Cyber Essentials Online: the complete UK guide for 2026

Cyber Essentials has been an entirely online scheme since its redesign in 2020. Every stage - the self-assessment questionnaire, the evidence submission, the assessor review, the feedback, the re-submissions, and the certificate itself - happens through a web portal. There is no site visit for the core Cyber Essentials scheme, and the required senior declaration is signed in the assessment portal; paper posting is not normally needed.

Despite that, a lot of UK organisations still think of Cyber Essentials as a paper exercise with an in-person assessor. It isn't. Doing Cyber Essentials online is not a shortcut or a lower-grade version of the scheme - it is the scheme. The self-led Basic assessment can be purchased through IASME or a supported route chosen with a licensed certification body.

This guide covers how online Cyber Essentials actually works, what to check when you choose a certification body, what the current UK market looks like on price and turnaround, and how to get it done quickly and properly without overpaying.

Cyber Essentials is a UK government-backed certification scheme created by the National Cyber Security Centre (NCSC) and delivered under licence by IASME. It assesses five technical controls:

1. Boundary firewalls and internet gateways

2. Secure configuration

3. User access control

4. Malware protection

5. Security update management

There are two levels. Cyber Essentials is a self-assessment verified by an IASME-licensed assessor. Cyber Essentials Plus adds hands-on technical testing by a suitably licensed Plus assessment body - vulnerability scans, a sample of device checks, and an authenticated scan of a representative endpoint. Both sit on the same self-assessment questionnaire; Plus is the same answers, independently verified.

The current scheme version is Cyber Essentials v3.3, effective 27 April 2026. If you hold an older certificate, the date on the certificate is what the NCSC verifies. Applications started before 27 April 2026 can continue under v3.2; check your portal account version.

When people search for "Cyber Essentials online" they usually mean one of three things: can I do the whole thing remotely; can I pay and start the assessment through a website; can I get the certificate without a consultant or a site visit. The answer to all three is yes, and has been for several years.

Here is what the end-to-end online process looks like in 2026:

1. Choose a certification body online. Use the live IASME directory to verify that the body holds the Cyber Essentials scheme licence. Licensed bodies operate through the same IASME assessment portal.

2. Buy the assessment online. Check the chosen provider's checkout, payment options, VAT handling and portal access; these vary by offer.

3. Complete the self-assessment questionnaire in the portal. The questionnaire is web-based, mobile-responsive, and auto-saves. Typical completion time for a prepared organisation is 60-90 minutes.

4. Submit the assessment. The body's assessor receives it through the portal. The provider's stated review clock starts under its own terms; preparation and non-compliant submissions are separate.

5. Receive feedback or the certificate. If the submission passes, the certificate is issued digitally and emailed. If the assessor flags gaps, you get written feedback through the portal under the package's stated feedback and resubmission terms.

6. Download the certificate and use the Cyber Essentials badge. Certificate PDF, badge graphics, and a verifiable entry on the IASME certificate search - all delivered online.

Nothing about this process requires you to leave your desk.

Cyber Essentials Plus online. The Plus audit itself still involves a technical assessor, but even Plus may be delivered remotely where the selected body can complete the required technical checks and agree suitable access. Confirm the method with that body. The same controls are being tested - the interaction has just moved off-site.

All IASME-licensed bodies assess against the same requirements and use the same portal. The differences are in speed, price, service, and transparency. Four things to look at before you pay.

1. Published pricing

Published pricing helps comparison. Quote-based packages can include preparation, Plus testing or a complex scope; ask for an itemised assessment price, VAT and support terms. A missing public price does not establish that a provider charges more.

2. Turnaround time, in writing

"A few days" is not a turnaround time. Ask for the maximum number of working hours between submission and feedback. A competent body will commit to a hard number. A good one will give you that number in writing on the order confirmation.

Published provider commitments differ, and preparation, clarification and remediation can change the total time. Compare dated written terms for a complete, compliant Basic submission on the same business-day basis; no single market range or queue explanation follows from those terms.

3. What happens if you fail the first submission

Feedback and resubmission entitlements depend on the selected package and scheme process. Different bodies handle them differently - some will give you written feedback with specific clauses and timestamps; some will give you a single line saying "failed on firewall question." The quality of feedback on a failed submission tells you more about a certification body than anything on their marketing site.

