Is Cyber Essentials a legal requirement?

It is not a general legal requirement, but it is contractually mandatory for UK central government contracts handling personal or sensitive information, and is required by most public sector frameworks (G-Cloud, DOS, MoD, NHS Digital). Many private sector buyers also require it as a tender pre-qualifier.

Who issues the Cyber Essentials certificate?

Certificates are issued by IASME-licensed Certification Bodies. IASME is the sole UK partner appointed by the NCSC to run the scheme. NixInfinity-AI is an IASME-licensed Certification Body, so we review and issue your certificate directly.

How long is Cyber Essentials valid?

12 months from the date of issue. We recommend starting renewal at least one month before expiry to avoid lapses, especially if your tender or insurance depends on continuous certification.

Is Cyber Essentials the same as ISO 27001?

No. Cyber Essentials is a focused technical control baseline. ISO 27001 is a broader information security management system. See our comparison guide for the differences.

Can I do Cyber Essentials myself without a provider?

Technically you can submit directly via the IASME portal, but you still need an IASME-licensed Certification Body to review and issue the certificate. Most organisations work with an assessor to avoid first-time failure (around 1 in 4 self-submitted applications fail on first attempt).

How much does Cyber Essentials cost?

£320 + VAT for organisations with 1–9 staff, scaling to £600 + VAT for 250+ staff. See our cost guide for a full breakdown.

What is Cyber Essentials? Plain-English Explainer | NixInfinity-AI

Cyber Essentials in plain English

Cyber Essentials is a UK government scheme that gives organisations a recognised certificate proving they meet a baseline of cyber hygiene. It was created by the National Cyber Security Centre (NCSC) and is run on the NCSC's behalf by IASME, the sole accreditation body. Every UK Cyber Essentials certificate – including ours – is issued through an IASME-licensed Certification Body.

The two levels

Cyber Essentials – self-assessment reviewed and verified by an IASME-licensed assessor. £320 + VAT.
Cyber Essentials Plus – everything in CE plus a hands-on technical audit and vulnerability scan. £1,400 + VAT.

The five technical controls

Both levels test the same five technical controls: firewalls, secure configuration, user access control, malware protection and patch management. The 2026 question set (Danzell, in force since 27 April 2026) updated MFA, patching and cloud requirements – see our Danzell 2026 explainer.

Who needs it?

Cyber Essentials has been mandatory for UK central government contracts handling sensitive information since 2014, and it is now a baseline requirement for most public sector frameworks (G-Cloud, DOS, MoD, NHS Digital, local authorities). It is also widely used by SMEs to win private sector tenders, satisfy cyber insurance, and reassure customers. See who needs Cyber Essentials.

How long does it take?

A prepared organisation can certify in 24 hours. Most clients certify within 1–2 weeks. CE Plus typically takes 2–4 weeks because of the technical audit. See our full timeline guide.

Why work with an IASME-licensed Certification Body

Only IASME-licensed Certification Bodies can issue Cyber Essentials certificates in the UK. As a licensed CB, NixInfinity-AI reviews your submission and issues the certificate ourselves – there is no third-party handover, which is why we can offer 24-hour turnaround for prepared organisations.