Step 7 of 7
Complete the assessment and get certified
Once the controls are in place, you complete an online questionnaire, a director signs it off, and an assessor marks it.
How to do it
Check your backups
Backups aren't scored, but they're strongly recommended. Back up your email and files to a service separate from your main system, and test that you can restore them.
Choose where to apply
Cyber Essentials is run by IASME on behalf of the NCSC. You can apply through IASME or through one of its licensed certification bodies. Some certification bodies include cyber insurance for eligible small organisations, so ask when you compare them.
Complete the questionnaire
Answer every question for your whole scope, using the device and service lists from step 1. Answer honestly: describe how things are now, not how you plan to set them up. You have six months to complete it from when you start.
Get it signed off
A director, or someone with equivalent authority, must sign the declaration. Make sure they've read the answers.
Submit and pay
The fee depends on your size. It's £320 + VAT for organisations with up to 9 employees, and £440 + VAT for 10 to 49. An assessor will mark your answers and tell you about anything that doesn't meet the standard.
Keep it current
Your certificate lasts 12 months. Keep the controls in place all year, and set a reminder to renew. If you're going for Cyber Essentials Plus, the hands-on audit must follow within 3 months of your basic certificate.
Common reasons people get caught out
- Answering "yes" for something you intend to do rather than have done
- Forgetting a cloud service and failing on MFA
- Letting the certificate lapse
Your checklist for this step
- Regular, tested backups kept separate from your main systems (recommended)
- Self-assessment questionnaire completed
- Declaration signed by a director or equivalent
- Submitted and paid for
- Certificate saved and renewal reminder set
This guide summarises Cyber Essentials Requirements v3.3 for small businesses. It is general guidance, not the official question set. Check the current requirements on the IASME website before you submit. Last updated 2 November 2026.