Picking the best Cyber Essentials Plus certification body changes how long your assessment takes, how painful the external vulnerability scan feels, and whether your certificate holds up when an NHS trust, a G-Cloud buyer, or an insurer's due diligence team asks for evidence.
Why this matters
Cyber Essentials Plus is the version of the UK government's scheme that requires an independent technical check, not just a self-assessment questionnaire. IASME accredits the certification bodies that are allowed to issue it, and the National Cyber Security Centre recognises the scheme for public sector procurement.
That matters commercially. Buyers on G-Cloud government contracts increasingly require Cyber Essentials Plus before they'll sign, and insurers use it as a baseline for cyber liability cover in 2026. A weak certification body doesn't just slow you down — it can leave gaps in your evidence trail that surface later during a renewal audit or a client security questionnaire.
The certification body you pick also decides your experience for the next 12 months, since that's how long a Cyber Essentials Plus certificate stays valid before you're back in the assessment queue.
How we ranked
Each body below is assessed against four criteria: IASME licensing status, assessment scope (remote-only versus on-site), sector experience with regulated buyers like the NHS and central government, and how well the body's process fits a growing SME rather than a 2,000-seat enterprise.
This isn't a pricing comparison — quotes vary by device count, scope, and whether you're renewing or certifying fresh. It's a fit comparison: which certification body matches which kind of business in 2026, and where each one falls short.
The ranked list
1. IT Governance — the bundler
IT Governance runs Cyber Essentials Plus alongside ISO 27001 and GDPR consultancy under one roof. If you're already planning an ISO 27001 audit, running both through one provider cuts duplicate evidence requests.
The scope is broad: SME to mid-market, with sector experience across finance, legal, and public sector suppliers. The tradeoff is a longer sales process than a specialist assessor. Verdict: Buy if you're stacking certifications; Skip if Cyber Essentials Plus is your only near-term requirement.
2. Bulletproof — the pentest-led pick
Bulletproof is a penetration testing firm first, and it runs the external vulnerability scan with its own technical team rather than outsourcing it. That matters if your infrastructure has unusual configurations that a generic scan tool misreads as a fail.
Companies with custom cloud setups or legacy on-prem systems get more useful remediation guidance here than from a pure paperwork-first assessor. Verdict: Buy for technically complex environments; Consider for a standard SaaS stack where the extra depth isn't needed.
3. CyberSmart — the software-first option
CyberSmart pairs its own compliance software with partner-delivered assessments, so evidence collection happens continuously rather than in a scramble before the assessment date. It's built for founders who don't want to chase spreadsheets.
The fit is strongest for SMEs under 50 seats who want the software doing the tracking between certifications. Verdict: Consider if you want a always-on evidence layer; Hold if you already run a dedicated compliance automation tool and don't need a second one.
4. NCC Group — the enterprise choice
NCC Group operates at a scale most SMEs never need: multi-site, multi-country scopes, and assurance work for critical national infrastructure clients. That depth comes with enterprise-level engagement processes — procurement cycles, scoping calls, formal statements of work.
If you're a single-site business under 100 employees, this is more process than you need. Verdict: Hold for SMEs; Buy if you're managing Cyber Essentials Plus across multiple legal entities or countries.
5. Sec-Tec — the budget remote option
Sec-Tec runs a lean, remote-first assessment model aimed squarely at SMEs that don't need on-site visits. For a single-office business with a straightforward IT estate, that keeps costs down and turnaround short.
The limitation shows up if your scope includes physical site controls or a hybrid on-prem environment — remote-only assessment isn't built for that. Verdict: Consider for simple, cloud-first SMEs; Skip if your scope needs on-site verification.
6. Cyberis — the fintech specialist
Cyberis leans into financial services and fintech clients, where assessors already understand FCA-adjacent security expectations and can map Cyber Essentials Plus controls onto existing regulatory frameworks without re-explaining context.
Outside financial services, that specialism is wasted spend. Verdict: Buy for fintech and regulated finance; Skip for unrelated sectors where a generalist assessor is cheaper.
Comparison table
| Certification body | Assessment style | Best for | Verdict |
|---|---|---|---|
| IT Governance | Bundled remote + on-site | ISO 27001 + CE Plus together | Buy |
| Bulletproof | Pentest-led technical scan | Complex or legacy infrastructure | Buy |
| CyberSmart | Software-assisted, partner-delivered | Founders under 50 seats | Consider |
| NCC Group | Enterprise, multi-site | Multi-entity or multi-country scope | Hold (SME) |
| Sec-Tec | Remote-only | Single-office, cloud-first SMEs | Consider |
| Cyberis | Sector-specialist | Fintech and financial services | Buy (sector-fit) |
Where to get certified
Three rules before you commit to any name on this list:
- Check the live IASME register, not the marketing page. Licensing status changes; a body's own website is the slowest place to find out it's lapsed.
- Confirm scope before quoting. Remote-only pricing and on-site pricing differ, and device count changes both — get the quote locked to your actual estate, not an estimate.
- Ask what happens at the 3-month mark. Cyber Essentials Plus must follow Basic certification within three months, and a body that can't guarantee a slot in that window isn't the right fit for a deadline-driven buyer like an NHS supplier or a Cyber Essentials Plus applicant serving NHS contracts.
Get evidence ready before assessment day
Automate the evidence collection your certification body will ask for.
Whichever certification body you pick, the assessment only moves as fast as your evidence. OneClickComply automates the evidence collection — access logs, patch records, configuration exports — so the certification body gets what it needs on day one instead of chasing your IT team for two weeks. That's the difference between a Cyber Essentials Plus renewal that takes an afternoon and one that eats a sprint.
Frequently asked questions
One last thing
IASME updates the Cyber Essentials question set periodically, and a certification body that hasn't re-trained its assessors on the current format will flag control-ownership questions incorrectly — ask directly whether the assessor has been briefed on the current 2026 question set before you book a date.