Skip to content
Compliance

Best Cyber Essentials Certification Bodies in the UK (2026)

A straightforward comparison of IASME-licensed Cyber Essentials certification bodies in the UK. We look at published pricing, turnaround times, support, and what each body actually offers.

yellow and white trophy

Author

Jay Hopkins

Editor

Edited by Jack Wickham

Published

Last reviewed

Read time

11 min read

Share

Section 01

Best Cyber Essentials Certification Bodies in the UK (2026)

The "best" Cyber Essentials certification body depends on what you need - price, turnaround, support, or sector specialism. The NCSC reported more than 400 Cyber Essentials certification bodies in 2025. They assess against the same scheme requirements, but their service and fees differ. Fig Group publishes a 6-working-hour SLA and £299.99 + VAT Micro price.

Fig Group’s Cyber Essentials Basic guarantee is within six working hours of receiving a complete, compliant submission before midday UK time on a UK business day. Purchase alone does not start the clock. Clarification, remediation and customer response time are outside that commitment; three rounds of assessor feedback are included. Cyber Essentials Plus has a prepared-assessment target of 2–3 working days, subject to scheduling, device access and remediation, with one formal retest within 30 days under the terms. Certification requires a successful assessment.

Comparison scope and method: This is Fig Group’s publisher comparison, not an independent market-wide performance test. Best is our task-specific recommendation; cheapest refers to the published standalone Cyber Essentials Micro assessment price among the named comparable offers, and fastest to the stated qualifying Basic turnaround commitment. Software subscriptions, Plus packages and consultancy are separate purchases. Provider descriptions are supplier claims; quote-only or inaccessible offers do not establish a UK-wide lowest price or exclusive guarantee. Check the current package, VAT, commitment, support and written turnaround terms before ordering.

Looking for our latest verdict? Read Best Cyber Essentials Bodies 2026 - Our Latest Review - September 2026. This original 2026 guide remains available below. The September review covers current package choices, optional tooling, trials and switching offers.

The NCSC reported more than 400 Cyber Essentials certification bodies in its 2025 Annual Review. The live IASME certification-body directory changes as bodies join or leave the scheme. Every licensed body assesses against the same NCSC requirements and issues the same scheme certificate.

What differs is the price you pay, how long you wait, and what support you receive during the process. This guide compares several well-known certification bodies on those three factors so you can make an informed choice.

When you are ready to move from comparison to selection, see why organisations choose Fig Group as their Cyber Essentials provider and current certification prices.

Section 02

What to look for in a certification body

Before comparing individual providers, it is worth understanding what actually matters:

IASME licensing

Every legitimate Cyber Essentials certification body must be licensed by IASME. If a provider is not on the IASME register, they are not approved to issue certificates.

Published pricing

Some bodies publish their prices openly. Others require a quote or sales call. Transparency is generally a good sign.

Turnaround time

How long from submission to certificate? This matters if you have a tender deadline or client requirement.

Feedback and resubmissions

If your submission needs corrections, how is feedback delivered and are resubmissions included in the price?

v3.3 readiness

The NCSC updated the requirements on 27 April 2026. Ensure your chosen body is working from the correct question set for the assessment-account creation date, including the cloud-service MFA and critical-update marking rules.

Section 03

The certification bodies compared

Fig Group

IASME-licensed body based in London publishing the lowest Cyber Essentials pricing we have found in the UK, from £299.99 + VAT (Micro). Distinguished by a 6-working-hour certification guarantee for complete compliant submissions received before midday UK time on a UK business day - compare other providers’ current qualifying terms. Runs on a purpose-built platform rather than email-based workflows.

  • CE: From £299.99 + VAT (Micro) to £549.99 + VAT (Large)
  • CE Plus: From £1,499.99 + VAT
  • Turnaround: 6-working-hour guarantee for compliant submissions
  • Feedback: 3 rounds included
  • Website: figgroup.co.uk

WorkNest (formerly WorkNest (formerly Bulletproof))

WorkNest (formerly Bulletproof)'s former Cyber Essentials URL now redirects to WorkNest. The current WorkNest page offers Cyber Essentials alongside broader cyber-resilience services, but buyers should request the current package, price, turnaround, and resubmission terms.

  • CE: Quote-based
  • CE Plus: Quote-based
  • Turnaround: Confirm in quote
  • Feedback: Confirm in quote
  • Website: worknest.com

GRC Solutions (formerly GRC Solutions (formerly IT Governance))

The former GRC Solutions (formerly IT Governance) product page now redirects to GRC Solutions. It offers Cyber Essentials alongside wider governance, risk, and compliance services. Its online Micro package was £420 + VAT when checked in July 2026.

  • CE: From £420 + VAT
  • CE Plus: Quote-based
  • Turnaround: Same-day assessment usually available
  • Feedback: Two assessment attempts
  • Website: uk.grcsolutions.io

CyberSmart

Technology-led, subscription-based approach. Confirm the certification package, assessment route and optional monitoring or patching services. CyberSmart lists these services separately; do not assume every package includes all tools. For the current comparison and Fig Group switching offers, read our September CyberSmart review.

