Cyber Essentials readiness: every route compared (UK, 2026)

The options at a glance

1. IASME’s free Readiness Tool

The official starting point. The NCSC describes it as a free tool that gives you “a tailored action plan that will help you prepare for Cyber Essentials certification.” It is built by IASME, the scheme’s delivery partner, so the questions track the real scheme.

It is a learning tool rather than an assessment: it does not score you or review your answers, and IASME does not store the plan, so download it before you close the page.

Price: free. Best for: a first look at what is involved. We compare it with BrightCert in more detail in IASME’s Readiness Tool vs BrightCert.

2. An NCSC-assured Cyber Advisor

Cyber Advisors are assessed against NCSC standards and work for an assured service provider. In the NCSC’s words, an advisor “will first identify gaps in your cyber security before recommending how your organisation can best address them,” and can provide hands-on support.

The NCSC says many advisors now offer a free 30-minute consultation for small and medium-sized businesses getting started with Cyber Essentials. Anything beyond that is quoted: “There is no recommended price for assured Cyber Advisors to charge.”

Price: free first call at many advisors, then quoted. Best for: businesses that want an expert to help fix gaps, not just find them.

3. A consultant or supported package

Many IT and security firms sell a gap analysis or a supported route, often bundled with the certification itself. Published examples we found on providers’ own sites include a supported package with “pre-submission review and gap analysis feedback” at £650 + VAT, and tiers from £720 + VAT (with a gap analysis) up to £1,420 + VAT (with up to a day of consultancy).

For context on total cost, the government’s 2023 evaluation of the scheme found a mean total spend of £4,941 to certify, including the assessment, the work needed to qualify and any new equipment. That average is pulled up by large organisations: the most common answer was £1,000, and micro businesses averaged £1,894.

Best for: businesses that want someone else to lead the process. See consultant vs BrightCert, side by side, and our full guide to Cyber Essentials costs.

4. CyberSmart

CyberSmart is a Certification Body that sells Cyber Essentials on a subscription platform. Its Cyber Essentials page lists free unlimited resubmissions and £25,000 of cyber insurance for eligible organisations, and its Active Protect subscription adds endpoint monitoring and management.

Price:quoted. Its plans page says fees “depend on organisation size and start from £675+VAT” and that “all of our plans are subscription only.” Best for: businesses that want certification and ongoing device monitoring from one supplier. See CyberSmart vs BrightCert.

5. Fig Group

Fig Group is an IASME-licensed Certification Body focused on speed: it says compliant submissions are certified “within 6 working hours”, with a refund guarantee for complete, compliant submissions received before midday on a business day, and three free rounds of assessor feedback. It also sells the Fig Platform, a compliance subscription.

Price: published one-off assessment fees from £299.99 + VAT for a micro business up to £549.99 + VAT for large organisations. Fig notes that preparation time is separate. Best for: businesses that are already prepared and want certification quickly.

6. Doing it yourself

You can preview the official question set free, then register, pay and complete the verified self-assessment, which is signed off by a board member and marked by an assessor. The NCSC lists certification as “starting at £320 +VAT”, and UK organisations with turnover under £20m that certify their whole organisation are entitled to cyber liability insurance with a £25,000 limit.

Best for: businesses with confident in-house IT. The question set tells you what is asked, not how to fix what you find. Our guide to the self-assessment questions covers what to prepare.

7. Your IT provider

If you already have an IT provider, they know your systems and can often fix gaps quickly. One question worth asking is whether they are an NCSC Assured Service Provider, which is what employing a Cyber Advisor requires.

Where BrightCert fits

BrightCert is a readiness assessment, not a Certification Body. You answer plain-English questions across the five control areas, in around two hours, and get a readiness score, gap findings and prioritised fixes. The assessment is free to complete; the full report is £199.

It works on its own or alongside any of the routes above: take the report to a Cyber Advisor, a consultant or your IT provider, and the first conversation starts from your actual gaps rather than from discovery. You then certify with whichever Certification Body you prefer.

Which route is right for you?

• Just exploring:start with IASME’s free tool.
• Want an expert to help fix things: book a free call with a Cyber Advisor.
• Want someone else to lead: a consultant or supported package.
• Already prepared and short on time: a fast Certification Body.
• Want to know exactly where you stand before paying for help or certification: a scored readiness assessment such as BrightCert.