Referral or reseller? Take the two routes apart first

Cyber Essentials for MSPs › Referral or reseller

Every certification body that works with the channel offers roughly the same two routes and describes them in roughly the same two paragraphs. Those paragraphs tell you who gets paid. They do not tell you who fields the call at half past four on a Friday from a client who cannot work out what the questionnaire means by an unsupported operating system. That call is the real cost, and it lands differently depending on which route you took.

Three questions wearing one coat

Before comparing routes, separate what is being decided. There are three distinct things, bundled so tightly in most partner programmes that people assume they are one.

1. Who holds the contract with the end client for the certification itself.
2. Who raises the invoice, carries the VAT and waits for the money.
3. Who does the client ring when they are stuck, and whose time absorbs that.

Referral and reseller are the two common bundles of those three, not the only possible ones. If neither fits the way your business runs, say so rather than picking the closer of two bad fits.

Referral, step by step

Worth setting out in order, because most of the friction sits in steps three and six rather than anywhere near the money.

1. You introduce a client who needs the certificate, usually by email with them copied in.
2. The certification body contracts and invoices the client directly. Your name is not on that paperwork.
3. The client is onboarded onto the assessment platform. This is the first place things stall, because the person with the email address is often not the person with the answers.
4. Scope is agreed. You are frequently the only party who knows what is in the estate, so you will be pulled into this whether or not the route says you are involved.
5. The questionnaire is completed, usually by the client with your help.
6. Assessment happens and the result comes back pass or fail. On a fail, somebody has to explain what went wrong. Formally that is not you. In practice the client rings you first, because you are the person they already pay.
7. Commission is paid to you on completion.

The honest summary is that referral removes the administrative burden and leaves most of the technical burden where it was. That is still a good trade for a lot of MSPs, because the administrative burden is the part you cannot bill for.

Reseller, step by step

1. You agree partner terms and a route to submit work.
2. You quote the client at your own price, inside your own proposal, beside whatever else you sell them.
3. You contract with the client. The certification body contracts with you.
4. You invoice the client on your own terms and cycle, which may be a monthly managed services bill rather than a one-off.
5. You are invoiced by the certification body, generally on completion rather than on order.
6. You run the client through readiness and submission. They may never speak to the certification body at all.
7. You own the relationship, the renewal date and the next conversation.

Side by side, on the things that actually differ

Referral and reseller compared on the mechanics rather than the money

Question	Referral	Reseller
Who signs with the client	The certification body	You
Who sets the price the client pays	The certification body	You
Who carries the cash gap	Nobody, on your side	You, if you invoice after paying
Who chases a late-paying client	The certification body	You, and you owe regardless
Whose support desk absorbs the questions	Shared in theory, yours in practice	Yours, explicitly
Who the client thinks provided the certificate	The certification body, and they are right	You, mostly
Who holds the renewal date	The certification body, with you reminded	You
What happens if you part company with the client	The certification relationship stays behind	It leaves with the contract
Effort to start	An email	Terms, a quote template and an internal process

What each route does to your margin

We do not publish partner numbers, and a certification body that does is publishing them to every direct buyer too. What we can describe is the shape of the two, which is what decides fit.

A referral pays you a defined amount per completed assessment. It is predictable, it requires no working capital, and it is capped. You cannot increase it by being good at your job, only by referring more.

A reseller margin is a spread. You buy at partner terms and sell at what your market bears, which inside a wider managed services proposal is often more than the certificate would fetch alone. The spread is yours to set, and so is the risk: a client who takes four months to complete a questionnaire costs you time you have already priced.

Terms in both cases are preferential against IASME’s published fee bands and are set by volume and by route, so the only way to compare them properly is against your own numbers rather than against a published table. Tell us roughly what your book looks like through the enquiry form and you will get the actual figures back in writing.

The wider point, which matters more than either number: the certificate is the smallest line in the job. Our published direct prices run from £320 plus VAT for a micro organisation of one to nine staff up to £600 plus VAT at 250 staff and over, with a gap analysis at £300. Whatever your terms are, they are a discount on figures of that order. The remediation that gets a client from failing to passing is not a discount on anything, and it is yours either way.

The support burden, costed honestly

Here is the number nobody puts in a partner pack. For a client whose estate you already run to a standard, expect two to four hours of your time across a certification: scoping, chasing the questionnaire, answering a couple of questions about how a control is implemented, and checking the submission before it goes.

For an inherited client with no asset register, mixed device ownership and a director who bought their own laptop, that figure is a day and a half, and most of it is chasing rather than technical work.

That gap is the argument for scoping readiness as billable work rather than swallowing it. It is also why referral suits some firms perfectly well: if you are not billing for that time anyway, you may as well not carry the invoicing either.

Renewal is the part worth owning

Cyber Essentials is annual. A client certified this October has to do it again next October, and the year after that. Over five years the renewals are worth more than the first certificate, and the route you chose decides who the reminder comes from.

On a reseller arrangement the renewal sits in your system, beside the licence renewals and the hardware refresh, and it is one more reason the client stays. On a referral it sits in ours. We will tell you it is coming, but the email the client receives is not from you. If Cyber Essentials is incidental to your business that is fine; if you intend it to be one of the things that makes you hard to replace, own the date.

Choosing, in five questions

1. Do you already sell compliance as a line item? If yes, reseller. It belongs in the proposal you are already sending.
2. Would adding a resold service create work your finance function cannot absorb? Purchase orders, supplier invoices and a cash gap are real. For a small firm they are sometimes the deciding factor.
3. How many a year? One or two makes the reseller overhead hard to justify. A steady flow changes the answer.
4. How much do you want your brand on the outcome? A fail under your name is your fail. Some firms want that ownership, some firms very deliberately do not.
5. Will the client pass first time? A mixed book argues for starting on referral while you standardise.

Nothing stops you running both. Plenty of firms refer awkward inherited clients and resell to the ones whose estates they built, which is not indecision but pricing the risk correctly per account.

When neither is right

If you are certifying at genuine volume, if Cyber Essentials is a product you sell rather than a favour you do, and if you have someone who could carry assessor training and keep it current, the honest answer may be that you should license as a certification body yourself. That is a real fork, covered separately on this site, and we would rather point at it than sign you up to a route that leaves money on the table.