How Cyber Essentials certification works

Cyber Essentials is certified through an online verified self-assessment. You apply and pay, answer the question set about your organisation and its IT, and a board member or equivalent signs a declaration that the answers are accurate. An assessor at an IASME-licensed Certification Body then marks the submission. If it passes, the certificate is issued straight away. If the assessor has questions or the submission fails, you put things right and resubmit. How long you have depends on who certifies you: 2 working days if you certify directly with IASME, or up to the end of the six months your assessment is open if you certify with Apexward Group through CyberEssentials.AI.

Step by step

1. Prepare

Before you apply, decide your scope and check your IT against the five controls. Most of the work happens here, not in the questionnaire.

• Decide whether you are certifying the whole organisation or a segregated sub-set. See Whole organisation or a sub-set.
• List your devices, operating systems and versions, network equipment, software and cloud services, including personal devices that reach work data.
• Fix gaps first: unsupported software, missing updates, MFA not switched on, shared or admin accounts used for everyday work.

2. Apply

You register and pay for the assessment through IASME, either directly or through a Certification Body. The fee depends on the size of your organisation. See Cyber Essentials fees. Once your account is created, you have six months to complete and pass the assessment. After that the account is closed and you would need to start again.

The question set that applies is the one current when your account is created. For accounts created from 27 April 2026 that is Danzell, under Requirements v3.3.

3. Answer the questions

The question set starts with your organisation and scope, then works through firewalls, secure configuration, security updates, user access and malware protection. Good answers are specific: name the products, versions and settings, and say who does what. Vague answers such as "yes" or "we use antivirus" tend to be queried. See How to answer the questions.

You can save and come back. If an IT provider manages your systems, you can work through the answers with them, but your organisation is still responsible for what is submitted.

4. Sign the declaration

Before submitting, a board-level representative, business owner or equivalent must sign a declaration that the answers are true. This is a personal sign-off, so the person signing should have checked the answers, not just approved the invoice.

5. Marking

An assessor at the Certification Body reviews your answers. IASME says this normally happens within 3 working days. The assessor marks each answer against the requirements and may ask for more detail where an answer is unclear.

• Query: if the assessor needs more information, you answer and resubmit.
• Fail: if an answer shows a requirement is not met, you fix the issue, update the answers and resubmit.
• Time to respond: 2 working days if you certify directly with IASME. With Apexward Group through CyberEssentials.AI, you can respond at any point in the six months your assessment is open.
• Each resubmission is reviewed in the same way.

Some answers are automatic fails under Danzell, such as a cloud service with MFA available but not enabled. See Automatic fail questions.

6. Certificate

When you pass, the certificate is issued immediately and appears on IASME's public register. It is valid for 12 months and reflects your position on the date it was issued. You will also get a digital badge for your website.

7. Included cyber insurance

UK-domiciled organisations that certify their whole organisation, with an annual turnover under £20 million, are entitled to the cyber liability insurance included with certification. The policy documents are sent by email after you pass. Read them to understand the cover and any conditions. If you certify only a sub-set, the insurance is not included.

How long it takes

The marking itself is quick. The time that varies is preparation: a small office with a few laptops and Microsoft 365 might be ready in days, while an organisation with old devices, many cloud services or personal devices in use can need weeks of remediation first.

After certification

Keep the controls running. Updates still need to go on within 14 days, new staff and new cloud services need MFA, and leavers need removing. Plan your renewal before the 12 months are up. See Certificate validity and renewal. If you need Plus, it must be completed within three months of this certificate. See The three-month window for Plus.

Checklist before you submit

• Scope described clearly, with any excluded parts named
• Every operating system version listed, and all of them supported
• MFA on for every cloud service that offers it
• Updates current and automatic where possible
• Answers specific, accurate and checked by the person signing

To find gaps before you apply, use the readiness checker.