Cyber Essentials certification support
Cyber Essentials for UK SMEs
Get certified with clear prices, practical help and a local team. We check where you are, fix the gaps and guide you through the IASME assessment, then help you stay certified every year.
Book a free readiness call Instant price estimate See prices
Why ABCOM
An NCSC Assured Service Provider
ABCOM is an NCSC Assured Service Provider under the Cyber Advisor (Cyber Essentials) scheme, which covers helping organisations put the five Cyber Essentials controls in place.
- Practical, plain-English advice for small businesses and charities
- Our Cyber Advisors are independently assessed by IASME for the NCSC
- IASME Cyber Assurance Level 2, independently audited
- A Burgess Hill team supporting businesses since 1996, with on-site visits when needed
- Optional continuous compliance, with our systems keeping you compliant all year
- Free 30-minute cyber security review to start
Quick recap
The five Cyber Essentials controls
Firewalls
Block unauthorised access.
Secure configuration
Remove defaults and unused accounts.
Security updates
Patch high-risk issues within 14 days.
User access control
Least privilege and MFA.
Malware protection
Protection on every device.
Why it matters
Most UK organisations aren’t protected yet
Cyber Essentials covers the basic controls that stop most common attacks, such as phishing and password guessing. Few businesses have all five in place.
Source: Cyber Security Breaches Survey 2025/26, DSIT and Home Office.
“Working within the healthcare sector, security, compliance and reliability are absolutely critical. ABCOM understood those requirements from day one. As cybersecurity and regulatory compliance became increasingly important, ABCOM helped us navigate those challenges with confidence.”Kay, Practice Manager, Family Dental, Crawley · worked with ABCOM for over 15 years
Prices
How much does Cyber Essentials cost?
There are two parts: the IASME certification fee, which is fixed by organisation size and paid each year, and any help you need to get ready. All prices exclude VAT.
1. IASME certification fee
Set by IASME and paid annually. Includes the assessment of your self-assessment questionnaire.
2. ABCOM readiness guidance
Only what you need. We confirm a fixed price after a free readiness call.
You’re mostly ready. We review your setup and help you complete the questionnaire.
A few gaps to fix, such as multi-factor authentication, unsupported devices or firewall settings.
Multiple sites, servers, remote access or significant remediation work.
Small-business IASME fee (£440) plus Standard readiness guidance (£450–£695).
Cyber Essentials Plus adds a hands-on audit and is quoted separately, based on the number of devices and sites in scope.
How it works
From first call to certificate
Most organisations that are already close can be certified within days. If there are gaps to fix, it typically takes a few weeks.
Free readiness call
We talk through your devices, cloud services and network, and tell you honestly how close you are.
Fix the gaps
We set up MFA, update or replace unsupported devices, tighten firewalls and admin access, and harden Microsoft 365.
Complete the assessment
We guide you through the IASME questionnaire so your answers are accurate and complete.
Certified, and kept current
You get your certificate for 12 months, and we remind you before renewal.
Optional
Continuous compliance, all year round
Cyber Essentials is checked on the day your certificate is issued, but you’re expected to stay compliant for the whole year. With our systems installed on your devices, we keep updates within 14 days, MFA switched on and devices supported throughout the year, and flag anything that drifts. Renewal then becomes a formality.
Choose your level
Cyber Essentials or Cyber Essentials Plus?
Both cover the same five controls. Plus adds an independent, hands-on check of your systems.
| Cyber Essentials | Cyber Essentials Plus | |
|---|---|---|
| How it’s assessed | Verified self-assessment questionnaire | Same questionnaire plus a hands-on technical audit |
| Technical testing | No | Vulnerability scans and device checks by an assessor |
| Timing | Days, if you’re already ready | Must be completed within 3 months of Cyber Essentials |
| Valid for | 12 months | 12 months |
| Price | IASME fee from £320 + VAT, plus any readiness help | Quoted by the number of devices and sites in scope |
| Best for | Most small businesses and charities | Government contracts, larger supply chains and higher-risk sectors |
The Cyber Essentials Plus audit must be completed within 3 months of your Cyber Essentials certificate being issued. If you’re aiming for Plus, we plan both together so you don’t miss the window.
FAQs
Cyber Essentials questions
Do you offer a free Cyber Essentials consultation?
Yes. We offer a free 30-minute cyber advisory call with one of our Cyber Advisors. We look at your devices, cloud services and network, tell you how close you are to Cyber Essentials, and explain what would need fixing. There’s no obligation, and you get a fixed quote afterwards. Find out about the free review or book your call below.
