Frequently asked questions

Get Cyber Certified is the trading name of Data Security and Compliance Services Ltd, a specialist cyber security certification and compliance firm based in South Yorkshire. We operate as licenced and assured assessors on behalf of IASME and the UK Government's National Cyber Security Centre (NCSC), helping organisations of all sizes — from sole traders through to large enterprises — achieve and maintain Cyber Essentials and Cyber Assurance certification.

We've been certifying since 2014, and in that time we've built a reputation for making what can feel like a complex and daunting process as straightforward and stress-free as possible. Our team brings real-world expertise to every assessment, and we're proud that no client who has taken our Supported service and followed our guidance has ever failed their assessment.

Whether you're coming to us for the first time or renewing an existing certification, you'll find us approachable, knowledgeable, and genuinely invested in helping your organisation succeed.

What are your company details?

We are registered in England and Wales. If you need to verify our company details independently, you can do so at any time via Companies House.

How do I get in touch?

We're always happy to hear from you — whether you have a question before you get started, need help part way through your assessment, or simply want to talk through which service is right for you.

• 📧 Email: team@getcybercertified.co.uk
• 📞 Phone: 0333 339 0383
• 📅 Book a meeting with your assessor: Click here to arrange a time
• 📚 Resource Hub: Visit our guidance area for self-help materials and assessor guidance

We aim to respond to all enquiries promptly during normal business hours.

What assessment services do you offer, and how much do they cost?

We offer a range of Cyber Essentials and Cyber Assurance services to suit different organisations, budgets, and levels of support needed. Whether you're confident you'll sail through and just need a straightforward marking service, or you'd prefer a fully guided and supported experience, we have an option for you.

All of our services are available to browse and purchase directly through our online shop. Our current services and prices are listed below for your convenience:

🔄 Changing from Marking Only to a Supported Service: if you start on Marking Only and later decide you'd like our support, the cost is the price difference between the Marking Only service and the corresponding Supported Service, plus a £50 admin fee to process the change of service.

📄 Duplicate certificates: define each additional organisation within your assessment. Once you pass, a duplicate certificate costs £10, paid directly to IASME using the link in your pass email.

✅ All prices are exclusive of VAT.

💳 Payment is required in advance — we do not offer credit terms.

🔒 We will never raise a charge or invoice without your prior authorisation via a formal written quote. You will always know exactly what you're agreeing to before any payment is taken.

For the most up-to-date pricing and full service descriptions, please visit our shop. If you're unsure which service is right for you, please don't hesitate to get in touch — we're happy to guide you.

Do you offer consultancy or bespoke workshop sessions?

Yes, absolutely. In addition to our standard assessment and marking services, we offer tailored consultancy and workshop sessions for organisations who need a more hands-on level of support. This might include help preparing for an upcoming assessment, training your internal IT team, working through specific compliance challenges, or running a structured session for your wider staff.

Our consultancy and workshop sessions are priced as follows:

Site Visits

We're happy to come to you. However, please be aware that travel to and from your site is not included in the above rates and will be charged separately:

• Travel time: £80.00 per hour
• Expenses: Reasonable out-of-pocket travel expenses (e.g. mileage, accommodation where required) will be charged at cost
  

✅ All prices are exclusive of VAT.

💳 Payment is required in advance — we do not offer credit terms.

🔒 We will never raise a charge or invoice without your prior authorisation via a formal written quote. The only exception to advance payment is travel costs, which by their nature can only be confirmed after the visit.

To enquire about booking a consultancy or workshop session, please contact us or call 0333 339 0383 and we'll be happy to put a formal quote together for you.

What standards of service can I expect from Get Cyber Certified?

We genuinely care about the experience every client has with us, and we want your journey through the certification process to be as positive and straightforward as possible. Below you'll find an honest and transparent overview of how we work, what you can expect from us, and what we ask of you in return.

Our Commitment to You

At Get Cyber Certified, we are committed to treating every client with courtesy, professionalism, and respect — regardless of the size of your organisation, your level of technical knowledge, or where you are in the certification process. We know that cyber security can feel overwhelming at times, and we're here to help, not to judge.

We are proud of the relationships we build with our clients, many of whom return to us year after year for their renewals. That trust means everything to us, and it's something we work hard to maintain in every interaction.

In turn, we ask that our team are treated with the same level of respect and courtesy. We have a zero tolerance policy towards threatening, abusive, or aggressive behaviour of any kind directed at any member of our team — whether in person, over the phone, or in written communications. In the event that this policy is breached, we reserve the right to cease all work immediately and without the issuance of a refund. This is not something we ever anticipate needing to enforce, and we share it here simply to ensure complete transparency for all parties.

Response Times & Email Support

We aim to respond to all email enquiries within 48 hours during normal business days. In practice, we're often much quicker than this, but we want to set a realistic expectation rather than one we can't always honour.

Please be aware that the level of email and telephone support available to you will depend on the service you have purchased:

• Supported Service clients have access to full email and telephone support throughout their assessment, including technical guidance, answer review, and direct assessor contact.
• Marking Only service clients are entitled to email support for the specific purpose of assistance with logging into and navigating the marking portal only. General technical support, guidance on answers, and assessment queries fall outside the scope of the Marking Only service.
  

