How to choose a Cyber Essentials certification body — when they all issue the same certificate

First, verify the badge — then ignore it

Any provider you consider should appear on IASME's directory of licensed certification bodies (IASME runs the scheme in partnership with the National Cyber Security Centre). Thirty seconds confirms it. After that, the badge tells you nothing more — every listed body can issue exactly the certificate a contract demands — so everything below is about how they'll treat you on the way.

The seven checks

1. Is the price published — and complete?

The honest ones publish a fixed figure and say what it includes: the assessment fee, the scheme/IASME element, VAT, and any support. The others say “contact us for a quote”, which usually means the price depends on how you sound on the phone. Insist on the all-in number in writing before you start.

2. What's the turnaround — in writing?

Basic Cyber Essentials is a verified self-assessment: once submitted, marking should take days, not weeks. Ask for the service standard in writing, and — if you're certifying for a tender deadline — say so and get the commitment against your date.

3. What happens if an answer isn't compliant?

This is the check that matters most and gets asked least. Some bodies simply fail non-compliant answers and charge for reassessment; better ones give feedback and a window to fix and resubmit. Ask exactly: how many resubmission rounds are included, within what period, at what cost? The answer predicts your whole experience.

4. Will a human help before you submit?

The questionnaire's language — scope, firewalls, user access control — trips up perfectly well-run small firms (see why applications fail). Check whether pre-submission support is included, costed, or “not our role”. A named contact beats a ticket queue.

5. Does the support cover remediation, or just paperwork?

If the readiness review finds a gap — an unsupported operating system, missing MFA — will they tell you what to fix and how, or hand you a failure and a shrug? “Done-for-you” should mean guided to a pass, not merely form-filled.

6. What do their customers say about the awkward moments?

Reviews that mention resubmissions, deadlines met, or questions answered are worth ten times the star average. You're reading for how they behave when something goes wrong — because on a first certification, something usually does.

7. Do they practise what they certify?

Ask whether the provider's own organisation holds Cyber Essentials. It's a small tell with a long shadow: a certification specialist that hasn't bothered with its own certificate is telling you what it really thinks of the standard.

How PassCyber answers its own seven checks

Fair's fair — judge us by the same list: fixed all-in price published on our pricing section (assessment, scheme fee and VAT stated); service standard in writing when we engage; feedback-and-fix support through resubmission included, not chargeable; a named contact (you'll deal with the same person throughout); remediation guidance in plain English before anything is submitted — our free readiness check exists so you see the gaps before spending a pound; and yes, our own house is certified — we'd find it odd to sell what we don't hold. Certificates themselves are awarded by an IASME-accredited certification body, and we support you through that process; where you'd rather go elsewhere, take this checklist with you — it works on anyone.

The one-page version

Confirm the IASME listing, then choose entirely on service: published all-in price, written turnaround, a real resubmission policy, human help before submission, remediation guidance included, reviews that mention the awkward moments, and a provider certified themselves. Same certificate everywhere — very different journeys.