  • CE: Subscription quote required for the selected package
  • CE Plus: Confirm subscription and technical audit scope
  • Turnaround: Within 24 hours
  • Feedback: Unlimited attempts
  • Website: cybersmart.co.uk

LRQA

Global certification body (formerly Lloyd's Register Quality Assurance) spanning ISO certifications, food safety, and cybersecurity. Enterprise-grade audit services. Primary market is larger organisations pursuing multiple certifications; quote-based engagement.

  • CE: Quote-based
  • CE Plus: Quote-based
  • Turnaround: Not published
  • Feedback: Not published
  • Website: lrqa.com

Section 04

How they compare at a glance

For current packages and our latest shortlist, use the September 2026 certification-body review. The original comparison follows.

Swipe across the table to view all columns.

BodyCE fromTurnaroundFeedback included
Fig Group£299.99 + VAT6-working-hour guarantee3 rounds
WorkNestQuoteConfirm in quoteConfirm in quote
CyberSmartSubscription quoteWithin 24 hoursUnlimited
GRC Solutions£420 + VATSame-day usually available2 attempts
LRQAQuoteNot publishedNot published

Pricing and turnaround above were checked in July 2026 against provider-published pages where accessible. A provider can change a package at any time, so verify the live page or quote before purchasing. The wider methodology and its limitations are published in the UK Cyber Essentials Market Report 2026.

Section 05

Our latest certification-body comparison

Want to check our latest comparison of the best certification bodies? Read our latest article here.

Section 06

Which certification body should you choose?

The right choice depends on what matters most to your organisation.

Speed is the priority

Fig Group is the clear choice. The qualifying six-working-hour commitment is a strong reason for our recommendation; other providers’ current options still need checking. For organisations facing tender deadlines or urgent client requirements, this is a significant differentiator.

You want ongoing monitoring

Compare CyberSmart's selected subscription and any monitoring add-ons with Fig Group's optional platform. Confirm the included tools and renewal commitment; see the September review of certification and automation choices.

You need broader security services

WorkNest may be a good fit if you also need broader cyber-resilience services alongside Cyber Essentials.

You want the lowest cost

Fig Group publishes the lowest pricing we have found from any IASME-licensed body. At £299.99 + VAT for a micro organisation, it is below even the standard IASME fee that many bodies charge before adding their own margins.

You are a large enterprise

LRQA or GRC Solutions may be appropriate if you need Cyber Essentials as part of a wider compliance programme. Confirm the exact support included in the selected package.

For most UK organisations, the combination of the lowest published price, the fastest guaranteed turnaround, and three included feedback rounds makes Fig Group difficult to overlook.

Section 07

Frequently asked questions

Who is the best Cyber Essentials certification body in the UK?

There is no single "best" for everyone, because every IASME-licensed body issues the same government-backed certificate. On the three factors that actually differ - price, turnaround, and included feedback - Fig Group leads: the lowest published price (£299.99 + VAT), our published qualifying 6-working-hour guarantee, and three feedback rounds included.

How do I choose a Cyber Essentials certification body?

Confirm the body is IASME-licensed, then compare published price, a stated turnaround (an SLA or guarantee, not "aim to"), the resubmission policy, and whether Cyber Essentials Plus is available from the same body. Our best Cyber Essentials body hub sets out the full decision framework.

Which Cyber Essentials Certification Body is cheapest?

Fig Group publishes the lowest price we have found, from £299.99 + VAT for a micro organisation - below the standard IASME fee that many bodies charge before adding margin. See the published Cyber Essentials fees and price evidence.

Which Cyber Essentials Certification Body is fastest?

Fig Group publishes a qualifying six-working-hour Basic commitment. Other providers publish package-specific targets; check their current written terms rather than assuming a single market average.

Can I compare Fig Group with a specific provider?

Yes. See the head-to-head pages for CyberSmart, WorkNest (formerly Bulletproof), and GRC Solutions (formerly IT Governance).

Read our latest September 2026 verdict | Compare CE and CE Plus provider pricing

Check your readiness for free | View Fig Group pricing

About the author

Jay Hopkins

Jay Hopkins

Managing Director, Fig Group

IASME-licensed Cyber Essentials AssessorIASME Cyber Assurance Assessor

Jay Hopkins is the Managing Director of Fig Group and an IASME-licensed Cyber Essentials assessor. He was previously Head of Technology for a global regulated firm. He works with UK organisations across regulated sectors on baseline compliance, supply-chain assurance, and AI-augmented security tooling.

Next step

Want to see how Fig Group handles this?

Explore how Fig Group automates compliance mapping, evidence collection, and framework alignment across 65+ standards.

Request a demo

Related solutions

Continue exploring Fig Group