Leave a Comment / Career Outlook / By

Which Cyber Security Certifications Are Worth It in the UK?

Which cyber security certification is worth it in the UK depends on your career stage and the direction you want to go. Starting out, ISC2 Certified in Cybersecurity (CC) or CompTIA Security+ give you a recognised baseline. Penetration testers should look at CREST, which says its CRT exam is recognised by the NCSC for CHECK, the scheme for testing public sector and critical national infrastructure systems. People heading into governance, risk and compliance (GRC) should look at ISO/IEC 27001 Lead Implementer or Lead Auditor and ISACA's CISA, CISM or CRISC. CISSP is a senior credential that needs five years' experience.

Laptop on a desk beside an exam answer sheet and pencil

One common mix-up first: Cyber Essentials is not a personal qualification. It certifies an organisation, not a person.

How to judge whether a certification is worth it

Before paying for any exam, check three things.

  1. Is it asked for in the jobs you want? Search UK job adverts for your target role and note which certifications keep appearing.
  2. Do you meet the experience requirement? Several of the best-known certifications (CISSP, CISA, CISM, CRISC, CGRC) need years of relevant work experience before you can hold the full credential. You can often sit the exam first, but you cannot use the title until the experience is in place.
  3. What does it really cost? Add training, materials and any resits to the exam fee, and check the issuer’s site, because prices change.

Entry level: ISC2 CC and CompTIA Security+

ISC2 Certified in Cybersecurity (CC) is the lowest barrier to entry. ISC2 states that no work experience is required and describes it as proving foundational knowledge for an entry or junior level role. Under the exam outline effective from 1 September 2026, the exam has 100 to 125 items and lasts 2 hours, with a pass mark of 700 out of 1000. The standard UK exam fee listed by ISC2 is GBP 161.19.

You may have heard the CC exam is free. That was ISC2’s One Million Certified in Cybersecurity programme, which has now concluded: new enrolments closed on 20 May 2026, and any unexpired exam codes must be used to schedule and take the exam by 31 December 2026.

CompTIA Security+ asks more of you. CompTIA lists a maximum of 90 questions, a mix of multiple choice and performance-based questions, in 90 minutes, with a pass mark of 750 on a scale of 100 to 900; these figures are the same for both the V7 and the new V8 version of the exam. CompTIA recommends about two years of hands-on experience in a security or systems administration role, although this is a recommendation, not a requirement. CompTIA is moving Security+ to a new version, V8, and the English V7 exam retires on 11 June 2027, so check which version your course and study materials cover. CompTIA does not show a UK price on its Security+ pages, so check the voucher price in its store before you budget.

In practice: if you are changing career with no IT background, CC is the cheaper first step. If you already work in IT support or systems administration, Security+ is the more natural fit.

Security analyst: CompTIA CySA+

For security operations centre (SOC) and vulnerability analyst roles, CompTIA CySA+ is the next step after Security+. The new version (exam CS0-004), released on 23 June 2026, has a maximum of 85 questions in 165 minutes, and CompTIA suggests about four years in a SOC analyst or vulnerability analyst role. The previous version’s English exam retires on 22 December 2026, so make sure any course you book teaches the new one.

Penetration testing: CREST and the NCSC CHECK scheme

CREST runs a ladder of penetration testing exams:

  • CREST Practitioner Security Analyst (CPSA): CREST calls it an entry level exam. It has no prerequisite and consists of 120 multiple choice questions in 2 hours; you need 60% to pass. Fee: GBP 275 plus any applicable tax.
  • CREST Registered Penetration Tester (CRT): an intermediate practical assessment of 2.5 hours plus 15 minutes’ reading time. You must hold a valid CPSA first. Fee: GBP 600 plus any applicable tax. CREST states that the CRT is recognised by the NCSC for its CHECK scheme.
  • CREST Certified Tester, Infrastructure or Application (CCT INF, CCT APP): the senior level. Each is in two parts booked separately, with a listed fee of GBP 1,600 plus any applicable tax.

