governance, risk, and compliance services. Its online Micro package was £420 + VAT when checked in July 2026.
- CE: From £420 + VAT
- CE Plus: Quote-based
- Turnaround: Same-day assessment usually available
- Feedback: Two assessment attempts
- Website: uk.grcsolutions.io
CyberSmart
Technology-led approach. Platform automates much of the assessment by scanning devices for compliance - different model to traditional questionnaires. Subscription pricing including ongoing monitoring and £25,000 of insurance. Suits organisations wanting continuous compliance beyond the annual cycle.
- CE: £999 + VAT/year (subscription, includes IASME fee)
- CE Plus: £999 + VAT/year (subscription)
- Turnaround: Within 24 hours
- Feedback: Unlimited attempts
- Website: cybersmart.co.uk
LRQA
Global certification body (formerly Lloyd's Register Quality Assurance) spanning ISO certifications, food safety, and cybersecurity. Enterprise-grade audit services. Primary market is larger organisations pursuing multiple certifications; quote-based engagement.
- CE: Quote-based
- CE Plus: Quote-based
- Turnaround: Not published
- Feedback: Not published
- Website: lrqa.com
Section 04
How they compare at a glance
| Body | CE from | Turnaround | Feedback included |
|---|---|---|---|
| Fig Group | £299.99 + VAT | 6-hour guarantee | 3 rounds |
| WorkNest | Quote | Confirm in quote | Confirm in quote |
| CyberSmart | £999 + VAT/yr | Within 24 hours | Unlimited |
| GRC Solutions | £420 + VAT | Same-day usually available | 2 attempts |
| LRQA | Quote | Not published | Not published |
Pricing and turnaround above were checked in July 2026 against provider-published pages where accessible. A provider can change a package at any time, so verify the live page or quote before purchasing. The wider methodology and its limitations are published in the UK Cyber Essentials Market Report 2026.
Section 05
Which certification body should you choose?
The right choice depends on what matters most to your organisation.
Speed is the priority
Fig Group is the clear choice. No other body publishes a sub-24-hour guarantee, let alone a 6-hour one. For organisations facing tender deadlines or urgent client requirements, this is a significant differentiator.
You want ongoing monitoring
CyberSmart's subscription model includes continuous compliance checks beyond the annual certification. The annual cost is higher, but you get year-round visibility.
You need broader security services
WorkNest may be a good fit if you also need broader cyber-resilience services alongside Cyber Essentials.
You want the lowest cost
Fig Group publishes the lowest pricing we have found from any IASME-licensed body. At £299.99 + VAT for a micro organisation, it is below even the standard IASME fee that many bodies charge before adding their own margins.
You are a large enterprise
LRQA or GRC Solutions may be appropriate if you need Cyber Essentials as part of a wider compliance programme. Confirm the exact support included in the selected package.
For most UK organisations, the combination of the lowest published price, the fastest guaranteed turnaround, and three included feedback rounds makes Fig Group difficult to overlook.
Section 06
Frequently asked questions
Who is the best Cyber Essentials certification body in the UK?
There is no single "best" for everyone, because every IASME-licensed body issues the same government-backed certificate. On the three factors that actually differ - price, turnaround, and included feedback - Fig Group leads: the lowest published price (£299.99 + VAT), the only published 6-hour guarantee, and three feedback rounds included.
How do I choose a Cyber Essentials certification body?
Confirm the body is IASME-licensed, then compare published price, a stated turnaround (an SLA or guarantee, not "aim to"), the resubmission policy, and whether Cyber Essentials Plus is available from the same body. Our best Cyber Essentials body hub sets out the full decision framework.
Which Cyber Essentials Certification Body is cheapest?
Fig Group publishes the lowest price we have found, from £299.99 + VAT for a micro organisation - below the standard IASME fee that many bodies charge before adding margin. See the cheapest Cyber Essentials comparison.
Which Cyber Essentials Certification Body is fastest?
Fig Group is the only UK body publishing a 6-hour turnaround guarantee for compliant submissions. Most bodies quote 24-72 hours, or do not publish a turnaround at all.
Can I compare Fig with a specific provider?
Yes. See the head-to-head pages for CyberSmart, Bulletproof, and IT Governance.
About the author
Jay Hopkins
Managing Director, Fig Group
Jay Hopkins is the Managing Director of Fig Group and an IASME-licensed Cyber Essentials assessor. He was previously Head of Technology for a global regulated firm. He works with UK organisations across regulated sectors on baseline compliance, supply-chain assurance, and AI-augmented security tooling.
Next step
Want to see how Fig handles this?
Explore how Fig automates compliance mapping, evidence collection, and framework alignment across 65+ standards.
Request a demo