CYBER ESSENTIALS · SOUTH WALES
Certified without the surprises
From £795 as a one off, or £75 a month alongside support so it renews itself each year rather than lapsing. The certification body's fee is inside both figures. We start with a gap assessment, so you know what passing will cost before you agree to any of it.
- The assessment fee is in the price
- Fixing quoted before you commit
- Most of the work is ours, not yours
Trusted by businesses across South Wales
Certified, not just recommending it
We hold Cyber Essentials ourselves
It would be a strange thing to sell and not hold. We take clients through the same certification, start to finish.
Pricing
What it costs
Ring three providers and ask what they charge. You will get three discovery calls and no numbers. Ours are published, excluding VAT, with out-of-scope work quoted before it starts rather than after.
See all pricesExcluding VAT. The certification body's own fee is inside these figures rather than added afterwards. Remediation is the one thing quoted separately, because it depends entirely on what the gap assessment finds, and you see that number before you commit to anything.
The day to day
What is included
Everything below is in the price. Remediation is the one thing that is not, because nobody can price it honestly before looking, and that is what the gap assessment is for.
A gap assessment first
We look at what you actually have and tell you which of the five controls you already meet. Most businesses are closer than they fear, and the ones that are not would rather know on day one than halfway through.
A written price for the gaps
Whatever needs fixing is quoted fixed, before you commit to the certification itself. No open-ended work, and no conversation about money once a deadline is in the room.
The certification body fee
Included rather than added afterwards. The fee is set by the certification body and rises with your headcount, and it is inside our figure at every band.
The questionnaire, filled in by us
There are a few dozen questions written in language nobody outside the trade uses. We complete it from what we found and bring you the answers to check and sign, because the sign-off has to be yours.
Submission and the chasing
We submit it, and if the assessor comes back with queries we answer them. That is the bit that quietly eats a week when a business does this alone.
Your certificate and your logo
The certificate and the badge for your website and tender documents, which is the reason most people are here.
A renewal that happens
On the monthly, we start the next one before the current certificate expires. Certification lasts twelve months and a lapsed one is worth nothing on the day somebody asks for it.
How it runs
Four stages, and you only do one of them
The work is mostly ours. What we need from you is access to look, and a signature at the end, because the declaration has to come from someone in your business rather than from us.
We look at what you have
Laptops, phones, firewall, Microsoft 365, who has administrator rights, what is still running an operating system nobody supports any more. A couple of hours, mostly remote.
You get the gaps and the cost
In writing. What passes today, what does not, and a fixed price for each thing that needs doing. This is the point where you decide, with real numbers rather than an estimate.
We fix and then fill it in
The remediation, then the questionnaire completed from what we found, brought to you for checking rather than sent to you as homework.
Submitted, queried, certified
We submit, answer anything the assessor asks, and hand you the certificate and the badge. If it fails, we fix and resubmit at no extra cost.
What it covers
The five controls, briefly
Cyber Essentials asks about five things. Your firewall and how your network is bounded. Your settings, meaning default passwords changed and anything you do not use turned off. Who can access what, and whether people have administrator rights they do not need. Protection against malicious software. And keeping everything patched and inside its support window.
None of it is exotic, and that is rather the point of the scheme. It is the ordinary hygiene that stops the attacks that actually happen to businesses your size, rather than the ones that make the news. If you are already run properly, the certification mostly documents what is already true.
Where it bites is the quiet stuff: a machine on an operating system that stopped getting security updates, a shared administrator login everybody knows, a piece of software three years behind. Those are the things the gap assessment finds, and the reason we price the fixing separately is that one business has none of them and the next has all three.
Being straight about it
Things worth knowing before you buy
Four things we would rather tell you now than have you discover later. They are the reason this page has a gap assessment on it rather than a single inclusive fee.
The certificate lasts twelve months
It is not a one-off. A certificate that expired in March is worth nothing in April when a customer asks, and renewal is the thing businesses forget until a tender is due. That is what the monthly option exists for.
You sign it, not us
It is a self-assessment, so the declaration has to be made by someone in your business. We do the work and bring you the answers, but we cannot sign on your behalf and neither can anybody else.
Fixing can cost more than the certificate
If you are running machines past their support date, the honest answer is hardware, and no certification fee covers that. You will see the number before you commit rather than after.
It is a baseline, not a shield
Certification means you meet five sensible controls. It does not mean nothing will ever happen to you, and anybody selling it as protection is overselling it. Ongoing security is [a different product](/business/cyber/) and we keep them apart on purpose.
Whether you need it
Who this is actually for
Most people arrive here because somebody told them to. A tender asks for it, an insurer asks for it, a customer has added it to their supplier terms, or you want public sector and NHS work where it is increasingly the floor rather than a bonus.
If that is you, the only questions worth asking are what it costs, how long it takes and how much of it lands on your desk. Four to six weeks is typical, most of which is us, and the honest answer on cost is that the certification is the predictable part and the fixing is not.
If nobody is asking you for it, it is still worth doing, but be clear about why. Done properly it closes the gaps that cause most of the trouble we get called to. Done as a box tick, by a provider who certifies you against what you said rather than what you have, it is a PDF and a false sense of security.
Questions
Cyber Essentials, answered
How much does Cyber Essentials cost?
From £795 as a one off for a business of one to nine staff, or £995 for ten to forty-nine, excluding VAT. The certification body's own fee is inside those figures rather than added afterwards. There is also a monthly option at £75 a month alongside support, which renews the certificate each year instead of leaving you to remember. Anything that needs fixing to pass is quoted separately after the gap assessment.
Why is the fixing priced separately?
Because it is the most variable part of the job and anybody quoting it before looking is guessing. One business needs an afternoon of settings changed. The next needs machines replaced because they are past the date the manufacturer stopped issuing security updates. Rolling that into one fee means either overcharging the first or arguing with the second halfway through, so we assess first, quote fixed, and let you decide.
How long does it take?
Four to six weeks is typical from the first look to the certificate, and most of that is the fixing rather than the paperwork. If you are already in good shape it can be a fortnight. If a tender deadline is driving it, tell us the date at the start, because that changes what we do first.
What happens if we fail?
You get two attempts inside the same application, so in practice a fail means fixing what the assessor flagged and resubmitting. We do that at no extra charge, because if it fails after we have assessed it then we missed something.
Do we have to be certified every year?
The certificate lasts twelve months, so yes if you want to keep it. Renewal is less work than the first time because the ground is known, which is what the monthly option is priced on. On a one off we will remind you, but it is then a fresh piece of work.
Can you certify us if you are not our IT provider?
Yes, and it happens often. You do not have to move your IT to us to get certified by us. We will need enough access to see what is there, and if we find something your current provider should fix we will tell you rather than quietly bill you for it.
Is it the same as Cyber Essentials Plus?
No. Basic is a self-assessment that you sign. Plus is the audited version, where an assessor tests a sample of your actual machines rather than taking your word for it. Plus sits on top of basic rather than replacing it, so you need both.
Does certification make us secure?
It makes you meaningfully harder to attack than you were, because the five controls block most of what actually happens to businesses your size. It does not make you safe, and we would not sell it as if it did. If you want something watching afterwards, that is ongoing security and it is a separate monthly service.
Services that go with this
We cover South Wales from Pembroke and Narberth in the west to Newport in the east, and from Barry up to Brecon. On-site visits are included on the Professional and Advanced support plans, and quoted before we travel on Essential. See the towns we cover
A free review, and an honest answer
An hour of our time, on site. You get a written list of what is fine, what is risky and what is costing you money. If everything is healthy, we will tell you that and leave you to it.