If you find that you need more support than the Marking Only service provides, please do get in touch — we can discuss upgrading your service, subject to our standard amendment fee.

Our Marking & Turnaround Times

We operate a two-tier system for the marking of assessments, which reflects the different levels of service our clients have purchased. We believe this is the fairest way to ensure that those who have invested in a higher level of support receive a proportionately higher level of priority and attention.

Supported Service Clients

If you have purchased one of our Supported services, you benefit from a formal Service Level Agreement (SLA) of 24 working hours for marking turnaround. This is calculated at 7 working hours per day, which in practical terms equates to approximately three working days.

In addition to the SLA, Supported service clients also benefit from:

• ⭐ A dedicated assessor assigned to your assessment
• ⏰ The option of late-night working where deadlines require it
• 📅 The ability to set a target deadline for us to work towards
• 📞 Full email and telephone support throughout the process
• 🔄 Faster turnaround as a prioritised client

Marking Only Service Clients

The Marking Only service is specifically designed for organisations who are confident they meet the requirements, have prior experience of the certification process, and simply need their submission assessed and their certificate issued. It is intentionally priced as a lower-cost option to reflect this.

This service is modelled closely on the direct IASME marking service. As such:

• There is no formal SLA in place for Marking Only clients, we aim to mark along the same timeline as you would get from IASME which would be a day to allocate to an assessor and then 2-3 days for the assessor to mark however this is not guaranteed.
• Service updates, telephone support, and general email support are not included
• Feedback is limited to the feedback provided within the marking portal itself, as per the standard IASME process
• Whilst our typical turnaround is 4–5 working days, this is not guaranteed and may be longer during busy periods, as Supported service clients will always be prioritised first.
  

We want to be upfront about this: the Marking Only service is the right choice if you are genuinely confident you will pass and you do not need guidance or support along the way. If there is any doubt at all, we would always recommend our Supported service. Not only does it come with a significantly higher level of support, but our track record speaks for itself — no client who has taken our Supported service and followed our guidance has ever failed their assessment.

If you're unsure which service is right for you, please get in touch or call us on 0333 339 0383 before purchasing — we'll give you an honest recommendation with no sales pressure.

Get Cyber Certified — licenced and assured assessors for Cyber Essentials and Cyber Assurance on behalf of IASME and the UK Government's NCSC.

Yes. Cyber Essentials Plus is priced individually because the cost depends on the size of your organisation and the systems in scope. Send us the details and we’ll give you a competitive bespoke quote.

As Cyber Essentials specialists we stick to our specialist subject which is Cyber Essentials and Cyber Assurance certifications. In order to offer clients a seamless service experience we partner with a trusted pool of Cyber Essentials Plus consultants to conduct Cyber Essentials Plus assessments. If you certify Cyber Essentials with us, we’ll connect you with the CE+ team after issuing your Cyber Essentials certificate. Already certified? Just send your report and certificate to team@getcybercertified.co.uk, and we’ll take it from there. We will select the CE+ specialist based on your requirements, they work independently to Get Cyber Certified and will issue you certificate under their certification body branding and logo. If you have a preferred CE+ consultant please let us know and we'll try to connect you.

We accept credit and debit cards, and offline payment by bank transfer or invoice where arranged. If your finance team needs a different setup, get in touch and we’ll see what we can do.

Unless we say otherwise on the service page, our prices are shown excluding VAT. If VAT applies to your order, it will be added clearly before you pay, so there are no surprises.

Cyber Essentials is a series of self-assessment questions that when answered will highlight and provide visibility of areas of cyber risk your business is exposed too. This allows you to make changes and become a Cyber essentials certified business.

You work through all the questions which are then assessed by the awarding body and you will pass or fail. We have supported services which come with assistance and pre checking of your answers before marking. We haven't had a client who's taken our supported service and followed our advice who has failed and we've been marking assessments since 2014. Or if you know you will pass we also have a marking only service which is simply that, we mark your submission and if its compliant we issue your certificate. If its marked non compliant then you have 2 working days to remediate before you get a free complimentary remarking. No fuss, no support, no turnaround SLA's, just a submission marking.

The basic level of Cyber Essentials (CE) does not require any vulnerability or third-party testing like the higher Cyber Essentials Plus certification which required an audit of your answers.

This is one of the most common questions and include: Are home user devices included? What about Microsoft 365? My company accesses a remote desktop environment so are the PC's and laptops still in scope? What about staff's personal phones?

Basically, any systems used to access, process or store organisational data is in scope. That's a very simple way of describing it and the UK Governments NCSC change the framework from time to time. If you would like to check what's covered in the Cyber Essentials assessment you can download the governments Requirements for IT Infrastructure document here. The NCSC sometimes change the link so if you cant download the document please let us know.

Cyber Essentials certification lasts for 12 months from the date your certificate is issued. We recommend starting your renewal a few weeks before expiry so there’s no gap in cover. If you leave it too late you will need to inform all interested parties that your organisation no longer holds Cyber Essentials which can have an impact on any contracts or supply agreements which rely on this.

