Cyber Essentials
for UK SMEs
Get certified with clear prices, practical help and a local team. We check where you are, fix the gaps and guide you through the IASME assessment, then help you stay certified every year.
- NCSC Assured Service Provider
- ABCOM is itself Cyber Essentials certified
- IASME fee from £320 + VAT
- Readiness help from £395 + VAT
Verified on the NCSC websiteAn NCSC Assured Service Provider
ABCOM is an NCSC Assured Service Provider under the Cyber Advisor (Cyber Essentials) scheme, which covers helping organisations put the five Cyber Essentials controls in place.
- Practical, plain-English advice for small businesses and charities
- Our Cyber Advisors are independently assessed by IASME for the NCSC
- IASME Cyber Assurance Level 2, independently audited
- A Burgess Hill team supporting businesses since 1996, with on-site visits when needed
- Optional continuous compliance, with our systems keeping you compliant all year
- Free 20-minute cyber security review to start
The five Cyber Essentials controls
- Q1
Firewalls
Block unauthorised access.
- Q2
Secure configuration
Remove defaults and unused accounts.
- Q3
Security updates
Patch high-risk issues within 14 days.
Miss this: automatic failPass with ABCOM - Q4
User access control
Least privilege and MFA.
Miss this: automatic failPass with ABCOM - Q5
Malware protection
Protection on every device.
Under the new Danzell question set, missing multi-factor authentication on cloud services, or high-risk updates not applied within 14 days, now means an automatic fail. The five controls themselves haven’t changed.
Would you pass today? Take the free quiz →Most UK organisations aren’t protected yet
Cyber Essentials covers the basic controls that stop most common attacks, such as phishing and password guessing. Few businesses have all five in place.
of UK businesses had a breach or attack in the last 12 months
of businesses faced phishing, the most common attack
of businesses have controls in all five Cyber Essentials areas
of businesses hold Cyber Essentials certification
Source: Cyber Security Breaches Survey 2025/26, DSIT and Home Office.
Win more work
Required for many UK government contracts, and more customers ask suppliers for it.
Cyber insurance included
Eligible UK organisations under £20m turnover that certify their whole organisation can get cyber liability cover with the IASME certificate.
Show you take security seriously
A recognised certificate for customers, funders, trustees and insurers.
How much does Cyber Essentials cost?
There are two parts: the IASME certification fee, which is fixed by organisation size and paid each year, and any help you need to get ready. All prices exclude VAT.
IASME certification fee
Set by IASME and paid annually. Includes the assessment of your self-assessment questionnaire.
ABCOM readiness guidance
Only what you need. We confirm a fixed price after a free readiness call.
Small-business IASME fee (£440) plus Standard readiness guidance (£450–£695).
Book a free readiness callAn estimate. We confirm a fixed price after a free readiness call.
Cyber Essentials Plus adds a hands-on audit and is quoted separately, based on the number of devices and sites in scope. See the full price table →
From first call to certificate
Most organisations that are already close can be certified within days. If there are gaps to fix, it typically takes a few weeks.
- Step 1
Free readiness call
We talk through your devices, cloud services and network, and tell you honestly how close you are.
- Step 2
Fix the gaps
We set up MFA, update or replace unsupported devices, tighten firewalls and admin access, and harden Microsoft 365.
- Step 3
Complete the assessment
We guide you through the IASME questionnaire so your answers are accurate and complete.
- Step 4
Certified, and kept current
You get your certificate for 12 months, and we remind you before renewal.
Continuous compliance, all year round
Cyber Essentials is checked on the day your certificate is issued, but you’re expected to stay compliant for the whole year. With our systems installed on your devices, we keep updates within 14 days, MFA switched on and devices supported throughout the year, and flag anything that drifts. Renewal then becomes a formality.
Ask about continuous complianceCyber Essentials or Cyber Essentials Plus?
Both cover the same five controls. Plus adds an independent, hands-on check of your systems.
Cyber Essentials
Like sitting the written paper.
Verified self-assessment questionnaire
✕No
Days, if you’re already ready
12 months
IASME fee from £320 + VAT, plus any readiness help
Most small businesses and charities
Cyber Essentials Plus
The written paper, then an examiner checks your work.
Same questionnaire plus a hands-on technical audit
✓Vulnerability scans and device checks by an assessor
Must be completed within 3 months of Cyber Essentials
12 months
Quoted by the number of devices and sites in scope
Government contracts, larger supply chains and higher-risk sectors
The Cyber Essentials Plus audit must be completed within 3 months of your Cyber Essentials certificate being issued. If you’re aiming for Plus, we plan both together so you don’t miss the window.
What Our Clients Say
Helping a fast-growing facilities firm stay ahead
Facilities management firm, 40+ staff
The challenge
Outdated systems and ad-hoc support couldn’t keep up with growth; the directors needed stability, security and compliance fast.
What we did
Rolled out fully managed IT: Microsoft 365, SharePoint and Teams, real-time monitoring, secure backups, a managed firewall and Cyber Essentials.
