The straightforward version
Cyber Essentials is not meant to turn a small business into a security department. It checks five sensible controls that stop many common attacks: secure firewalls, safe settings, controlled access, malware protection and prompt security updates.
The certificate is useful when a customer, tender, insurer or board wants independent evidence that those basics are in place. It is also a practical deadline for fixing security jobs that have been sitting on a list for too long.
Our role is simple: work out what you actually need, find the gaps before the assessor does, and make the route to certification manageable.
Nerdster holds Cyber Essentials itself, so every year we renew against the same question set we prepare clients for. Our certificate is listed in an independent registry, linked in the footer of this page. Your own certificate is issued by an IASME-licensed certification body, not by us.
Book a free 15-minute readiness call if you have a deadline, or ask for a fixed quote if you already know which level you need.
Cyber Essentials or Cyber Essentials Plus?
For the technical testing route, see our dedicated Cyber Essentials Plus service.
There are two levels. The right one is normally decided by the wording in your contract—not by which badge sounds more impressive.
|
Cyber Essentials |
Cyber Essentials Plus |
| How it is checked |
Your self-assessment is independently reviewed |
A qualified assessor also tests the controls |
| Best for |
General supplier checks, insurance and a security baseline |
Contracts or customers that explicitly require stronger assurance |
| Technical audit |
No hands-on audit |
Device sampling, vulnerability checks and control testing |
| Valid for |
12 months |
12 months |
| Nerdster package, 1 to 9 people |
Guided £495 + VAT · Ready £1,315 + VAT |
Duo – Guided £1,895 + VAT · Plus – Ready £3,115 + VAT |
If somebody asked only for “Cyber Essentials”, standard certification is usually the answer. We will not recommend Plus unless the requirement names it or the additional assurance makes sense for your organisation.
You cannot skip the first level and buy Plus on its own. Cyber Essentials comes first, and IASME says the Plus audit can be completed within three months of it, so the two are best planned as a single project. Not sure Plus is realistic yet? Read what the Plus assessor tests or try the free Plus readiness checker.
What you are paying Nerdster to do
You are not paying us merely to send you a questionnaire. Depending on the package, we:
- confirm which devices, people, networks and cloud services belong in scope;
- review the answers and evidence before the assessor sees them;
- find blockers such as unsupported software, missing MFA or weak admin access;
- turn the gaps into a practical, prioritised remediation plan;
- coordinate the certification and answer technical questions; and
- prepare Plus customers for the hands-on audit.
What the price covers
Every Nerdster package price already contains the certification body fee, so there is no second invoice for the certificate. For comparison, the NCSC says self-led certification starts at £320 + VAT, depending on the size of the organisation. Prices below are for 1 to 9 people.
- Cyber Essentials – Guided, £495 + VAT. Adds an assessor review of your answers before submission, policy templates for the five controls, and email and chat support. For organisations whose controls are already in place.
- Cyber Essentials – Ready, £1,315 + VAT. Adds the hands-on work: a gap review against the current question set, remediation of failing controls such as MFA, patching, admin accounts and device configuration, and an evidence pack.
- Cyber Essentials – Managed, £1,025 a year + VAT (year one £1,610 including onboarding). Certification every year, plus device monitoring, third-party patching, policies and staff training in between.
Our aim is a pass at the first attempt; if an answer is marked down, we correct it and resubmit with you. Work beyond the package is scoped separately because one business may need two settings changed while another needs an operating system upgrade across fifty devices. Every price is listed by organisation size on the pricing page.
What is included—and what is separate
Every proposal shows the certification fee, Nerdster’s work and any likely third-party costs as separate lines.
Included in the chosen package: the certification body fee, the work listed on the pricing card and a written scope.
Potentially separate: fixing technical gaps, replacing unsupported devices or software, new security licences, an in-person Plus audit, or work outside the agreed organisation and network scope.
Nothing starts without approval. If the readiness call shows that you can sensibly complete the self-led route, we will say so.
The five blockers we find most often
Most delays are ordinary and fixable:
- MFA is missing on one cloud service or administrator account.
- Software is out of support, even though it still appears to work.
- Critical patches miss the 14-day window on laptops that rarely connect to the office.
- Nobody has a complete device or cloud-service list, so the assessment scope is wrong.
- Everyday users have administrator access they no longer need.
Password rules cause more confusion than they should; see the Cyber Essentials password requirements.
Finding these before the assessment is cheaper and calmer than discovering them after the submission clock has started.
How the project runs
- Free readiness call. We ask why you need certification, your deadline, headcount and current IT setup.
- Written scope and price. You see what is included, what may be separate and the assumptions behind the quote.
- Readiness review. We check the environment against the current questions and technical requirements.
- Fix and evidence. Your IT team or ours closes the agreed gaps and gathers the right evidence.
- Assessment and certificate. We support the submission and, for Plus, coordinate the technical audit.
A reasonably well-managed environment often completes in two to four weeks. We quote a wider two-to-six-week range because legacy software, unmanaged personal devices and unclear cloud ownership can add work. A fixed date is confirmed only after we understand the scope.
Current 2026 requirements
Applications started from 27 April 2026 use version 3.3 of the NCSC Requirements for IT Infrastructure and the Danzell question set.
The practical message is not “buy more security software”. It is to make sure cloud services are included in scope, MFA is applied correctly, accounts are controlled and supported software is updated on time. We check the live requirements when your project starts instead of relying on last year’s answers.
For the detail, read what changed in Cyber Essentials v3.3. If you want a quick indication of readiness first, use the free Cyber Essentials readiness checker.
Supplying the Ministry of Defence? Cyber Essentials is also the foundation of every level of Defence Cyber Certification (DCC), which the MOD has asked its suppliers to hold at Level 0 by 31 December 2026.
Renewing your certificate
A Cyber Essentials certificate lasts 12 months and does not renew itself. If it is not renewed within that period, the organisation is removed from the NCSC’s list of certified organisations.
Renewal is a fresh assessment against the question set in force when your assessment account is opened, not a copy of last year’s answers. If you last passed under the Willow question set, the cloud MFA rules are stricter now: see what changed.
Timing matters in both directions. IASME says the new certificate runs for 12 months from the date of the new submission, not from the old expiry date, so renewing very early shortens the year you have paid for. We suggest starting six to eight weeks before expiry: enough time to fix a gap, without giving up months of cover.
With Cyber Essentials – Managed, certification is included every year and your devices are monitored and patched in between, so renewal is a scheduled submission, not a project. Otherwise, a Guided or Ready package covers a single renewal.
Ready to make a sensible plan?
Bring us the contract wording, renewal date or customer request. We will tell you which level you need, whether the timeline is realistic and what the first step should be.
Book a free 15-minute Cyber Essentials call or request a fixed quote. No obligation, and no pressure to buy Plus when standard certification is enough.
If you already have an IT provider, bring them into the conversation. We are happy to handle the certification while they complete the technical work.