You should have a clear view of the devices, users, software, and internet-facing services that are in scope. It also helps to have details of your firewall setup, patching process, secure configuration, admin account control, and malware protection. If you choose one of our supported services, we can help you check everything before submission so you can move forward with confidence!

If something does not meet the standard, we’ll tell you what needs fixing. You can then make the changes and resubmit. If you choose one of our supported services, we help reduce that risk by checking things before you go live.

It’s straightforward. You choose the right service, complete the assessment, and our assessor reviews everything. If you choose a supported service, we’ll check your answers first and flag any gaps before final submission. Once everything is in order, we issue your certificate.

Cyber Essentials Plus is a hands-on audit: an independent assessor tests a sample of your devices and accounts to confirm that the controls you declared in your Cyber Essentials assessment are really in place. Your CE+ testing must be completed within three months of your Cyber Essentials certificate being issued.

Under the current (Danzell) rules:

• You have a single 30-day remediation window, and fixes must be applied across every in-scope device, not just those tested.
• If missing updates are found in your first sample, the first sample is retested after you've fixed them, and a second random sample is tested, with no more than 72 hours' or three working days' notice.
• If the second sample shows the same missing updates, your CE+ fails and IASME revokes your Cyber Essentials certificate. Different missing updates mean CE+ can still be awarded, with an advisory to fix them.

Unfortunately, refunds aren't provided for a failed CE+ assessment. Testing covers areas such as MFA, timely security updates, supported software and devices, malware protection and the accuracy of your Cyber Essentials answers.

That's why, if you get your Cyber Essentials through us, we recommend our Supported Service, and we offer an optional pre-CE+ check before testing begins.

Although lower priced, the DIY marking only service comes with the risk of failing your assessment. Feedback is also minimal as this is a marking only service and if you fail you will need to pay to take the assessment again. If you choose one of the supported services you will benefit from a pre assessment review and gap analysis which will list all of the non compliant controls before you even log into the live marking portal. This allows you time to resolve any issues before you submit. This is the lowest risk and most cost effective pass process.

That depends on your risk appetite and level of expertise. Marking Only suits organisations that already know they will pass, for example those with an in-house Cyber Essentials expert who has already checked their answers, or those with a high risk appetite, since Marking Only carries a real chance of failure. With our Supported service, we review your answers before anything is submitted for formal marking, and 100% of applicants who have followed our advice and who have submitted within the required deadlines have passed. We've been certifying since 2014. For a full side-by-side comparison, read our guide: Cyber Essentials Marking Only vs Supported.

By getting someone who is familiar with the Cyber Essentials framework to pre check your answers before you submit for final marking. You can either use your own expert or we can do this for you using one of our supported services. For customers on our supported options, we will pre-asses your answers before final submission so can ensure everything is in order. This also helps to ensure you can pass Cyber Essentials on your first attempt. Click here for a full breakdown of how this works.

Our supported service also includes expediated marking. Basically, we mark the supported clients before the marking only clients meaning that the turnaround time for supported clients is usually within 1-2 working days (if you need immediate marking, please contact us, if we can help, we will. The quickest we've certified is 4 hours from start to finish). This, along with no time limits for remediation other than IASME's six-month assessment window and as many feedback > remediate > re-mark loops as needed means that the risk of failing under our supported service are low. 100% of applicants who have followed our advice and who have submitted within the required deadlines have passed. For a full comparison of our services, see our guide to Cyber Essentials Marking Only vs Supported.

Same-day certification may be possible, but it depends on assessor availability and how quickly you can complete the assessment. If you have a tight deadline, contact us first and we’ll tell you what’s realistic. The cleaner your answers and evidence are, the faster we can move!

Yes, absolutely. Coming from an MSP background and having designed the partner program around the same model which was successful for our MSP we're the go-to Certification Body for MSP's. We regularly support MSPs and IT providers, including teams managing more than one client. We’ll help you pick the right service and keep the process simple and efficient.

IASME is the NCSC’s sole Cyber Essentials Delivery Partner who have been appointed by the National Cyber Security Centre (NCSC) to overlook the UK Government's Cyber Essentials Scheme. The Certification Bodies are companies licenced to IASME who perform the assessments. Its a great set up and means that you get to choose to work with any of the many certification bodies to achieve the IASME Cyber Essentials certification. Its important to choose a certification body who are a good fit for your organisation and who provide service to suit your needs.

What is Cyber Essentials and do I need it?

Cyber Essentials is a UK Government-backed certification scheme developed by the experts at the National Cyber Security Centre (NCSC). It represents the minimum standard of cyber security recommended by the Government for organisations of all sizes — from sole traders right through to large enterprises.

The scheme is designed to protect your organisation against the most common internet-based cyber threats. The NCSC describes cyber attacks as no longer a question of "if" but "when" — and the reassuring reality is that the majority of attacks are opportunistic and basic in nature. Cyber Essentials helps ensure your organisation is not an easy target.

IASME is the NCSC's official Cyber Essentials Delivery Partner, and manages a network of over 400 Certification Bodies across the UK — including Get Cyber Certified — who are licensed to assess and certify organisations against the scheme.

What are the five technical controls that Cyber Essentials covers?

