There are two ways to certify for Cyber Essentials. On the self led route you register with IASME, pay, and complete a verified self-assessment that a board member signs and an assessor marks. On the supported route you hire an IASME licensed Certification Body to help you read the questions. Pick by how much interpretation help you want.
The two routes
The NCSC describes the self led route as register, pay, answer, then board sign off and assessor marking. The supported route uses a Certification Body licensed by IASME to help you understand the questions and assess whether you meet the requirements.
Which suits you
Self led fits when:
- you have someone technical who can read the requirements,
- your estate is small and simple,
- you want to keep costs down.
Supported fits when:
- nobody on the team has done this before,
- you have a mix of cloud services and devices and are unsure what is in scope,
- you need a date and want guidance to hold it.
This is our judgment, not scheme rules. Neither route changes the controls you must meet.
Step by step
- Download the question set and use the free readiness tool and resources the NCSC points to.
- For small and medium businesses, the NCSC page mentions a free 30 minute consultation. Check eligibility and current availability.
- Decide scope. Whole organisation certification is what the NCSC links to the free cyber liability insurance for qualifying UK organisations under 20 million pounds turnover.
- Choose your route and register.
- Answer from facts. Check settings on real devices.
- Get the sign off from a board member or equivalent before submitting.
- If a buyer wants Plus, plan for the independent testing next. See base level vs Plus.
Common stumbles
Answering from memory is the most common. Devices drift. A quick settings check often reveals an unsupported system or a shared account.
Another is scope creep or scope cutting. Excluding something awkward may defeat the reason a customer asked.
Finally, no one owns the date. Put a named person in charge.
Check certificates
The NCSC points to IASME's certificate search to verify existing certificates, which is useful when a supplier claims to hold one.
Quick check
Who signs off the self led route?
A board member or equivalent signs off the answers, and an assessor marks them.
Does the supported route change the requirements?
No. It adds help interpreting and assessing against the same requirements.
Sources
Last reviewed: 19 October 2026.
