Can you buy Cyber Essentials directly from IASME? (2026)

IASME is the NCSC-appointed scheme operator - the organisation that designs, maintains, and governs the Cyber Essentials scheme. IASME does not typically deliver certification assessments directly to end-customers; assessments are performed by IASME-licensed certification bodies (CBs) like Fig Group. You can buy through any of the hundreds of licensed CBs and receive the same IASME-issued certificate. The price, speed, and service experience vary by CB; the certificate does not.

• Runs the Cyber Essentials scheme on behalf of the National Cyber Security Centre (NCSC)
• Writes and updates the scheme requirements (currently v3.3 as of 2026)
• Licences certification bodies and supervises their quality
• Maintains the directory of licensed CBs
• Issues the certificate itself once a CB approves an assessment
• Audits certification bodies and handles customer complaints

• Perform the assessment - review your self-assessment questions and evidence
• For CE Plus, conduct the vulnerability testing
• Pass approved assessments to IASME, who issues the certificate

Fig Group is one such IASME-licensed CB. Our licence is verifiable directly on the IASME directory.

IASME's public-facing offering is the directory and scheme documentation. While IASME operates a small set of assessment services (for particular programmes, defence partners, and certain specialist needs), the standard route for UK SMEs is through a licensed CB. You will get the same certificate either way.

Yes - substantially. CBs set their own commercial terms. Published prices for Micro-tier Cyber Essentials range from around £300 + VAT (Fig Group) to £800+ through consultancy-led bodies. The IASME-issued certificate is identical regardless of how much you paid.

Yes. Turnaround ranges from hours to weeks depending on the CB:

• Platform-first bodies (e.g. Fig Group) offer 6-working-hour SLAs on clean Micro-tier submissions
• Consultancy-led bodies typically take 1-3 weeks depending on their internal workflow

Ask any CB for their SLA in writing before paying.

• The certificate: IASME-issued, 12-month validity
• The directory listing: your certificate appears on the IASME directory
• The scheme requirements: v3.3 as of 2026 - all CBs test to the same standard
• Acceptance: by UK government tenders, insurers, and supply chains - no procurement team cares which CB issued your certificate, only that it's on the directory and in date

1. Verify the licence on the IASME directory. This is non-negotiable.

2. Get the price in writing with VAT shown.

3. Ask for an SLA - submission to review.

4. Ask about resubmission policy if the first review fails.

5. Ask about additional services - some CBs offer training or monitoring. Any eligible cyber-liability benefit is arranged separately at scheme level by IASME and its insurance partner.

You cannot typically buy Cyber Essentials direct from IASME; you buy through a licensed CB. The certificate is identical across all licensed CBs - what varies is price, speed, and additional services. Fig Group offers £299.99 + VAT for Micro, a 6-working-hour SLA, and insurer-grade compliance evidence exports. Any eligible cyber-liability benefit is arranged separately by IASME and its insurance partner; Fig does not provide or arrange it.

Start Cyber Essentials - from £299.99 + VAT | All pricing tiers | Verify our IASME licence