Cyber Essentials is built around five technical controls, each designed to address a specific area of risk. To achieve certification, your organisation must demonstrate that these controls are in place across your scoped IT infrastructure:

The full requirements are published by the NCSC in the Requirements for IT Infrastructure document (v3.2, April 2025), which is updated annually.

How does the Cyber Essentials certification process work?

There are two routes to Cyber Essentials certification, both of which involve a verified self-assessment questionnaire:

Self-Led: You register directly with us, make payment, and complete the self-assessment independently. Your answers must be signed off by a board member or equivalent before being submitted for marking by an assessor.

Supported: You engage a licensed Certification Body — such as Get Cyber Certified — to help you understand the questions and how they apply to your organisation, before submitting for marking.

Cyber Essentials is an annually renewable certification. To keep your certificate valid, you must reassess and pass each year.

For more detail on how our supported service works, visit our Resource Hub: Navigating Cyber Essentials — What to Expect from Our Support Process and Our Hassle-Free Approach to Passing First Time.

How much does Cyber Essentials cost?

Certification is priced according to the size of your organisation, starting at £320 + VAT. You can view current pricing and purchase directly through our online shop.

Is there any additional benefit to getting Cyber Essentials?

Yes. Any UK-based organisation with a turnover under £20 million that achieves Cyber Essentials certification covering their whole organisation is automatically entitled to free Cyber Liability Insurance, arranged by IASME. This includes a 24/7 incident response helpline providing technical, legal, and crisis management services up to a total liability of £25,000. Full details are available at iasme.co.uk/cyber-essentials/cyber-liability-insurance.

In addition, since October 2014, Cyber Essentials certification has been a mandatory requirement for suppliers to UK central government who handle certain types of sensitive or personal information, or who provide specific technical products and services.

Where can I find more information and resources?

• 📘 Our Cyber Essentials Resource Hub
• 📘 Your Ultimate Cyber Essentials Certification Guide
• 📘 NCSC Cyber Essentials Overview

What is Cyber Essentials Plus and how is it different from Cyber Essentials?

Cyber Essentials Plus (CE+) is the higher level of the UK Government's Cyber Essentials scheme. It is based on exactly the same five technical controls as the standard Cyber Essentials certification — Firewalls, Secure Configuration, User Access Control, Malware Protection, and Security Update Management — but goes significantly further by adding an independent technical audit of your IT systems to verify that those controls are genuinely in place and working effectively.

Where Cyber Essentials is a verified self-assessment — meaning you answer questions about your systems and an assessor reviews your answers — Cyber Essentials Plus takes this a step further by having a qualified assessor actively test your systems. This provides a higher level of assurance both to your organisation and to anyone relying on your certification.

It is also worth noting that the pass bar for Cyber Essentials Plus is set at a higher level than for standard Cyber Essentials. Where a minor non-compliance may not prevent a pass at the basic level, any non-compliances found during a CE+ audit must be remediated before certification can be issued. Failure to remediate will lead to the revocation of your Cyber Essentials certificate and will necessitate your organisation needing to start again.

Do I need to hold Cyber Essentials before I can do Cyber Essentials Plus?

Yes — this is a firm requirement. The verified self-assessment questionnaire of Cyber Essentials is a prerequisite for Cyber Essentials Plus. You must have passed your Cyber Essentials assessment before a CE+ audit can be conducted, and the CE+ audit must be completed within 3 months of your Cyber Essentials certification date.

What does the Cyber Essentials Plus audit actually involve?

The CE+ audit is conducted by a Certification Body qualified to deliver Cyber Essentials Plus assessments. The audit can be carried out on site or remotely, and includes the following:

• Vulnerability scans of your organisation's scoped infrastructure
• External scanning from the internet against each of your organisation's public IP addresses
• Device sampling — the assessor will observe users carrying out everyday tasks on a representative sample of devices, to verify that the controls are correctly implemented in practice
• Cloud services checking — where cloud services are in scope, at least one standard user account and one administrator account will be verified

The technical procedures and methods used are set out in the Cyber Essentials Plus Test Specification (v3.2, April 2025), published by the NCSC.

How much does Cyber Essentials Plus cost?

Cyber Essentials Plus is priced according to the size and complexity of your organisation's network, as the technical testing involved requires proportionately more time for larger and more complex environments. Our current CE+ pricing can be found in our online shop. As CE+ must be quoted for individually for larger or more complex organisations, please contact us if you would like a tailored quote.

Where can I find more information?

• 📘 Our Cyber Essentials and CE+ Resource Hub
• 📘 IASME — Cyber Essentials vs Cyber Essentials Plus: What is the difference?
• 📘 NCSC Cyber Essentials Overview
• 📘 NCSC Help & Resources — including CE+ Test Specification

What does the IASME Cyber Assurance Level 1 assessment cover?

The IASME Cyber Assurance standard is organised into fourteen themes, grouped across four categories:

The depth of the standard is tailored to your organisation's size, meaning smaller organisations are not overwhelmed with requirements that are not relevant to them. For example, a sole trader or two-person partnership is required to meet 20 requirements, whilst larger organisations address a more comprehensive set of up to 65. IASME also provides a range of free downloadable templates for many of the policies, procedures and trackers required under the standard.

Do I need Cyber Essentials before I can apply for IASME Cyber Assurance?