How much does Cyber Essentials cost?
The IASME certification fee is £320 + VAT for micro organisations (1–9 employees), £440 for small (10–49), £500 for medium (50–249) and £600 for large organisations (250+). If you need help getting ready, ABCOM’s readiness guidance ranges from £295 to £2,500 + VAT depending on complexity. We confirm a fixed price after a free readiness call.
How long does it take to get Cyber Essentials?
If your systems already meet the requirements, you can complete the online self-assessment and be certified within days. If there are gaps to fix, such as setting up multi-factor authentication or replacing unsupported devices, it typically takes a few weeks.
How long does Cyber Essentials certification last?
Certification lasts 12 months. You need to renew every year to stay certified, and the requirements are updated from time to time, so each renewal is a good opportunity to check your security is still up to date.
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Cyber Essentials is a verified self-assessment. Cyber Essentials Plus covers the same five controls but adds a hands-on technical audit, including vulnerability scans and device checks, carried out by an assessor. Cyber Essentials Plus must be completed within three months of achieving Cyber Essentials.
Does Cyber Essentials include cyber insurance?
UK organisations with an annual turnover under £20 million that certify their whole organisation may be eligible for free cyber liability insurance included with the IASME certification. The terms are set by the insurer and are confirmed when you certify.
Is Cyber Essentials mandatory?
It is voluntary for most organisations, but it is required for many UK government contracts that involve handling personal or sensitive information, and more and more businesses ask their suppliers for it. It is also a clear way to show customers, funders and insurers that you take security seriously.
What changed in Cyber Essentials in April 2026?
The Danzell question set replaced the previous Willow question set for assessment accounts created after 26 April 2026. The five controls haven’t changed, but marking is stricter: missing multi-factor authentication on any cloud service where it’s available, or high-risk and critical updates not installed within 14 days, now means an automatic fail. Organisations also need to describe their scope in more detail, list the legal entities included, and the director’s declaration now confirms you’ll stay compliant for the whole certification year. Cyber Essentials Plus retests now check a fresh sample of devices. Accounts created before the change had six months to certify under Willow.
Why choose ABCOM for Cyber Essentials?
We’re an NCSC Assured Service Provider under the Cyber Advisor (Cyber Essentials) scheme, we hold IASME Cyber Assurance Level 2, and we’ve supported businesses and charities from Burgess Hill since 1996. As your IT provider we can fix the gaps ourselves, rather than just telling you about them, and we can keep you compliant all year so renewal is straightforward.
Is ABCOM independently assessed?
Yes. To become an NCSC Assured Service Provider under the Cyber Advisor scheme, our advisers passed an independent assessment of their skills, run by IASME for the NCSC. ABCOM also holds IASME Cyber Assurance Level 2, which includes an independent audit. If you choose Cyber Essentials Plus, your own systems are also tested by an independent assessor.
Can you keep us compliant throughout the year?
Yes, as an option. Cyber Essentials is checked on the day your certificate is issued, but the declaration you sign confirms you’ll stay compliant for the whole year. With our systems installed on your devices, we keep security updates within 14 days, multi-factor authentication in place and devices supported all year, and flag anything that drifts, so renewal is a formality.
When do we need to complete Cyber Essentials Plus?
Within 3 months of your Cyber Essentials certificate being issued. The Plus audit tests the same controls on a sample of your devices, so if you’re aiming for Plus we plan both stages together to fit the 3-month window.
What happens if we fail Cyber Essentials?
If your assessment isn’t passed first time, you’re told what needs to change. We help you fix the issues and resubmit, and a free readiness check beforehand makes a fail much less likely.
Do you help businesses and charities in West Sussex with Cyber Essentials?
Yes. ABCOM is based in Burgess Hill and helps businesses and charities across West Sussex, Brighton and the wider South East to achieve Cyber Essentials, with remote support and on-site visits where needed.
More answers in our Cyber Essentials cost guide and Knowledge Hub.
Free readiness call
Book a free Cyber Essentials readiness call
Tell us a little about your organisation. We’ll tell you how close you are and what it will cost.
Prefer to pick a time yourself? Book a cyber security consultation in Yann's calendar →
What happens next?
- A short callWe go through your devices, cloud services and network in plain English.
- An honest readiness checkWe tell you whether you’re Light, Standard or Complex, and what needs fixing.
- A fixed quoteYou get a written price for the IASME fee and any help you need, with no obligation.
We reply to new enquiries within one working day, Monday to Friday, 8am–6pm.