Get help with Cyber Essentials
Start with a free 20-minute call
Tell us why you need Cyber Essentials (a tender, an insurer, a defence contract or a client questionnaire), how many staff and devices you have, and your deadline. In 20 minutes we’ll tell you straight what’s involved, what needs fixing and what it will cost.
1. Fixed-price Cyber Essentials preparation
Basic Cyber Essentials is a verified self-assessment, but answering “yes” when a setting isn’t actually in place breaches the director’s declaration — and answering “no” on Multi-Factor Authentication (MFA) or 14-day patching fails the assessment automatically. We do the technical work first so your answers are accurate and compliant:
- Scope review: Defining your legal entities, locations, home workers, devices and cloud services under the v3.3 rules, and documenting any segregated exclusions.
- Gap check against Danzell (v3.3): Checking all three auto-fail areas (cloud MFA, 14-day OS/firmware patching, 14-day app patching) plus admin accounts, firewalls, passwords and malware protection.
- Microsoft 365 hardening: Configuring MFA and Conditional Access (or Security Defaults), separate cloud-only admin accounts, Windows LAPS, and Intune update rings and device compliance policies.
- Evidence pack: Policies and asset, cloud and admin registers to support your answers and the director’s declaration.
- Assessment walkthrough: Helping you complete the question set clearly before your director signs it off.
Fixed preparation pricing (+ VAT)
Our one-off Guided Cyber Essentials preparation starts from £295 + VAT, or is included in our £395 + VAT/month Monthly Cyber Posture plan. We confirm your exact fixed total before we start.
IASME assessment fee: Paid separately according to the total number of employees in your scope (£320 + VAT for 1–9 staff, £440 + VAT for 10–49, £500 + VAT for 50–249, £600 + VAT for 250+). We are not a certification body: your assessment is marked and your certificate is issued by an IASME-licensed Certification Body.
2. Cyber Essentials Plus preparation
Cyber Essentials Plus (CE+) adds a hands-on technical audit within 90 days (3 months) of your basic certificate (IASME FAQ): an independent assessor scans your devices for unpatched vulnerabilities and tests your email and web malware protection.
Under the April 2026 Danzell rules (IASME), you cannot change your self-assessment answers once Plus testing starts. Worse, if any device in the auditor’s sample fails the patching check, the retest covers both the original sample and a brand-new random sample of devices — and failing that retest revokes your basic Cyber Essentials certificate too. We run pre-audit vulnerability checks and remediate third-party app gaps across every device so your sample passes first time.
3. Staying compliant all year
Under Danzell, the board member or director who signs the assessment now formally declares that the organisation will keep all five controls in place for the entire 12-month certification period, not just on assessment day. If you want us to look after updates, MFA, device compliance and annual renewal year-round, see AlphaSec and Alphabyte IT.
4. Also free: our 28-point Microsoft 365 security audit
If you run on Microsoft 365 and want to see how your tenant is configured before you start, request our free, read-only 28-point Microsoft 365 security audit at alphasec.uk. One of your Microsoft 365 administrators signs in once on a short, 10-minute Teams call to approve read-only access (we never ask for passwords), and your full traffic-light report follows — usually within one working day — flagging the exact tenant settings that block Cyber Essentials.
How it works
- Free 20-minute call: We check your deadline, headcount, licences and why you need certification, and confirm a fixed price.
- Check and scope: We audit your devices, routers, admin accounts and cloud services against v3.3 and agree your scope statement.
- Fix: We remediate the technical gaps — remote across the UK, or on site in South Wales where needed.
- Submit: We guide you through the assessment answers so you submit with confidence.
Frequently asked questions
Do you guarantee a pass?
No honest provider can guarantee how an independent assessor will mark a submission. Our factual record is that none of the clients we’ve prepared has ever failed.
Are you a certification body?
No. Your certificate is issued by an IASME-licensed Certification Body. Our role is to check your systems, fix anything that would fail, and help you complete the assessment accurately.
Will you need access to our systems?
Yes, where you ask us to check or configure your Microsoft 365 tenant and devices. For a read-only check, one of your administrators approves read-only access on a short Teams call. Where you ask us to apply fixes, we use separate, named administrative accounts protected by multi-factor authentication — never shared passwords — and remove access as soon as preparation is complete.
How long does it take?
For a well-prepared small firm on Microsoft 365, preparation and certification can take one to two weeks; if older devices or third-party cloud apps need fixing, allow two to four weeks. Read our full guide on how long Cyber Essentials takes.
What does it cost in total?
Your total cost is the IASME assessment fee (£320 to £600 + VAT depending on the number of employees in scope), any preparation help you choose (from £295 + VAT), and any licence or hardware fixes your systems need. See our breakdown of how much Cyber Essentials costs.
We already have an IT provider. Can you still help?
Yes. We regularly work alongside an organisation’s existing IT team or Managed Service Provider (MSP) — either providing the gap check and exact fix list for them to apply, or handling the Cyber Essentials preparation directly.