Yes — an up-to-date Cyber Essentials certification is a prerequisite for IASME Cyber Assurance. You must hold a valid Cyber Essentials certificate before you can begin an IASME Cyber Assurance assessment. If you do not yet hold Cyber Essentials, we can help you with both — please get in touch or visit our shop.

How does the Level 1 assessment process work?

Once you have registered and your Cyber Essentials prerequisite is confirmed, you will be given access to the secure online assessment platform. You will complete the verified self-assessment questions relevant to your organisation's size and profile. A senior member of the board or equivalent must then e-sign a declaration confirming that all answers provided are accurate. Your completed assessment is then reviewed and marked by a qualified, independent external Assessor.

Level 1 is an annually renewable certification, requiring an annual resubmission of the verified self-assessment and maintenance of your Cyber Essentials prerequisite.

How much does IASME Cyber Assurance Level 1 cost?

Level 1 pricing is based on the size of your organisation. Please visit our online shop for current pricing, or contact us if you'd like to discuss which service is right for you.

Where can I find more information?

• 📘 Our Cyber Assurance Resource Hub
• 📘 How Cyber Assurance Helps Organisations Demonstrate Good Practice
• 📘 Exploring Cyber Assurance Support Services

What is IASME Cyber Assurance Level 2 and how is it different from Level 1?

IASME Cyber Assurance Level 2 is the higher level of the IASME Cyber Assurance scheme, providing a significantly greater level of assurance than Level 1. Where Level 1 is a verified self-assessment reviewed by an independent assessor, Level 2 involves a full independent audit of your organisation's processes, procedures, and controls — conducted by an IASME-assured Assessor — to verify that the requirements of the standard have been correctly implemented in practice, not just on paper.

For organisations who want to provide the highest level of independent assurance to clients, partners, or government procurement bodies that their cyber security governance and processes are genuinely robust and operating effectively, Level 2 represents the gold standard within the IASME Cyber Assurance scheme.

Do I need to hold Level 1 before I can go for Level 2?

Yes — IASME Cyber Assurance Level 1 must be passed before you can apply for Level 2. Additionally, because Level 1 is itself dependent on a valid Cyber Essentials certificate, you must hold both before a Level 2 audit can proceed. This means the full certification journey runs: Cyber Essentials → IASME Cyber Assurance Level 1 → IASME Cyber Assurance Level 2.

What does the Level 2 audit involve?

The Level 2 audit is conducted by an IASME-assured Certification Body and is quoted for individually based on the size and complexity of your organisation. The audit process involves your organisation demonstrating activities and providing documentary evidence to support your answers to the IASME Cyber Assurance self-assessment question set. Specifically, the Assessor will:

• Review documentation — examining policies, procedures, and records relevant to the standard's requirements
• Interview key personnel — speaking with relevant staff to understand how security practices are implemented and maintained on a day-to-day basis
• Observe activities — verifying that security controls are operating in practice, not just described in documents
  

The audit can be conducted in person at your premises or remotely (for example, via video call), depending on what is agreed between your organisation and the Assessor.

How long is a Level 2 certification valid for?

The IASME Cyber Assurance Level 2 audit certification is valid for three years. However, it is important to note that this does not mean you can leave your other certifications to lapse during that period. To maintain your Level 2 status, you are required to:

• Renew your Cyber Essentials certification annually
• Complete your IASME Cyber Assurance Level 1 verified self-assessment annually

These annual renewals act as an interim check to ensure your controls remain in place between full Level 2 audits. IASME describe this as part of what helps keep the overall cost of Cyber Assurance more affordable than schemes that require a full independent audit every year.

How much does IASME Cyber Assurance Level 2 cost?

The Level 2 audit must be quoted for individually, as the cost will vary depending on the size and complexity of your organisation and the time involved in conducting the audit. To request a quote, please contact us or call 0333 339 0383 and we will be happy to discuss your requirements.

Where can I find more information?

• 📘 Our Cyber Assurance Resource Hub
• 📘 How Cyber Assurance Helps Organisations Demonstrate Good Practice
• 📘 Exploring Cyber Assurance Support Services

Not every organisation needs Cyber Essentials Plus. Standard Cyber Essentials is often enough for general compliance and many contracts, but some customers, frameworks, and public sector tenders ask for CE+ specifically. If you’re unsure, check the contract wording first. If it mentions technical testing or a higher level of assurance, Cyber Essentials Plus is usually the right choice.

Usually, yes. ISO 27001 is a broader information security management standard, but it does not replace Cyber Essentials. If a client, contract or insurer asks for Cyber Essentials, you need the Cyber Essentials certificate itself.

Cyber Essentials checks five specific technical controls against the NCSC's requirements, such as multi-factor authentication on every cloud service that offers it and applying high-risk and critical updates within 14 days. Holding ISO 27001 doesn't guarantee you meet those controls, although the asset records and policies you keep for ISO 27001 will make your Cyber Essentials assessment much easier to complete.

Going directly to IASME means your submission is randomly assigned to one of many certification bodies and assessors, who may vary in experience and interpretation of guidelines. By choosing us, you'll have the same experienced assessor every time, ensuring consistency and a strong working relationship.