- Cyber Essentialsachieved for client assurance
- 40+ staffworking remotely
- Ongoingproactive support
“Having a whole office work remotely at a flick of a switch is not something that is ever going to be easy, but the headache of the IT side was taken away.”James, General ManagerRead the case study →
of secure, compliant IT for a dental practice
Family Dental, Crawley
“Working within the healthcare sector, security, compliance and reliability are absolutely critical. ABCOM understood those requirements from day one. As cybersecurity and regulatory compliance became increasingly important, ABCOM helped us navigate those challenges with confidence.”Kay, Practice ManagerRead the case study →
Book a free Cyber Essentials readiness call
Tell us a little about your organisation. We’ll tell you how close you are and what it will cost.
Book a free readiness callPrefer to pick a time yourself? Book a cyber security consultation
What happens next?
- A short callWe go through your devices, cloud services and network in plain English.
- An honest readiness checkWe tell you whether you’re Light, Standard or Complex, and what needs fixing.
- A fixed quoteYou get a written price for the IASME fee and any help you need, with no obligation.
We reply to new enquiries within one working day, Monday to Friday, 8am–6pm.
Cyber Essentials questions
Is the first consultation free?
Yes. We offer a free 20-minute discovery call with one of our Cyber Advisors. We look at your devices, cloud services and network, tell you how close you are to Cyber Essentials, and explain what would need fixing. There’s no obligation, and you get a fixed quote afterwards. Find out about the free review or book your call.
How much does Cyber Essentials cost?
The IASME certification fee is £320 + VAT for micro organisations (1–9 employees), £440 for small (10–49), £500 for medium (50–249) and £600 for large organisations (250+). If you need help getting ready, ABCOM’s readiness guidance starts from £395 + VAT, depending on complexity. We confirm a fixed price after a free readiness call.
How long does it take to get Cyber Essentials?
If your systems already meet the requirements, you can complete the online self-assessment and be certified within days. If there are gaps to fix, such as setting up multi-factor authentication or replacing unsupported devices, it typically takes a few weeks.
How long does certification last?
Certification lasts 12 months. You need to renew every year to stay certified, and the requirements are updated from time to time, so each renewal is a good opportunity to check your security is still up to date.
Cyber Essentials or Cyber Essentials Plus?
Cyber Essentials is a verified self-assessment. Cyber Essentials Plus covers the same five controls but adds a hands-on technical audit, including vulnerability scans and device checks, carried out by an assessor. Cyber Essentials Plus must be completed within three months of achieving Cyber Essentials.
Does Cyber Essentials include cyber insurance?
UK organisations with an annual turnover under £20 million that certify their whole organisation may be eligible for free cyber liability insurance included with the IASME certification. The terms are set by the insurer and are confirmed when you certify.
Is Cyber Essentials mandatory?
It is voluntary for most organisations, but it is required for many UK government contracts that involve handling personal or sensitive information, and more and more businesses ask their suppliers for it. It is also a clear way to show customers, funders and insurers that you take security seriously.
What changed in Cyber Essentials in April 2026?
The Danzell question set replaced the previous Willow question set for assessment accounts created after 26 April 2026. The five controls haven’t changed, but marking is stricter: missing multi-factor authentication on any cloud service where it’s available, or high-risk and critical updates not installed within 14 days, now means an automatic fail. Organisations also need to describe their scope in more detail, list the legal entities included, and the director’s declaration now confirms you’ll stay compliant for the whole certification year. Cyber Essentials Plus retests now check a fresh sample of devices. Accounts created before the change had six months to certify under Willow.
Why choose ABCOM for Cyber Essentials?
We’re an NCSC Assured Service Provider under the Cyber Advisor (Cyber Essentials) scheme, we hold IASME Cyber Assurance Level 2, and we’ve supported businesses and charities from Burgess Hill since 1996. As your IT provider we can fix the gaps ourselves, rather than just telling you about them, and we can keep you compliant all year so renewal is straightforward.
Is ABCOM independently assessed?
Yes. To become an NCSC Assured Service Provider under the Cyber Advisor scheme, our advisers passed an independent assessment of their skills, run by IASME for the NCSC. ABCOM also holds IASME Cyber Assurance Level 2, which includes an independent audit. If you choose Cyber Essentials Plus, your own systems are also tested by an independent assessor.
Can you keep us compliant all year?
Yes, as an option. Cyber Essentials is checked on the day your certificate is issued, but the declaration you sign confirms you’ll stay compliant for the whole year. With our systems installed on your devices, we keep security updates within 14 days, multi-factor authentication in place and devices supported all year, and flag anything that drifts, so renewal is a formality.
When do we need to complete Cyber Essentials Plus?
Within 3 months of your Cyber Essentials certificate being issued. The Plus audit tests the same controls on a sample of your devices, so if you’re aiming for Plus we plan both stages together to fit the 3-month window.
What happens if we fail Cyber Essentials?
If your assessment isn’t passed first time, you’re told what needs to change. We help you fix the issues and resubmit, and a free readiness check beforehand makes a fail much less likely.
Do you help West Sussex businesses and charities?
Yes. ABCOM is based in Burgess Hill and helps businesses and charities across West Sussex, Brighton and the wider South East to achieve Cyber Essentials, with remote support and on-site visits where needed.
More answers in our Cyber Essentials cost guide and Knowledge Hub.