Can we say 'our platform is Cyber Essentials approved'?

No. The scheme certifies organisations against a scope. It has no concept of product approval. Use 'our organisation is certified for the scoped environment that delivers this platform'.

Can we use the IASME / NCSC logos?

Use them according to the brand guidelines you receive on certification. The CE badge can be used while the certificate is current; remove it on expiry until re-certified.

Do we need to publish our scope wording?

Not mandatory, but strongly recommended. It avoids buyer assumptions and protects you in tenders and audits.

What if a sales person has already overclaimed?

Correct it in writing as soon as you become aware, update the public-facing copy, and brief the sales team. Document the correction – it matters if a buyer or regulator asks later.

How VDI, SaaS and MSP Providers Can Market Cyber Essentials Honestly

Why marketing language matters

Procurement teams, insurers and regulators read CE statements literally. Overclaiming on a website or in a sales deck can amount to misrepresentation, distorts competition, and undermines trust in the scheme. The fix is straightforward: say what the certificate says, no more, no less.

Safe wording – use these

"[Provider] is Cyber Essentials certified for the scoped IT environment described on our certificate."
"Our hosted desktop platform is delivered from infrastructure within our Cyber Essentials scope."
"Our administrator endpoints and engineer accounts fall within our Cyber Essentials certification."
"Customers remain responsible for certifying their own end-user devices and identities."

Risky wording – avoid these

"Our product is Cyber Essentials approved." (The scheme has no product approval.)
"All our customers are Cyber Essentials certified through our service." (Untrue.)
"Our platform is fully compliant – nothing more to do." (Misleading.)
"100% certified across our customer base." (Unverifiable.)

Website copy guidance

Show the badge alongside the certificate scope, not in isolation
Link to the certificate on the IASME register where possible
State explicitly what customers are still responsible for
Pair the claim with the date of certification and expiry

Sales proposal wording

A proposal should contain:

A short statement of certification status
The exact scope sentence from the certificate
A shared responsibility note
The certificate PDF as an appendix

Procurement response wording

When asked "are you Cyber Essentials certified?", answer in three parts:

Yes/No – with current expiry date
Scope – verbatim from the certificate
Shared responsibility – what remains with the buyer

How to handle CE Plus claims

The same rules apply, with one addition: CE Plus involves technical testing of the scoped environment – it does not "approve" the product. See CE Plus in virtualised and cloud environments.

Sales team briefing checklist

Sales reps must not improvise around the scope wording
Any new market-facing copy goes through compliance review
Anyone using the badge must know what it does and does not cover
Insurance, financial services and public sector tenders deserve extra care – misstatements there can have regulatory consequences

For why this matters in detail, see your certificate does not cover your customers.