Cyber Essentials is the UK government backed certification that proves your organisation has the essential technical controls in place. Get certified through All-Secure: we scope it and give you a same-day fixed quote, our trusted, accredited certification partner leads you through the assessment itself, and if anything needs fixing our penetration testers help you fix it.
The baseline tier. You answer a question set covering the five core controls and an assessor verifies your answers. Fast, affordable and the certification most contracts ask for first.
The audited tier. The same five controls, verified by a hands-on technical audit of a sample of your systems, carried out within three months of the basic certificate.
Both tiers certify the same five controls: firewalls, secure configuration, access control, malware protection and security update management. The difference is assurance. Cyber Essentials verifies what you declare; Cyber Essentials Plus independently tests that it is true.
Not sure which one your contract asks for? Send it over and we will tell you straight.
Your answers to the question set, reviewed by an assessor. Days to certify, and the entry requirement for many contracts and supply chains.
A technical audit of a sample of your systems proves the controls work in practice. Required where customers want proof rather than a signed declaration.
The five controls stop the vast majority of common, internet-based attacks. The certificate proves it to the people who ask.
Many central government contracts involving personal or sensitive data require Cyber Essentials, and Ministry of Defence suppliers must hold it. Some tenders specify Plus.
Insurers and enterprise procurement teams increasingly expect it, and eligible smaller organisations get cyber insurance included with certification.
Firewalls, secure configuration, access control, malware protection and security updates: the essentials, checked and certified rather than assumed.
One scoping call with us, then a clear path to the certificate. You always know what happens next.
Tell us your size, your systems and which tier you need. We come back with a fixed price for the whole thing, quoted the same day.
We introduce you to our trusted certification partner, an accredited IASME-licensed certification body, and stay in the loop throughout.
The partner leads you through the self-assessment question set, so you always know what a compliant answer looks like.
Your answers are verified and the certificate is issued. For Plus, the hands-on technical audit happens within three months of the basic certificate.
If the assessment surfaces a gap, an All-Secure penetration tester is on hand to help you close it quickly and properly.
Certification lasts twelve months. We prompt you when renewal is due and arrange the reassessment, so the certificate stays current year after year.
Certification is delivered by our trusted partner, an accredited, IASME-licensed certification body, who leads you through the assessment and issues the certificate. All-Secure handles the quote, the introduction and anything security related that comes out of it.
The difference is what sits behind it. We break into systems for a living, so if the assessment flags a gap, you are not left holding a checklist: a penetration tester helps you close it properly. And when you are ready to go beyond the baseline, the same team already knows your environment.
Straight answers to what organisations ask most about getting certified.
Cyber Essentials is a verified self-assessment: you answer a question set covering the five technical controls and an assessor reviews your answers. Cyber Essentials Plus covers the same controls but adds a hands-on technical audit, where an assessor tests a sample of your systems to verify the controls are genuinely in place. Plus carries more weight with customers and is named in some contracts, and the audit must be completed within three months of the basic certification.
The assessment fee for basic Cyber Essentials is set by the scheme and varies with the size of your organisation. Cyber Essentials Plus depends on how many systems need to be sampled in the audit. Tell us your size and scope and we will give you one fixed price the same day, with no hidden extras.
Basic Cyber Essentials can be turned around in days once your answers are ready, as the self-assessment is usually reviewed within a few working days of submission. Cyber Essentials Plus typically takes a few weeks end to end, and the audit must happen within three months of the basic certificate being issued.
No. Cyber Essentials Plus includes an audited technical verification, but that is not a penetration test and the scheme does not require one. A penetration test goes much deeper: it shows what a real attacker could actually do, rather than checking baseline controls. Many organisations do both, and as penetration testers we can quote for either, or both together, in one conversation.
Our trusted certification partner, an accredited IASME-licensed certification body, leads you through the assessment and issues your certificate. All-Secure scopes the work, gives you a same-day fixed quote and makes the introduction, with penetration testers on hand if the assessment flags anything that needs fixing.
Very often, yes. Many central government contracts that involve handling personal or sensitive information require Cyber Essentials, and Ministry of Defence suppliers are required to hold it. Some contracts specify Cyber Essentials Plus, so check the wording, or send it to us and we will tell you which tier you need.
Twelve months. Certification is renewed annually against the current question set, which evolves as the scheme is updated. We prompt you when renewal is due and arrange the reassessment through our certification partner, so the certificate never quietly lapses.
Tell us your size and which tier you need. We will come back the same day with one fixed price, with no sales theatre.