Cyber Essentials Marking Only vs Supported: Which Service Is Right for You?
If you're working out how to get Cyber Essentials, one of the first decisions you'll make with us is which service to choose: Marking Only or Supported. Both lead to exactly the same Cyber Essentials certification, marked by a licensed Get Cyber Certified assessor through the same IASME assessment portal. The difference is how much risk you're prepared to carry on the way there.
This guide explains what each service includes, how marking turnaround works, and how to decide honestly which one fits your organisation.
The short answer: it comes down to risk appetite
Cyber Essentials certification is a pass or fail assessment. With Marking Only, you complete the self-assessment on your own, submit it, and it is marked as submitted. If your answers fall short of the requirements, that risk sits with you.
With Supported, our assessors review your answers against the requirements before anything is submitted for formal marking. We work through the gaps with you, and your assessment only goes forward for marking once we are confident it will pass.
That approach is why our track record looks the way it does: 100% of applicants who have followed our advice and who have submitted within the required deadlines have passed.
So the real question isn't "which is cheaper?" It's "how confident are we that we'll pass first time, and what happens to us if we don't?"
What both services have in common
The same Cyber Essentials standard and the same verified self-assessment, completed in the IASME assessment portal
Marking by a licensed Get Cyber Certified assessor
The same Cyber Essentials report and certificate when you pass
Free cyber liability insurance (terms and conditions apply)
Cyber Essentials Marking Only
Marking Only is modelled closely on the direct IASME marking service. It is designed for organisations that already know their systems meet the requirements and simply need their submission assessed and their certificate issued. It is priced as a lower-cost option, from £319 + VAT, to reflect that.
What's included
Access to your own secure assessment portal
Marking, with feedback limited to the comments in the marking portal, as per the standard IASME process
A complimentary re-mark, with a two-day window to remediate any non-compliances first
Email support for logging into and navigating the marking portal
What isn't included
Any pre-submission review or gap analysis
Telephone support, general technical guidance or help with your answers
A formal marking SLA. We aim to mark along the same timeline as IASME, typically 4 to 5 working days, but this isn't guaranteed and can be longer at busy times because Supported clients are always prioritised first
If you start on Marking Only and realise you need more help, get in touch and we can discuss upgrading your service, subject to our standard amendment fee.
Cyber Essentials Supported
Supported is our most popular service, from £650 + VAT including the certification fee. You're assigned a senior assessor who stays with you from scoping through to your certificate. You can read the full walkthrough in what to expect from our support process, but in short:
We start with an introductory call to agree your scope, the most important phase of any assessment.
You receive the question set in spreadsheet form and describe your current setup honestly. It's a starting point, not a test.
Your assessor returns a gap analysis showing each non-compliant item, why it doesn't meet the requirement and what's needed to fix it. We don't dictate brands or products, so you can meet the requirements with the tools you already use.
You make the changes, update your answers and we review again, as many times as needed.
Only when we're confident you will pass do your final answers go into the live portal for formal marking.
What's included
A dedicated senior assessor
Unlimited remote support by email and telephone throughout
Pre-submission review and gap analysis
As many review cycles as you need within the governing body's six-month limit
A 24 working hour marking SLA, with priority over Marking Only submissions
The option to set a target deadline for us to work towards, including late-night working where deadlines require it
Your Cyber Essentials report and certificate, plus free cyber liability insurance (terms and conditions apply)
Deadlines and turnaround: why the SLA matters
Many organisations come to Cyber Essentials certification with a date already in the diary: a tender closing, a contract starting or a certificate about to expire.
Supported clients have a formal SLA of 24 working hours for marking, calculated at 7 working hours per day, which works out at roughly three working days. If you have a hard deadline, tell us at the start. We'll set it as a target, prioritise your assessment and, where it's needed, work late to meet it.
Marking Only has no SLA. Typical turnaround is 4 to 5 working days, but it isn't guaranteed and can stretch when we're busy. So if a deadline matters, Marking Only adds schedule risk on top of the risk of failing.
What "submitted within the required deadlines" means
IASME applies a six-month time limit to every Cyber Essentials assessment, running from when the assessment account is purchased. The question set is also updated periodically, which brings its own cut-off dates. Our track record covers applicants who followed our advice and submitted within those limits, which is why your assessor will always flag the dates that apply to you early on.
Which service should you choose?
Marking Only could suit you if all of these are true
You have in-house IT or cyber security expertise, or you've already had support for this year's assessment
Someone has checked your systems against the current requirements and confirmed nothing more is needed, including MFA on every cloud service, separate administrator accounts and the 14-day patching rule
You're confident about what's in scope, including cloud services and personally owned devices
You have no tight deadline, and you can accept a fail-and-fix cycle if something has been missed
Supported is the safer choice if any of these apply
It's your first Cyber Essentials assessment, or the requirements have changed since you last certified
You're not completely sure what's in scope
You have a contract, tender or renewal deadline to meet
Failing would be costly in time, money or reputation
You'd rather have an assessor confirm you're ready before you submit
Put simply, if there's any doubt at all, we'd recommend Supported.
What about the Readiness Assessment?
You may also see our Readiness Assessment. It isn't a route to certification: your answers are reviewed and you receive a report of what needs to change, but no certificate is issued. It's useful if you want to understand where you stand before committing. If your goal is to get Cyber Essentials certified, choose Marking Only or Supported.
Ready to get cyber certified?
Whichever route you take, the destination is the same: a Cyber Essentials certificate that shows clients and partners you meet the government-backed baseline. If you'd like support all the way to that certificate, choose Cyber Essentials Supported. If you're confident and simply need marking, choose Cyber Essentials Marking Only.
Not sure which fits? Call us on 0333 339 0383 or email team@getcybercertified.co.uk before you buy, and we'll give you an honest recommendation with no sales pressure. You'll find more detail on both services in our FAQs.
Comments