A customer, a tender or the MOD wants proof you can be trusted with data. We do the heavy lifting, from gap analysis to audit day, and keep you certified after it.
Prefer to talk? Call 01206 598232, Monday to Friday, 9am to 5pm.
Cyber Essentials certification body
DCC Level 0 certification body
ISO 27001 certified ourselves
It’s usually a customer, a tender or a regulator, and there’s usually a deadline. Pick the closest match to see where to start.
Start with
The UK government-backed scheme that protects you against the most common cyber attacks. Many central government contracts ask for it, and more local ones do every year.
How we help. We’re an IASME-accredited certification body, so we can guide you through the questions and certify you. Submit your answers and we assess them within 48 hours.
Start with
DCC is the cyber security certification for UK defence suppliers, developed by the Ministry of Defence and IASME. The MOD has asked its industry partners to reach Level 0 by 31 December 2026.
How we help. We’re a certification body for Cyber Essentials and for DCC Level 0, so one team can take you from your first certificate to DCC Level 0.
Start with
An independent certificate that shows you manage information risk properly. It answers most of what larger customers ask when they vet a supplier.
How we help. Gap analysis, scope, risk assessment, Statement of Applicability, policies, training, internal audit and audit day. We run it for you, or coach your team through it.
Ask about ISO 27001 The ISO 27001 process (opens in a new tab)
Start with
SOC reports are control reports based on standards from the American Institute of Certified Public Accountants. US buyers often want a SOC 2 report before they trust you with their data.
How we help. We put the right controls in place and get your evidence ready for the auditor, with support from our office in Tampa, Florida. We also help US defence contractors prepare for CMMC.
Start with
It shows customers you develop and use AI responsibly, and that you manage its risks. It isn’t a legal requirement, but it puts you in a good position for future AI regulation.
How we help. Gap analysis, policies and procedures, staff awareness and preparation for your certification audit, led by an ISO 42001 Lead Auditor. It sits neatly alongside ISO 27001.
Start with
Every organisation with access to NHS patient information must publish a DSPT assessment each year, against the National Data Guardian’s 10 data security standards.
How we help. We’ve helped companies in the NHS supply chain complete and evidence the DSPT, and we line it up with Cyber Essentials and ISO 27001 so the work counts twice.
Start with
Car manufacturers including BMW, Mercedes-Benz, Toyota and Volkswagen ask suppliers for TISAX, the Trusted Information Security Assessment Exchange, to show that their information is protected properly.
How we help. We get your information security ready for the TISAX assessment, from scope and gap analysis to policies, controls and evidence.
Start with
If you handle payment card data, PCI DSS applies. The PCI Security Standards Council maintains it, and it sets out how cardholder data must be protected.
How we help. We work out what’s in scope, close the gaps and prepare the evidence, so compliance becomes part of how you work rather than a yearly scramble.
Start with
The best-known quality management standard. ISO 9001:2026 was published on 16 September 2026, and organisations certified to the 2015 version have about three years to move across.
How we help. Implementation, internal audits and transition support, led by an ISO 9001 Lead Auditor and timed with your next surveillance or recertification audit.
Ask about ISO 9001 What’s changed in 2026 (opens in a new tab)
Start with
That’s what the first call is for. Tell us who’s asking and by when, and you’ll come away knowing which certificate you need, and which you don’t.
How we help. If you’d like a clearer picture first, our Cyber Security Health Check shows where you stand today and what to fix first.
Book a discovery call About the health check (opens in a new tab)
Certification shouldn’t mean your best people vanish into spreadsheets for six months. This is how a typical ISO 27001 project runs with us.
We take on most of the workload, and can act as your CISO or information security manager while you run the business.
We coach your own team with our templates and know-how, so you own the system from day one.
Who’s asking, by when, and what’s in scope. You’ll know what you need, and what you don’t.
We compare how you work today with the standard, and report the high-risk gaps first.
Scope, risk assessment, Statement of Applicability, policies, staff training and evidence.
Internal audit and management review, help choosing a UKAS-accredited certification body, then we chaperone the auditor.
ISO management, internal audits and support at every surveillance audit, so the certificate keeps working for you.
Spritzmonkey is certified to ISO 27001, ISO 9001 and Cyber Essentials Plus. We’re an IASME-accredited certification body for Cyber Essentials and Cyber Essentials Plus, and a certification body for Defence Cyber Certification Level 0.
We’re also a BSI Associate Consultant, an LRQA Registered Consultant, and members of the ISOQAR and Centre for Assessment consultant networks.
We’re an IASME-accredited certification body, so we can certify you ourselves. Choose your organisation’s size to see your prices.
Self-assessment
A verified self-assessment. You answer the questions online, and we assess them.
£320 + VAT
The fee is set by IASME, so it’s the same at every certification body.
With expert help
A named expert works through the questions with you, so you submit with confidence.
£640 + VAT
Certification £320 plus 3 hours of expert support £320
Independently tested
Your self-assessment plus hands-on technical testing, to show your controls really work.
