IT Governance review: Cyber Essentials in 2026

IT Governance review: Cyber Essentials in 2026

IT Governance (part of GRC International Group) is one of the UK's largest compliance-training and consultancy firms, and an IASME-licensed Cyber Essentials body. They are reputable, mature, and particularly strong for organisations that are also buying training, ISO 27001 consultancy, or book/reference material. Fig Group differentiates on price, speed, and delivery model - lowest published UK price, 6-working-hour SLA, and platform-first self-serve.

Who IT Governance is

• Founded: 2002, Ely, Cambridgeshire
• Part of: GRC International Group Plc (LON:GRC)
• IASME-licensed: yes - on the IASME directory
• Scope: Cyber Essentials, CE Plus, ISO 27001 training / consultancy / certification, GDPR, DPO-as-a-service, publishing
• Brand strength: significant - they sit at the top of search results for many compliance keywords thanks to years of content investment

IT Governance's reputation and training offer is genuinely strong. For buyers who weight brand recognition or want training alongside certification, they are a defensible choice.

Pricing and turnaround

IT Governance publishes Cyber Essentials pricing on its website in tiered packages. Expect published starting prices materially above Fig Group's £299.99 + VAT Micro tier. Turnaround is business-hours rather than hour-clocked. For current pricing, see itgovernance.co.uk - any review is a snapshot.

Where IT Governance makes sense

• You want training and certification from one supplier. Their BCS-accredited courses are a recognised training route in the UK.
• You are building an ISO 27001 programme. Their toolkits and consultancy have depth.
• You prefer an established, brand-recognised supplier. Their scale is a data point for some procurement processes.

Where Fig Group positions differently

1. Published £299.99 + VAT floor price on the Micro tier. No sales conversation required to get pricing - everything is on our pricing page.

2. 6-working-hour certification SLA on clean Micro submissions. Unusual in the UK market.

3. Platform + AI-augmented delivery rather than consultant-heavy. Lower labour cost per certificate, passed to you.

4. Verifiable licence - 325cdf33-3812-4082-bf8d-7dce7ac02977 on the IASME directory.

The certificate is identical

An IT Governance-issued Cyber Essentials certificate and a Fig-issued certificate come from the same scheme, with the same 12-month validity, the same IASME directory listing, and the same acceptance by buyers and insurers. The commercial path differs.

When to consider switching

• You do not need training bundled with the certification
• You want a lower, fixed, published price
• You have a certification deadline in hours or days, not weeks

Due-diligence checklist

Before paying any certification body:

1. IASME licence verified on the IASME directory

2. Price in writing with VAT

3. Turnaround SLA explicit in writing

4. Resubmission policy and any additional-charge clause

5. Scope statement - staff count, device categories, geographies

Bottom line

IT Governance is one of the most established names in UK cyber and compliance training. If their training and ISO 27001 offer is what you need, the premium can make sense. If you want the lowest-price, fastest IASME-licensed route, Fig Group is a straightforward alternative at £299.99 + VAT. The IASME-arranged £25k cyber liability cover ships with any valid CE certificate where eligibility criteria are met, regardless of which IASME-licensed body issues it.

Start Cyber Essentials with Fig - from £299.99 + VAT | All pricing tiers | IT Governance comparison