Why CHECK matters. CHECK is the NCSC scheme under which assured companies carry out authorised penetration tests of public sector and critical national infrastructure (CNI) systems. The NCSC now requires at least one proposed CHECK Team Leader to hold a UK Cyber Security Council professional title in Security Testing at Principal level or above, and other team members to hold a Security Testing title at the appropriate level. Team members must also be eligible for SC clearance. So if you want to test government systems, plan for both the technical exams and a Council title (see below).

For a feel for the day-to-day work, see our post on the ethical hacker’s playground.

GRC and audit: ISO 27001, ISACA and ISC2 CGRC

ISO/IEC 27001 Lead Implementer and Lead Auditor courses teach you to build, or audit, an information security management system (ISMS) against the ISO/IEC 27001 standard. Requirements depend on which body issues the certificate. As one example, PECB runs each as a five-day course with the exam on day five. Its full Lead Auditor credential needs five years’ work experience, two of them in information security management, plus a total of 300 hours of audit activities; the Lead Implementer credential has the same experience requirement with 300 hours of project activities instead.

ISACA offers three relevant credentials. Each exam has 150 questions and ISACA’s candidate guide gives 4 hours to complete it. The fee is US$575 for ISACA members and US$760 for non-members. You can sit the exam before you have the experience, then apply for certification within five years of passing.

  • CISA (auditing): at least five years of information systems auditing, control or security experience, gained within the ten years before you apply.
  • CISM (security management): at least five years of information security management experience, across at least three of the four CISM domains.
  • CRISC (IT risk): at least three years of experience across at least two of the four CRISC domains.

ISC2 CGRC covers governance, risk and compliance. It needs two years’ experience in one or more of its seven domains; the exam has 125 items over 3 hours, and the standard UK fee is GBP 485.19.

CGRC, CRISC and ISO 27001 Lead Auditor overlap a great deal, so choose by the frameworks your target employers use. If you are new to GRC, start with the concepts before any of them: our free 12-session GRC course covers risk, controls, policies and audit in plain English.

Senior: CISSP

CISSP from ISC2 is aimed at experienced practitioners, and the experience requirement is the main hurdle: at least five years of cumulative, full-time experience in two or more of the eight CISSP domains. A relevant degree, or another credential from ISC2’s approved list, can count for one year, and only one year can be waived.

If you pass without the experience, you become an Associate of ISC2 and have six years to earn the five years required. The exam uses computerised adaptive testing: 100 to 150 items in 3 hours, with a pass mark of 700 out of 1000. The standard UK fee is GBP 606.69. ISC2 says a new exam outline takes effect on 15 April 2027, so check which outline your study material covers.

If you are searching for a CISSP bootcamp or a CISSP course in London, remember that ISC2 sells exam registration separately from training. A course is preparation, not the credential, so check the experience requirement before paying for either.

UK Cyber Security Council professional titles

The UK Cyber Security Council awards professional registration titles. They are not exams: you apply with evidence of your competence, which is assessed against the Council’s Standard for Professional Competence and Commitment. There are four titles:

  • Associate Cyber Security Professional (ACSP): the entry-level title, for people at the start of their careers. It is not tied to a specialism. The Council has aligned some existing qualifications, certifications and training courses to it, which can fast-track an application.
  • Practitioner (PraCSP), Principal (PriCSP) and Chartered (ChCSP): held against a chosen specialism, such as Security Testing or Cyber Security Audit and Assurance.

The Council licenses organisations, called Licensed Bodies, to assess applications for its titles in specific specialisms; the Associate application form is on the Council’s own site. For most people a Council title sits alongside certifications rather than replacing them, but for CHECK penetration testers it is now a requirement.

Cyber Essentials certifies organisations, not people

If you searched for Cyber Essentials certification in London, note that no individual can hold it. The NCSC describes Cyber Essentials as the minimum standard of cyber security recommended by the Government for organisations of all sizes. It has two levels:

  • Cyber Essentials: a combination of self-assessment and independent audit.
  • Cyber Essentials Plus: the same protections, with more rigorous, independent technical testing.