Our Marking Only service is priced below IASME's rates, and if you'd like help, our Supported Service checks your answers before you submit so you can fix any problems before marking rather than after.

Do I need Cyber Essentials to bid for contracts?

Quite possibly — and if you're working with or supplying to the public sector, the chances are the answer is yes.

Cyber Essentials has been a mandatory requirement for certain UK Government contracts since 2014, and the scope of that requirement has grown considerably in the years since.

The short version is this: if your work involves any of the following, you very likely need Cyber Essentials — and may need Cyber Essentials Plus:

• Supplying goods, services, or works to any UK central government department, agency, or NHS body under a contract covered by Procurement Policy Note 014 (PPN 014)
• Working within the MOD or defence supply chain (Cyber Essentials Plus required under DEFCON 658)
• Supplying to NHS Supply Chain or providing digital health technology to the NHS (Cyber Essentials Plus required for in-scope NHS Supply Chain suppliers; Cyber Essentials mandatory for DTAC compliance)
• Delivering criminal legal aid services under a Legal Aid Agency Standard Crime Contract (mandatory from October 2025)
• Supplying services or technology to HM Prison and Probation Service (HMPPS) under contracts requiring CE or CE+
• Accessing the G-Cloud framework as a cloud technology supplier (Cyber Essentials required for all suppliers)

Beyond these formal contractual requirements, Cyber Essentials is also strongly expected — and in many cases required — across the legal sector (including Law Society Lexcel accreditation and SRA guidance), the Scottish and Welsh public sectors, charities, housing associations, and financial services — where six major UK banks have publicly committed to requiring it from their suppliers.

Which level do I need — Cyber Essentials or Cyber Essentials Plus?

It depends on the specific contract. Basic Cyber Essentials satisfies most standard public sector supply chain requirements. Cyber Essentials Plus is required for higher-risk contracts, MOD supply chain contracts under DEFCON 658, and NHS Supply Chain in-scope suppliers. Your contract documentation will always state which level is required — and if in any doubt, Cyber Essentials Plus satisfies every requirement that basic Cyber Essentials does, and more.

Where can I find out more?

We've written a detailed Resource Hub article covering every sector and contract type in full, including the specific policy documents and official sources behind each requirement. It's the most comprehensive guide we've produced and is well worth a read if you're navigating this area for the first time — or if you need to understand the requirements for a specific tender.

📘 Read the full article: Which Contracts Require Cyber Essentials? A Complete Guide for UK Organisations

If you'd like a conversation about your specific situation before committing to a service, please get in touch or call 0333 339 0383 — we're always happy to point you in the right direction.

⚠️ Please note: Contract requirements change regularly as government policy evolves. Always verify the specific requirements of your own contract and refer to the latest published guidance. The information above is correct as of May 2026 and is provided for general guidance purposes only.

How does Get Cyber Certified handle my personal data?

As a cyber security certification firm, we hold data protection and privacy in the highest regard — not just because it is a legal requirement, but because it sits at the very heart of what we do and what we stand for. We would expect nothing less than the highest standards from ourselves, and we are committed to handling your personal data responsibly, transparently, and securely at all times.

Our Legal Basis for Processing Data

Get Cyber Certified (Data Security and Compliance Services Ltd) is registered with the Information

Commissioner's Office (ICO) as a data controller. All personal data we collect and process is handled in full compliance with the UK General Data Protection Regulation (UK GDPR) and the

Data Protection Act 2018.

You can verify our registration independently at any time via the ICO's public register at ico.org.uk/ESDWebPages/Search.

What Data Do We Collect and Why?

We only ever collect personal data that is necessary for the purpose of delivering our services to you. This may include:

• Contact information — your name, email address, telephone number, and business address, used to communicate with you and deliver your service
• Business information — details about your organisation, its IT infrastructure, and systems, collected solely for the purpose of completing your assessment
• Payment information — billing details required to process your purchase, handled securely and never stored beyond what is legally required
• Assessment data — information submitted as part of your Cyber Essentials or Cyber Assurance assessment, processed on behalf of IASME and the NCSC

We do not collect personal data beyond what is required, and we do not use your data for marketing purposes without your explicit consent.

How Long Do We Hold Your Data?

We retain your data only for as long as is necessary to fulfil the purpose for which it was collected, and in line with our legal obligations. Assessment records are retained in accordance with IASME's data retention requirements. If you would like specific information about how long we hold particular categories of data, please contact us directly.

Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• The right to access the data we hold about you
• The right to rectification of inaccurate data
• The right to erasure (the right to be forgotten), where applicable
• The right to restrict processing of your data
• The right to data portability
• The right to object to processing
• The right to withdraw consent at any time, where processing is based on consent

To exercise any of these rights, please contact us at team@getcybercertified.co.uk. We will respond to all data rights requests within 30 days in line with our legal obligations.

Data Breaches

In the unlikely event of a personal data breach that poses a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of the breach, and will notify you directly without undue delay where required to do so under UK GDPR.

Third Parties & Data Sharing

We do not sell, rent, or trade your personal data to any third party. We may share data with trusted third parties where necessary to deliver our services — for example, with IASME as the awarding body for Cyber Essentials and Cyber Assurance certifications. Any third party with whom we share data is required to handle it in accordance with UK GDPR.

