Can you buy Cyber Essentials directly from IASME? (2026)

Can you buy Cyber Essentials directly from IASME? (2026)

IASME is the NCSC-appointed scheme operator - the organisation that designs, maintains, and governs the Cyber Essentials scheme. IASME does not typically deliver certification assessments directly to end-customers; assessments are performed by IASME-licensed certification bodies (CBs) like Fig Group. You can buy through any of the hundreds of licensed CBs and receive the same IASME-issued certificate. The price, speed, and service experience vary by CB; the certificate does not.

What IASME does

• Runs the Cyber Essentials scheme on behalf of the National Cyber Security Centre (NCSC)
• Writes and updates the scheme requirements (currently v3.3 as of 2026)
• Licences certification bodies and supervises their quality
• Maintains the directory of licensed CBs
• Issues the certificate itself once a CB approves an assessment
• Audits certification bodies and handles customer complaints

What certification bodies (CBs) do

• Perform the assessment - review your self-assessment questions and evidence
• For CE Plus, conduct the vulnerability testing
• Pass approved assessments to IASME, who issues the certificate

Fig Group is one such IASME-licensed CB. Our licence number is 325cdf33-3812-4082-bf8d-7dce7ac02977 - verifiable directly on the IASME directory.

Can you certify direct through IASME itself?

IASME's public-facing offering is the directory and scheme documentation. While IASME operates a small set of assessment services (for particular programmes, defence partners, and certain specialist needs), the standard route for UK SMEs is through a licensed CB. You will get the same certificate either way.

Does price differ between CBs?

Yes - substantially. CBs set their own commercial terms. Published prices for Micro-tier Cyber Essentials range from around £300 + VAT (Fig Group) to £800+ through consultancy-led bodies. The IASME-issued certificate is identical regardless of how much you paid.

Does speed differ between CBs?

Yes. Turnaround ranges from hours to weeks depending on the CB:

• Platform-first bodies (e.g. Fig Group) offer 6-working-hour SLAs on clean Micro-tier submissions
• Consultancy-led bodies typically take 1–3 weeks depending on their internal workflow

Ask any CB for their SLA in writing before paying.

What is the same across all CBs?

• The certificate: IASME-issued, 12-month validity
• The directory listing: your certificate appears on the IASME directory
• The scheme requirements: v3.3 as of 2026 - all CBs test to the same standard
• Acceptance: by UK government tenders, insurers, and supply chains - no procurement team cares which CB issued your certificate, only that it's on the directory and in date

How to pick a CB

1. Verify the licence on the IASME directory. This is non-negotiable.

2. Get the price in writing with VAT shown.

3. Ask for an SLA - submission to review.

4. Ask about resubmission policy if the first review fails.

5. Ask about bundled extras - some CBs include insurance (Fig does: £25k), training, or monitoring.

Bottom line

You cannot typically buy Cyber Essentials direct from IASME; you buy through a licensed CB. The certificate is identical across all licensed CBs - what varies is price, speed, and bundled extras. Fig Group offers £299.99 + VAT for Micro, a 6-working-hour SLA, and £25k bundled cyber insurance.

Start Cyber Essentials - from £299.99 + VAT | All pricing tiers | Verify our IASME licence