Ask directly: "If our submission fails, what does your feedback look like, and how many free re-submissions do we get?"

4. IASME licence verification

Check the named legal entity and relevant scheme permission on the IASME certification-body directory. Ask the provider or IASME to resolve an apparent mismatch before buying; only an appropriately licensed body can issue the certificate.

There is no official IASME-wide customer-price table for certification bodies. Check IASME's direct route and obtain dated offers from the providers you are considering. Compare the same staff-size tier, VAT, standalone assessment, preparation support, feedback and resubmission conditions. Plus testing is a separate scope.

Fig Group publishes Cyber Essentials from £299.99 + VAT for the Micro tier. Its price positioning refers to the named comparable standalone offers reviewed on the pricing page; the IASME body directory verifies licensing, not a full market price ranking.

A provider's end-to-end timing includes intake, assessor review, clarification and any remediation. Ask it to define when its clock starts and what happens if answers need correction.

Do not infer a market-wide queue from one offer. Compare written service levels against the same complete, compliant submission and business-day conditions.

Fig Group publishes a six-working-hour Basic certification guarantee after receipt of a complete, compliant submission before midday UK time on a UK Business Day, subject to certification terms. This is the fastest published SLA from any IASME-licensed certification body in the UK at the time of writing.

"Online means lower-quality." No. Online is the scheme. The assessment standard, the questionnaire, and the assessor's qualification are identical whether the work happens in person, by email, or through the IASME portal - the portal is how every IASME-licensed body is required to operate.

"We need a consultant to get certified online." Organisations that already meet the five controls do not need a consultant. They need a certification body with a good portal and clear feedback. Consultancy is valuable if there are genuine control gaps - it is not required for a well-prepared organisation.

"Cheaper certification bodies cut corners." Price alone does not prove assessment quality. Verify the current IASME licence, assessment scope, feedback terms and written process.

"Cyber Essentials Plus needs an in-person visit." Plus can be delivered fully remotely through authenticated scanning and screen-share. Ask the Plus body whether the required technical tests can be completed remotely for your estate.

If you want the fastest, cheapest legitimate route to a Cyber Essentials certificate in 2026:

1. Prepare first. Confirm you meet the five controls: NCSC's overview is the primary reference. The IASME scheme page publishes the full v3.3 requirements.

2. Run a free readiness check. Fig Group's readiness checker can flag possible gaps from your answers; it does not establish assessment readiness or detect every issue.

3. Buy online. Choose an IASME-licensed body with published pricing and a written turnaround. Buy Cyber Essentials from £299.99 + VAT.

4. Complete the questionnaire. Allow time based on your device and cloud inventory and the answers you need to verify. Save evidence as you go.

5. Submit and receive the certificate. With a 6-hour turnaround body, check the provider's cutoff, business-day definition and compliant-submission conditions.

Three measurable facts:

• Fastest. 6-hour turnaround on compliant submissions, the shortest published SLA from any IASME-licensed certification body in the UK.
• Cheapest. Cyber Essentials from £299.99 + VAT, the lowest published price for a standalone assessment from any IASME-licensed body in the UK as of April 2026.
• Best verified. Check the current public review profile directly; a rating needs a dated count and source. The Cyber Essentials licence is verifiable through its Blockmark badge and registry link on the trust page.

Three qualitative ones:

• Genuine online-native workflow. Payment, portal access, submission, feedback, and certificate are all handled digitally, without sales friction.
• Honest feedback on failed submissions. Fig Group includes three feedback rounds under its stated terms; check whether further submissions or remediation are needed.
• Transparent pricing and SLA. Both are published on the website, not gated behind a contact form.

Cyber Essentials online should be quick, cheap, and clear. Fig Group operates that way by design, and at the price and speed above.

Cyber Essentials is an online certification. Doing it online is not a compromise - it is the scheme, and in 2026 Fig Group publishes a Micro Basic price of £299.99 + VAT and a conditional six-working-hour guarantee. The variation in the UK market is in the certification body, not the standard. Pick one with published pricing, a written SLA, a verifiable IASME licence, and detailed feedback on failed submissions. That is the playbook.

Start Cyber Essentials from £299.99 + VAT | See all pricing | Run the free readiness checker | FAQ