Not always. Many small businesses certify by answering the self-assessment themselves. A consultant is most useful when you are unsure what is in scope, or a gap needs technical work to fix.
Cyber Essentials consultant vs BrightCert
A consultant fixes the gaps. BrightCert shows you which gaps you have.
Good consultants are worth paying for when there is real work to do. BrightCert tells you, in about two hours and for £199, whether there is, and exactly where.
Why businesses check first
Paying for discovery
Published supported packages run from about £650 to £1,420 + VAT. Part of what you pay for is finding out what you have.
Not knowing what to ask for
Without a baseline, it is hard to judge a quote, or to know whether you need a day of help or an hour.
Three automatic fails
Since April 2026, missing MFA on cloud services and missed 14-day patching fail the assessment on their own. Find them before anyone is on the clock.
Side by side
| Feature | BrightCert | Consultant |
|---|---|---|
| Scored readiness across all five controlsBoth give you a picture of your gaps | ✓ | ✓ |
| Start today, self-serve, about 2 hoursConsultants are booked around their diary | ✓ | ◐ |
| Fixed, published priceConsultant work is usually quoted | £199 | ◐ |
| Hands-on fixes to your systemsBrightCert tells you what to fix; it does not log in and do it | ✗ | ✓ |
| Report you can share with your IT provider | ✓ | ◐ |
| CertificationSome consultants bundle it; BrightCert never certifies | ✗ | ◐ |
Prices from providers' own websites, checked 22 October 2026.
Better together, not either-or
Run BrightCert first and take the report to your consultant, Cyber Advisor or IT provider. Their time goes on fixing, not discovery, and you know what you are paying for.
How it works
- 01
Answer plain-English questions
About your devices, users, software and cloud services. Around two hours.
- 02
Get your scored gap report
A readiness score, gaps by control area, and fixes in priority order.
- 03
Fix, then certify
Yourself, with your IT provider or a consultant, then apply through any IASME Certification Body.
Frequently asked questions
Published examples we found range from about £650 to £1,420 + VAT for supported packages, and many consultants quote per job. The government's 2023 evaluation found the most common total spend to certify was £1,000, with micro businesses averaging £1,894.
For finding your gaps, often yes. For fixing them, no: BrightCert tells you what to change but does not make changes to your systems. Many businesses use both.
Many NCSC-assured Cyber Advisors offer a free 30-minute consultation for small and medium-sized businesses getting started with Cyber Essentials.
No. BrightCert is a readiness assessment. Certification comes from an IASME-licensed Certification Body, which you choose separately.
See where your business stands before you pay anyone to fix it.
Start your assessmentBrightCert provides readiness assessment only. Official certification comes from an IASME-licensed Certification Body.