£1,600 + VAT
Transparent pricing with no hidden fees.
*Cyber liability insurance with £25,000 of cover for 12 months, for organisations domiciled in the UK or Crown Dependencies with annual turnover under £20 million that certify their whole organisation and opt in. Prices exclude VAT and are as published by Spritzmonkey in October 2026. Cyber Essentials Plus builds on a Cyber Essentials certificate, and both renew every 12 months.
Since 27 April 2026, under version 3.3 of the requirements, missing multi-factor authentication on a cloud service that offers it is an automatic fail. So is a high-risk or critical security update left uninstalled for more than 14 days. The assisted package catches problems like these before you submit.
The MOD has asked its industry partners to reach Defence Cyber Certification Level 0 by 31 December 2026. Level 0 starts at £475 + VAT, and we can certify your Cyber Essentials first. Ask about DCC
“I think that was the least painful audit I have ever been in!”
Case study
A 62-person fleet management firm across two Essex sites, already certified to ISO 9001 and ISO 14001. We ran a month-by-month plan, trained every member of staff and chaperoned both stages of the BSI audit.
“What stood out about working with Spritzmonkey was how practical and collaborative their approach was. They worked alongside our teams, understood our business, and helped us implement controls that fit how we operate.”
Zero non-conformities
“…our most recent external audit, which resulted in a pass with zero non-conformities.”
Joanne Brotherhood, Performance Networks, ISO 27001
Certified first time
“Using them on our project shortened our timescales and focused our teams on what was important, ensuring a smooth process and successful first time certification.”
Ger Kennedy, ISO 27001
Five years and counting
“We’ve partnered with them for over five years, and in that time they’ve consistently delivered a personalised service, always going the extra mile to help.”
Fahim Rashid, Invitise, Cyber Essentials
Daren and Jayne started Spritzmonkey in 2016 after careers in large organisations. Today there are offices in Brightlingsea, Kraków and Tampa, specialist associate consultants for the jobs that need them, and CREST-certified penetration testers.
Co-founder and Principal Consultant
CISSP. ISO 27001 Lead Implementer and Lead Auditor. ISO 42001 Lead Auditor. Cyber Essentials Assessor.
Co-founder, Sales and Marketing
IT project and programme manager for blue-chip companies. Prince2, MSP and M_o_R.
Senior Consultant
ISO 9001 Lead Auditor and ISO 27001 Lead Implementer, after 16 years as an SME quality manager.
Consultant and Internal Auditor
ISO 27001 Lead Auditor and Lead Implementer. Cyber Essentials and DCC Assessor. GDPR Practitioner.
Junior Consultant and Internal Auditor
ISO 27001 Lead Auditor, with more than five years of ISO 27001 and ISO 9001 audits.
Cyber Essentials Assessor
Certifies clients to Cyber Essentials, and runs vulnerability scanning and patch management.
Training Consultant and Key Accounts
More than 25 years in the public sector, designing and delivering training for law enforcement. Has studied forensic psychology.
European and US Business Development
We’re proud partners of Porridge & Pens, a charity working in Kumasi, Ghana, that gives children in need food and an education. Jayne is one of its trustees.
Something else on your list? Call 01206 598232 or send us your question.
Most projects take three to six months, depending on your size, scope and starting point. After the gap analysis you get a realistic timeline, and we can plan back from a customer’s or tender’s deadline.
The certification fee depends on the size of your organisation: £320 for 0 to 9 people, £440 for 10 to 49, £500 for 50 to 249 and £600 for 250 or more, all plus VAT. Cyber Essentials Plus starts at £1,600 plus VAT.
Both, depending on the standard. For Cyber Essentials and Cyber Essentials Plus we’re an IASME-accredited certification body, so we can guide you and certify you. For ISO standards we get you ready, and your certificate comes from a UKAS-accredited certification body. We’ll help you get quotes and choose one.
There are two parts: the certification body’s fees for the audits and certificate, and the work of building and running your information security management system. Both depend on your size and complexity, so we quote after a short call, and we can gather certification body quotes for you.
Not if we can help it. You can hand most of the work to us, or have us coach your own team with our templates. Either way, we fit around how your people already work.
Probably not. Our vCISO service gives you senior security leadership part time, from risk assessment and policy to incident planning and board reporting, usually for a fixed monthly fee.
Yes. We have offices in Brightlingsea, Kraków and Tampa, and most of the work can be done remotely. Organisations outside the UK can get Cyber Essentials too, although the cyber insurance that comes with it is only for organisations domiciled in the UK or Crown Dependencies.
ISO 9001:2026 was published on 16 September 2026, and certified organisations have about three years to move across. We suggest timing the switch with your next surveillance or recertification audit, to keep the cost and disruption down.
Two short steps. We’ll reply to book your discovery call, by phone or face to face.
Monday to Friday, 9am to 5pm. Looking for a job? Email your CV to hr@spritzmonkey.com.
