Cyber Essentials for larger and more complex organisations
Multiple sites, mixed device fleets, layered cloud services and more than one legal entity. We bring structure to complex scopes, so your submission is right first time and stands up to scrutiny from customers and procurement teams.
At a glance
- A structured scoping call with a senior assessor
- Group and multi-entity certification options
- A clear path to Cyber Essentials Plus and Cyber Assurance
Why larger organisations certify
Procurement and supply chain
Customers and procurement teams increasingly require Cyber Essentials, and often Cyber Essentials Plus, before contract award or renewal.
Board-level assurance
Independent certification against the NCSC’s requirements gives leadership a clear, external view of baseline security.
A foundation to build on
Cyber Essentials is the natural first step towards Cyber Essentials Plus and IASME Cyber Assurance for organisations that need to go further.
What larger organisations get from us
A named senior assessor
One experienced assessor who learns your environment and stays with you from scoping to certificate.
Structured scoping
We agree boundaries, entities, cloud services and devices up front, so there are no surprises at marking.
Additional organisations
Define additional organisations within your assessment and you’ll automatically be asked whether you’d like a duplicate certificate.
Cyber Essentials Plus
Delivered with a trusted partner certification body, building on your Cyber Essentials work.
IASME Cyber Assurance
For wider governance, incident response and policy assurance, from £660 + VAT.
Clear, actionable feedback
Written gap analysis your IT team, MSP and leadership can all act on.
Where larger organisations commonly trip up
These are the issues we see most often when marking assessments, so you can deal with them before you submit.
- Under-scoped cloud services. Teams often list Microsoft 365 and miss messaging platforms, social media admin accounts, cloud accounting, HR systems and domain registrar portals. All of them are in scope under v3.3.
- BYOD that’s outgrown its policy. Personal devices accessing organisational email or data are in scope. Your policy and technical controls need to match how people actually work.
- Unclear entity boundaries. Subsidiaries and sister companies need a clear decision on whether they sit inside one scope as additional organisations or certify separately.
- Third parties and MSPs. Accounts your MSP uses on your systems are in scope, so make sure they follow the same MFA and admin-account rules as your own staff.
Two ways to get certified
Our Supported Service is built for this kind of complexity: a structured gap analysis before submission means your first attempt is your last. Straightforward environments can go straight to Marking Only.
For confident, well-prepared teams
Ideal if you have in-house expertise and have already checked your setup against the requirements.
- Your own secure assessment portal
- Independent marking with a feedback report
- Two working days to fix any non-compliances, then a complimentary re-mark
- Cyber Essentials report and certificate included
Cyber liability insurance is subject to IASME’s terms. Certifying more than one organisation? Define each additional organisation within your assessment and you’ll automatically be asked whether you’d like a duplicate certificate.
Buy Marking OnlyA senior assessor with you all the way
The right choice for most organisations, and for anyone working to a deadline.
- Your own assigned senior assessor
- Readiness check and gap analysis before anything is submitted
- Feedback within 24 working hours, with same-day assessments available subject to T&C’s
- Unlimited remote support for every question
- As many attempts as you need within the six-month assessment window
- Cyber Essentials report and certificate included
For our Supported Service: 100% of applicants who have followed our advice and who have submitted within the required deadlines have passed. Cyber liability insurance is subject to IASME’s terms. Certifying more than one organisation? Define each additional organisation within your assessment and you’ll automatically be asked whether you’d like a duplicate certificate.
Buy SupportedPrices are “from” prices, exclude VAT and depend on organisation size; your exact price is shown in our shop. Free cyber liability insurance is available to eligible organisations (IASME terms apply).
Guidance for larger organisations
Practical articles from our assessors in the Resource Hub.
“Mark has been so helpful each time, super transparent about IASME guidance, and helped us navigate tricky edge cases in a compliant manner.”
Hannah · Google reviewCommon questions
Do we need Cyber Essentials Plus as well?
Plus adds hands-on technical verification of your systems and is often required in larger contracts. Cyber Essentials comes first; we then deliver Plus with a trusted partner certification body.
What’s the difference between Cyber Essentials and Cyber Assurance?
Cyber Essentials covers five technical controls. IASME Cyber Assurance is broader, covering governance areas such as incident response, staff training and operations.
Can you work alongside our MSP or IT team?
Yes. We regularly work directly with internal IT teams and managed service providers, and can include them on calls and feedback.
More answers in our full FAQs.
Discuss your scope with a senior assessor
Book a free scoping call and we’ll map out entities, cloud services and the right certification route for you.