Cyber Essentials FAQ. Everything buyers actually ask.

Fig Group prices Cyber Essentials from £299.99 + VAT for micro organisations (1–9 staff). Prices rise to £399.99 (Small), £449.99 (Medium), and £549.99 (Large). Every tier is below the standard IASME certification body fee.

CE Plus costs £1,499–£4,499 + VAT depending on organisation size. Micro £1,499, Small £1,999, Medium £2,799, Large £4,499. All Fig CE Plus prices exclude VAT and are transparent - no consultancy add-ons.

No. Fig includes three free re-submissions with every Cyber Essentials certification. Most certification bodies charge £100–£200 per re-submission. If you need more than three, we work with you to address readiness first.

Fig prices the Micro tier at £299.99 + VAT, which is already below the standard IASME fee. Separately, the NCSC sometimes funds free CE certifications for specific charity sectors via IASME - check availability at certification time.

Fig Cyber Essentials Micro at £299.99 + VAT for 1–9 staff. Below the standard IASME certification body fee. Three free re-submissions, 6-hour guarantee, IASME-licensed.

No. Fig Group publishes prices excluding VAT. UK VAT is added at checkout for UK-based organisations.

For Cyber Essentials Plus and larger corporate engagements, yes. For standard CE certifications the checkout flow uses Stripe card payment. Enterprise invoicing is available on request.

Every device and service used to access organisational data: laptops, desktops, phones, tablets, cloud services, home routers for remote workers (under v3.3), and corporate network equipment. Anything that does not access organisational data is not in scope.

Personal devices that access organisational data are in scope. You can exclude them with a sub-set (technical enforcement that the device accesses nothing). Policy-only BYOD restrictions do not meet v3.3 - you need technical controls, typically MDM or virtual desktop.

Under v3.3, yes - for remote workers. The admin password must be changed from default, firmware must be current. The common solution is a corporate VPN: the firm's VPN gateway becomes the boundary, and the home router is effectively just a transit device.

Yes. SaaS, IaaS, and PaaS that hold organisational data are in scope. You must document how cloud services are configured securely (MFA, access control, secure defaults). v3.3 is explicit about this.

For SaaS companies: typically no. Scope CE to the corporate estate only (laptops, M365, corporate SaaS) and explicitly exclude production AWS. Production security is separately assessed under SOC 2, ISO 27001, or ISO 27017.

If contractors access your organisational data from their own devices, their devices are in scope. You can exclude them with a sub-set (virtual desktop or MDM) or bring them into scope with corporate-issued devices.

Any security update classified as "high" or "critical" by the vendor must be applied within 14 days of release. Applies to operating systems, applications, firmware, and internet-facing services. Monthly patching cycles do not meet v3.3.

Yes. Windows Defender with tamper protection enabled is the most common malware protection for UK organisations certifying under CE. The assessor checks that it is enabled, updated, and that on-access scanning works.

Yes. macOS is fully supported. Apple's built-in XProtect, Gatekeeper, and the System Integrity Protection satisfy the malware-protection control. Ensure FileVault is on and the device is current.

If Linux endpoints or servers access organisational data, yes. The same five controls apply - firewall, secure configuration, access control, malware protection (ClamAV or equivalent), and patch management.

Not strictly. v3.3 requires malware protection, which Windows Defender meets. EDR (Defender for Business, CrowdStrike, SentinelOne) exceeds the bar and is common in MSP and enterprise contexts.

Once per audit cycle for Cyber Essentials Plus. The external scan targets public-facing IP addresses and domains, checks TLS configuration, looks for exposed management interfaces, and flags out-of-date services. Findings must be remediated before certification issue.

Yes. Fig Group is an IASME-licensed Cyber Essentials Certification Body. The licence is 325cdf33-3812-4082-bf8d-7dce7ac02977. It is listed on the IASME directory and referenced from the trust evidence page and the footer of every page on figgroup.co.uk.

London. Our registered office is at 167-169 Great Portland Street, 5th Floor, London W1W 5PF. Fig Group is registered in England and Wales as The Fig Group Limited, Company No. 16845978.

The Fig Group Limited is registered at Companies House under number 16845978 and was incorporated on 10th November 2025. Full filings are public on gov.uk at find-and-update.company-information.service.gov.uk/company/16845978.

Jay Hopkins. He is an IASME-licensed Cyber Essentials and Cyber Assurance assessor. LinkedIn: linkedin.com/in/jayhopkins.

No. Fig Group runs a connected compliance and resilience platform covering 65+ frameworks, plus Cyber Essentials and Defence Cyber Certification as IASME-licensed services. The platform serves MSPs and corporate risk teams.

Yes. Fig Group's MSP model is white-label, multi-tenant, and includes Cyber Essentials reselling. Typical MSP margin uplift is 3–5x compared to delivering CE manually. See /msp.

Yes. Fig Group is an IASME-licensed Defence Cyber Certification body at Level 0 and Level 1. See /defence-cyber-certification for MOD supplier readiness information.