Cyber Essentials for MSPs: The Partner Program That Pays You Margin Without the IASME Licensing Burden

A partner route lets an MSP retain the client relationship while Fig Compliance Ltd performs the certification assessment under its relevant scheme licence. Certification, the Fig Technology Ltd platform and the MSP’s remediation work are separate responsibilities. Confirm customer consent, communications, scope and the applicable partner agreement before originating an order.

The Basic guarantee: Fig Group issues Cyber Essentials within six working hours of receiving a complete, compliant submission before midday UK time on a UK business day. Purchase, preparation, clarification, remediation and customer response time do not form part of that clock. Three rounds of assessor feedback are included; this is not unlimited certification attempts. A human assessor makes the certification decision. Read the service terms.

The reviewed current website programme uses 7.5% for qualifying certification revenue and 15% for qualifying platform or licence revenue, with monthly commission handling under the applicable partner terms. It does not use the former rolling-volume Tier 1–4 cash tables. The percentage base, exclusions, attribution, payment timing and any reversals must be clear in the accepted agreement; a website illustration does not change an existing signed partner deal.

The customer’s actual accepted quote or order determines the certification amount. Current portfolio quotes can apply volume adjustments dynamically. Historic saved catalogue price references are not authority to charge an old price, and this article does not authorise changing existing subscriptions or signed agreements.

Illustrative economics

If the applicable commission base is £1,000 of qualifying certification revenue, 7.5% is £75. If the applicable base is £1,000 of qualifying platform revenue, 15% is £150. These are arithmetic examples, not promised annual income, customer volumes or a claim that every VAT-inclusive invoice qualifies in full.

For net economics, also allow for the MSP’s preparation, remediation, customer support and administration. Compare that cost with the actual licensing, staffing and scheme obligations of becoming a certification body. Capturing the full customer fee is not the same as earning that amount as profit.

• Certification only: one-off Basic or Plus assessment without a compulsory Fig Group platform subscription.
• Platform only: use governance and compliance tooling with your existing assessment relationship, subject to its evidence requirements.
• Both: agree certification scope and platform access as distinct parts of the service.
• Portfolio arrangements: request a quote using actual staff bands, assessment types, customer numbers and platform packages. Monthly payment and deferred starts require agreed terms; a monthly instalment may still have a longer commitment.

Our cheapest positioning concerns the published standalone Basic Micro price among the named comparable offers, from £299.99 + VAT. It does not prove the cheapest combined annual platform arrangement for every MSP. Our fastest positioning concerns the qualifying Basic commitment; a Plus audit or DCC assessment has separate scheduling and assessment requirements.

Agree who obtains client sign-off, owns evidence permissions, communicates assessor feedback and performs technical remediation. White-label communications can be discussed in the agreed scope. They do not conceal the licensing body or change who is responsible for certification. Do not assume that an old volume tier automatically grants full white-label access or a particular portal entitlement.

Verify the relevant scheme through the IASME certification-body directory and licence evidence. Separate Cyber Essentials, Plus and DCC licences rather than treating one identifier as authority for every product.

Annual Cyber Essentials renewal requires current scope and the applicable questionnaire, including changes to devices, cloud services, users and technical controls. Prior evidence can help preparation, but renewal is not a guaranteed 20-minute delta review or a shorter official assessment. Use the expiry date on the issued certificate and plan ahead.

Plus requires valid matching Basic certification and technical verification. The prepared-assessment target is 2–3 working days, subject to scheduling, device access and remediation. One formal retest within 30 days is included under the Plus terms. Basic’s three feedback rounds do not mean three Plus technical retests.

A customer, tender, regulated service or insurer may ask for certification. Check the written requirement, scope and deadline rather than assuming that every MSP, NHS supplier, SJP partner or insurance renewal has the same mandate. PPN 014 applies to specified in-scope government procurement. Regulatory and customer-specific requirements need their own evidence.

1. Confirm the customer’s requirement and readiness.

2. Agree customer permissions, service responsibilities and communications.

3. Select the correct size band and assessment family.

4. Review the current quote, commission basis, payment arrangements and commitment.

5. Submit implemented controls accurately and resolve any assessor feedback.

No cohort-backed 100% future-pass promise or guaranteed same-day remediation is made here. Certification depends on satisfying the scheme; the MSP’s remediation service can help the customer get ready.

Discuss the MSP partnership | Calculate portfolio pricing | Buy one-off Cyber Essentials