IASME is the NCSC’s official Cyber Essentials Delivery Partner and manages the network of organisations that certify businesses. NCSC CHECK providers, for example, must keep an in-date Cyber Essentials Plus certification for systems that hold customer engagement information.

Summary table

CertificationBest forExperience neededExamFee (issuer’s site)
ISC2 CCCareer changersNone100 to 125 items, 2 hoursGBP 161.19
CompTIA Security+Entry level with IT backgroundRecommended, not required: about 2 yearsMax 90 questions, 90 minutesCheck CompTIA store
CompTIA CySA+SOC and vulnerability analystsRecommended: about 4 yearsMax 85 questions, 165 minutesCheck CompTIA store
CREST CPSAAspiring penetration testersNo prerequisite120 questions, 2 hoursGBP 275 plus tax
CREST CRTPenetration testersCPSA requiredPractical, 2.5 hoursGBP 600 plus tax
ISO/IEC 27001 LI or LA (PECB)GRC, ISMS implementation and audit5 years (2 in infosec management) plus 300 hoursSet by issuerVaries by issuer
ISACA CISAIT audit5 years150 questions, 4 hoursUS$575 member, US$760 non-member
ISACA CISMSecurity management5 years150 questions, 4 hoursUS$575 member, US$760 non-member
ISACA CRISCIT risk3 years150 questions, 4 hoursUS$575 member, US$760 non-member
ISC2 CGRCGRC2 years125 items, 3 hoursGBP 485.19
ISC2 CISSPSenior and leadership roles5 years (1 can be waived)100 to 150 items, 3 hours, adaptiveGBP 606.69

Fees were checked on the issuers’ sites in November 2026. Taxes may be added depending on where you sit the exam, so confirm before booking.

Where LSCS fits

LSCS courses build the practical skills these certifications assume, rather than replacing them. CyberForce is a four-week, BCS Tech 10 accredited bootcamp for beginners and career switchers (GBP 1,900). The GRC Mentorship is a six-month programme (GBP 150 per month) covering ISO 27001, NIST CSF and other frameworks through policy writing, risk registers and mock audits. Contact us for dates.

Frequently asked questions

What is the best cyber security certification for beginners in the UK?

ISC2 Certified in Cybersecurity (CC) needs no work experience and has a standard UK fee of GBP 161.19. If you already work in IT, CompTIA Security+ is a common next step.

Can I get CISSP with no experience?

You can sit the exam, but you need five years of relevant full-time experience to hold CISSP (one year can be waived). Passing without it makes you an Associate of ISC2, with six years to gain the experience.

Which certifications do UK penetration testers need?

CREST offers an exam ladder (CPSA, then CRT, then CCT), and states the CRT is recognised by the NCSC for CHECK. CHECK teams also need UK Cyber Security Council Security Testing titles.

Can an individual get Cyber Essentials certification?

No. Cyber Essentials and Cyber Essentials Plus certify organisations. Individuals can take training, but the certificate is issued to the business.

Which certification is best for a GRC career?

Common choices are ISO/IEC 27001 Lead Implementer or Lead Auditor, ISACA CRISC, CISA or CISM, and ISC2 CGRC. Most need two to five years’ experience for the full credential.

References

Start Learning With LSCS

Student wearing headphones studying online on a laptop at home
OUR COURSES

RELATED POSTS

ALL POSTS
Professional working through printed documents beside a laptop
Career Outlook

How to Become a GRC Analyst in the UK: Skills, Routes and Roadmap

November 11, 2026
Trainer leading a staff workshop at a flipchart in an office meeting room
Across Industry

Cyber Security Awareness Training for Employees: A UK Guide

November 11, 2026
Board members in a meeting around a conference table with laptops
Across Industry

Cyber Security Training for Boards: What It Covers and What It Costs

November 11, 2026

Stay Ahead With LSCS

Get critical Cybersecurity updates, events invitations, and industry analysis. Our immersive, hands-on training is the most direct path to a high-growth cyber career.

Subscription Form

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top