Contact & Complaints

If you have any questions or concerns about how we handle your data, please contact us at:

📧 team@getcybercertified.co.uk 📞 0333 339 0383 📮 Get Cyber Certified, 2 Rotherside Court, Rotherside Road, Eckington, Sheffield, S21 4HL

If you are not satisfied with our response, you have the right to lodge a complaint with the ICO at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

What is your Equality, Diversity & Inclusion policy?

Get Cyber Certified is committed to building and maintaining an inclusive, welcoming, and respectful environment for all of our clients, partners, and staff. We believe that diversity in all its forms is a strength, and that everyone deserves to be treated with dignity and fairness — regardless of who they are, where they come from, or how they identify.

Our Commitment

We are committed to ensuring that no person receives less favourable treatment, is disadvantaged, or is discriminated against — either directly or indirectly — on the basis of any of the nine Protected Characteristics as defined by the Equality Act 2010:

• Age
• Disability
• Gender reassignment
• Marriage and civil partnership
• Pregnancy and maternity
• Race (including colour, nationality, and ethnic or national origin)
• Religion or belief
• Sex
• Sexual orientation

This commitment applies equally to how we engage with our clients, how we recruit and support our staff, and how we work with our partners and suppliers.

What This Means in Practice

In practical terms, our commitment to equality, diversity, and inclusion means:

• All clients will receive the same high standard of professional service, without exception
• We will make reasonable adjustments wherever possible to accommodate the needs of clients or staff with disabilities or additional requirements — please don't hesitate to let us know if there is anything we can do to make our services more accessible to you
• Our team are expected to uphold these values in every interaction, both internally and with clients
• Any form of discriminatory behaviour — whether by a member of our team or directed at a member of our team — will be taken seriously and addressed promptly

Reporting a Concern

If you feel that you have been treated unfairly or have experienced discrimination in your interactions with Get Cyber Certified, we want to hear from you. Please contact us at:

📧 team@getcybercertified.co.uk 📞 0333 339 0383

All concerns will be handled confidentially, promptly, and with sensitivity. If you are not satisfied with the outcome, please refer to our Complaints Policy or contact the Equality Advisory and Support Service (EASS) at equalityadvisoryservice.com or on 0808 800 0082.

What is your position on LGBTQ+ inclusion?

Get Cyber Certified is a proudly inclusive organisation, and we want every client, partner, and member of staff to feel genuinely welcomed, respected, and valued — whoever they are and however they identify.

We recognise that for many LGBTQ+ individuals and organisations, feeling safe and respected in professional environments isn't something that can be taken for granted. We want to be explicitly clear: you are welcome here, and you will be treated with the same warmth, professionalism, and respect as every other client we work with.

Our Commitment to LGBTQ+ Inclusion

We are unequivocally committed to:

• Welcoming and serving LGBTQ+ clients, staff, and partners without reservation
• Using respectful and affirming language in all of our communications
• Ensuring that LGBTQ+ individuals are never made to feel unwelcome, uncomfortable, or othered in their interactions with us
• Maintaining a zero tolerance policy towards homophobia, biphobia, transphobia, or any other form of discrimination or prejudice directed at LGBTQ+ individuals — whether by a member of our team or by another client

What Happens if Something Goes Wrong?

We take any report of discriminatory or disrespectful behaviour extremely seriously. If you have experienced or witnessed anything that falls short of the values we have set out here, please contact us immediately at:

📧 team@getcybercertified.co.uk 📞 0333 339 0383

Your concern will be handled confidentially, sensitively, and without judgement. We are committed to listening, acting, and improving.

For wider support and guidance, the following organisations may also be of assistance:

• Stonewall: stonewall.org.uk | 0800 050 2020
• Switchboard LGBT+ Helpline: switchboard.lgbt | 0800 0119 100

Please contact us as soon as possible if you need to cancel or amend your assessment. Refunds for cancelled marking services are considered case by case. If you cancel, a minimum charge equivalent to a half-day consultancy rate of £700 excluding VAT will apply to cover work already completed. The earlier you get in touch, the more options we may have for you.

What is your anti-harassment and bullying policy?

Get Cyber Certified is committed to maintaining a professional, respectful, and safe environment for everyone we interact with — including our clients, our staff, and our partners. Harassment and bullying of any kind have no place in our organisation, and we take all reports of such behaviour seriously.

This policy applies in all directions. Just as our clients can expect to be treated with respect and professionalism by our team at all times, we equally ask that our team members are treated with the same courtesy and dignity in return.

What Constitutes Harassment or Bullying?

