A low price is fine. Not knowing what it contains is not

Cheap Cyber Essentials › Checking a cheap provider

Cheap Cyber Essentials is not automatically a problem. The assessment fee goes to IASME either way, the certificate is the same certificate, and a provider with low overheads and no sales team can legitimately charge less than one with both.

The problem is ambiguity. Two listings at similar prices can be entirely different products, and the difference is never in the headline number. It is in who issues the certificate, who reads your submission, what happens if it does not pass, and whether the price you are looking at is annual or one-off. Six questions settle all of it, and every one of them can be answered in writing before you pay anything.

1. Are they a certification body, or selling on behalf of one?

Cyber Essentials certificates are issued by Certification Bodies appointed by IASME, which runs the scheme on behalf of the NCSC. Plenty of organisations sell Cyber Essentials without being one, passing the submission to an appointed body behind the scenes. That is a legitimate business model and it is not inherently worse, but you should know which you are dealing with, because it determines who you are actually contracting with and who controls the timeline.

Check it directly. IASME publishes a searchable list of Certification Bodies. Search the exact legal entity name that appears on the quote, not the trading name on the website, because those differ more often than you would expect and the difference is where confusion lives.

If they are not listed, the follow-up question is simple: which appointed body will issue the certificate, and are you contracting with them or with the reseller? Neither answer is disqualifying. A vague answer to a direct question is a different matter.

2. Who actually reviews the submission?

This is the question that separates products most sharply, and it is increasingly worth asking explicitly.

The scheme works because a qualified assessor reads what you wrote and judges whether it meets the five controls. A submission run through an automated checker or a language model is faster and cheaper to process, and it is not the same thing: it cannot reliably tell a compliant answer from a plausible one, and the entire value of the certificate to the person asking you for it rests on somebody competent having read it.

Ask directly. Is every submission reviewed by a qualified human assessor, or is any part of the review automated? Get the answer in writing. Every Cyber Essentials submission we assess is reviewed by a qualified assessor and none of them are reviewed by a model, and any certification body should be willing to say the same in a sentence.

3. What happens on a fail?

Cyber Essentials is pass or fail against five technical controls. There is no partial credit, so the handling of a fail is a material part of what you are buying, and it is almost never described on a pricing page.

Three things to establish. What feedback do you receive, specifically: a list of which questions did not meet the standard, or a general statement that the submission was unsuccessful? Who explains it to you, and is that conversation chargeable? And is there a limit on how much of it you get?

The difference between a useful fail and a useless one is entirely in the feedback. A provider who tells you which answers fell short and why has given you a route to a pass. One who tells you the submission was unsuccessful and offers to sell you remediation consultancy has given you a sales call.

4. Is resubmission included, and within what window?

Under current scheme rules a failed submission gets one free resubmission within a limited window. That is a scheme provision rather than a provider's generosity, so the questions to ask are about the practicalities rather than the existence of it.

How long is the window, exactly, and when does the clock start? What happens if you need longer than that because the fix involves replacing hardware or waiting on a supplier? And if the window is missed, what does starting again cost: the full fee, or a reduced one?

That last answer is the one to have before you need it. The gap between "you resubmit at no charge" and "you buy the assessment again" is the whole tier fee, and it is not a conversation you want to have for the first time after a fail.

5. Is this a certificate or a subscription?

Some of the most attractive headline prices are annual subscriptions to a compliance platform with the certificate bundled in. That is a real product and it suits organisations that will use the monitoring, the policy templates and the ongoing dashboard.

It is the wrong purchase for an organisation that needs a certificate for a tender, because the subscription continues after the need has passed, and the exit is rarely as simple as not renewing. Four questions settle it. Is the price annual or one-off? Is there a minimum term? Does the certificate remain valid if you cancel the subscription? And what is the price of the assessment alone, without the platform?

A provider selling a platform will answer all four without difficulty, because it is a legitimate product they are proud of. Difficulty answering the fourth is the signal.

6. What is the stated turnaround, and what is it measured from?

Turnaround claims are usually true and frequently measured from a point you were not expecting. The useful question is what happens between you clicking submit and a certificate existing, and specifically whether anything sits in a queue at an intermediary.

Our standard is an assessment inside one business day from the point you submit, and a same-day review with the urgent option if the submission lands before midday. We can commit to that because we issue the certificate ourselves rather than passing it to somebody else's queue. A provider who is not an appointed body is dependent on whoever is, and their turnaround claim is only as good as the arrangement behind it.

The summary, as a table

What to ask, and what a poor answer looks like

Question	A poor answer
Are you an appointed IASME Certification Body?	Anything other than yes or a clear no with the name of the body that is
Does a qualified human assessor review every submission?	"Our platform handles it", or a description of the technology instead of the person
What feedback do we get on a fail?	An offer of paid consultancy in place of an answer
Is resubmission included and how long is the window?	"We will look after you", without a number
Is the price annual or one-off?	Any hesitation, or a monthly figure where you asked for a total
Who issues the certificate and how long does it take?	A turnaround figure with no explanation of who the work passes through

What is not a red flag

Worth saying, because vigilance overshoots easily and there are several things that look suspicious and are not.

A low price on its own is not one. The assessment fee is set by IASME tier, and a provider who does not mark it up is charging less for a reason that reflects well on them rather than badly.

A small provider is not one. Certification Body status is the same status whatever the size of the company holding it, and a small body may well answer the phone faster.

Not offering Cyber Essentials Plus is not one either. Plus requires a separate assessor qualification and a hands-on technical audit. We assess Cyber Essentials Plus from late October 2026, and until then we say so plainly rather than describing it as available.

And a provider who tells you that you do not need the optional help they sell is not being careless with their own revenue. They are answering the question you asked.

Get it in writing, and keep it

Every one of these questions can be answered in a short email. Ask them in one message before you pay, and keep the reply. It takes ten minutes, it costs nothing, and it converts a price into a description of what you are actually buying.

A provider who answers all six clearly and quickly has told you a great deal about what working with them is like. So has one who answers three of them and offers a call to discuss the others.