Harassment is any unwanted conduct that has the purpose or effect of violating a person's dignity, or creating an intimidating, hostile, degrading, humiliating, or offensive environment. This includes but is not limited to:

• Verbal abuse, offensive language, or personal insults — whether spoken or written
• Threatening or aggressive behaviour, including via email, telephone, or any other communication channel
• Persistent unwanted contact or communication designed to intimidate or pressure
• Discriminatory remarks or behaviour relating to any Protected Characteristic (see our Equality, Diversity & Inclusion policy)
• Online or written harassment, including through social media

Our Zero Tolerance Stance

As referenced in our Service Standards, we operate a zero tolerance policy towards threatening, abusive, or aggressive behaviour directed at any member of our team. In the event that this policy is breached, we reserve the right to:

• Cease all work on your assessment immediately
• Withdraw our services without the issuance of a refund
• Report the behaviour to the relevant authorities where appropriate

This is not a position we ever anticipate needing to enforce. The vast majority of our clients are a pleasure to work with, and we share this policy simply to be fully transparent about the standards we hold ourselves — and ask others to hold — in our professional relationships.

Reporting Harassment

If you have experienced or witnessed behaviour that you believe constitutes harassment or bullying — whether by a member of our team or another party — please report it to us immediately:

📧 team@getcybercertified.co.uk 📞 0333 339 0383

All reports will be taken seriously, investigated promptly, and handled with full confidentiality. If the report concerns a member of our team, it will be escalated to senior management immediately. If you are not satisfied with our response, please refer to our Complaints Policy.

How do you ensure your services are accessible to everyone?

Get Cyber Certified is committed to ensuring that our services are accessible to all clients, including those with disabilities or additional needs. We believe that achieving cyber security certification should be open to every organisation, and we want to make sure that no one is disadvantaged in accessing our services due to a barrier that we can help to address.

Our Accessibility Commitment

We are committed to:

• Making our services as accessible as possible to clients with a wide range of needs and abilities
• Providing reasonable adjustments to the way we deliver our services wherever it is practical and within our capacity to do so
• Communicating clearly and in plain English across all of our written materials, avoiding unnecessary jargon wherever possible
• Responding to accessibility requests with sensitivity, without making clients feel that they are asking for something unreasonable

Reasonable Adjustments — What We Can Offer

If you have a disability, neurodivergent condition, or any other need that affects how you are best able to engage with our services, please let us know and we will do our very best to accommodate you. Examples of adjustments we may be able to make include:

• Providing information or correspondence in an alternative format where possible
• Allowing additional time or flexibility around communication and response expectations
• Adapting the way we deliver consultancy or workshop sessions to suit your needs
• Conducting sessions remotely where a physical visit would present a barrier

Every request will be considered individually and we will always aim to find a workable solution. We would far rather have that conversation with you upfront than have you feel that our service is not for you.

Website Accessibility

We are committed to ensuring that our website at getcybercertified.co.uk is as accessible as possible and aim to align with the Web Content Accessibility Guidelines (WCAG) 2.1. If you encounter any accessibility barriers on our website, please let us know so that we can work to address them.

Get in Touch

If you have an accessibility requirement or would like to discuss how we can best support you, please contact us — we're very happy to have that conversation:

📧 team@getcybercertified.co.uk 📞 0333 339 0383

For further guidance on your rights as a disabled person or someone with additional needs, the Equality Advisory and Support Service (EASS) can be contacted at equalityadvisoryservice.com or on 0808 800 0082.

How do I make a complaint?

We sincerely hope that your experience with Get Cyber Certified is always a positive one. However, we recognise that things can occasionally fall short of expectations, and we believe that every client deserves a clear, fair, and accessible route to raise a concern if that happens.

We take all complaints seriously, treat them as an opportunity to learn and improve, and are committed to resolving every concern as promptly and fairly as possible.

Step 1 — Raise it With Us Directly

In the first instance, we ask that you contact us directly to let us know about your concern. Many issues can be resolved quickly and informally, and we would always prefer the chance to put things right before a concern escalates.

You can contact us by:

📧 Email: team@getcybercertified.co.uk �� Phone: 0333 339 0383 📮 Post: Get Cyber Certified, 2 Rotherside Court, Rotherside Road, Eckington, Sheffield, S21 4HL

Please provide as much detail as possible about the nature of your complaint, including any relevant dates, reference numbers, and what outcome you are hoping for. This will help us to investigate and respond as efficiently as possible.

Step 2 — Formal Complaint

If you have contacted us and feel that your concern has not been adequately addressed, you may escalate your complaint formally. Please mark your communication clearly as a Formal Complaint and direct it to the same contact details above. Upon receipt of a formal complaint, we will:

• Acknowledge your complaint in writing within 5 working days
• Investigate your complaint thoroughly and impartially
• Provide you with a full written response within 20 working days of acknowledgement
• Where this timescale cannot be met, we will contact you to explain why and provide a revised timeframe

Step 3 — External Escalation

If you remain dissatisfied following our formal complaints process, you may have the right to escalate your concern to a relevant external body, depending on the nature of your complaint:

• Assessment & Certification concerns: As accredited assessors operating on behalf of IASME, concerns relating specifically to the assessment or certification process may be escalated to IASME at iasme.co.uk/contact-us
• Data Protection concerns: May be referred to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113
• Equality & Discrimination concerns: May be referred to the Equality Advisory and Support Service (EASS) at equalityadvisoryservice.com or on 0808 800 0082

Our Promise to You

We commit to handling every complaint with fairness, confidentiality, and without prejudice. Raising a complaint will never negatively affect the way we treat you or the service you receive from us. We view feedback — including complaints — as valuable, and we genuinely thank you for taking the time to share your experience with us.