James Cairns, Quality & Performance Manager, UK Cyber Security Council | 25th August 2026

Licensed Bodies are organisations authorised by the UK Cyber Security Council to assess applicants for our professional cyber security titles. They assess cyber security professionals against the UK Cyber Security Standard of Professional Competence and Commitment and make recommendations to the Council as to whether an individual should be awarded a professional title. In this blog, James Cairns, the Council's Quality and Performance Manager explores the ongoing process to ensure that our Licensed Bodies are working to the highest standards, delivering the assessment and application process that cyber professionals deserve when applying for professional registration.

One of the questions that sits at the heart of professional registration is surprisingly simple:

"Who assures the organisations carrying out the assessments for professional registration?"

If you're applying for a professional title in cyber security, you'll be familiar with the broad model. The UK Cyber Security Council sets the standards. Licensed Bodies assess applicants against those standards. Successful applicants achieve professional registration.

But if the value of professional registration rests on trust in the assessment process, then there is an equally important question behind it: how do we know the organisations carrying out those assessments are operating to the standards expected of them?

That's where much of my work as Quality & Performance Manager begins.

Confidence in the system

The cyber profession should care about this because professional registration only has value if it is underpinned by confidence. Confidence that standards are applied consistently. Confidence that applicants are treated fairly. Confidence that decisions can withstand challenge.

Without that, professional registration becomes little more than a badge.

When the Council awards Licensed Body status, it is not simply recognising expertise in a particular area of cyber security. It is placing trust in an organisation to act as a gatekeeper for professional standards on behalf of the profession.

And that trust has to be earned.

At the Council, I spend a great deal of time understanding how prospective Licensed Bodies intend to operate. We review assessment methodologies, governance arrangements, quality assurance approaches and operational plans. By the point approval is granted, we have confidence that the organisation can meet the expectations of the role.

From approval to operation

But approval is not the finish line.

In many respects, it is the point where an organisation moves from telling us what it intends to do, to showing us that it can actually do it. Really it is just the beginning.

Almost every organisation can produce a process diagram. Almost every organisation can write a policy. The real test is whether those systems work when real applicants enter the process, real assessment decisions need to be made and real challenges emerge.

That's why newly approved Licensed Bodies don't simply receive a licence and get left alone.

They enter a period of developing and embedding the governance and operational systems required to run the service. They undertake pilot activity designed to demonstrate that assessment processes work in practice, not just on paper, and their recommendations to the Council are moderated to ensure consistency and correct application of standards. And throughout these processes the Council reviews progress closely.

Testing delivery, not intention

The pilot stage is particularly important because it allows us to look beyond intention.

Can assessment decisions be evidenced?
Are assessors reaching robust conclusions?
Can records stand up to scrutiny?
Can the organisation demonstrate consistency?

These are not theoretical questions. They are the practical foundations upon which confidence in professional registration depends.

Importantly, this is not about trying to catch organisations out.

The cyber security profession is still maturing as a recognised profession, and all of us have an interest in getting this right. The Council's role is as much about support and improvement as it is about assurance. We want Licensed Bodies to succeed because their success contributes to a stronger and more trusted profession.

Not every organisation is ready

At the same time, there is a responsibility to be selective. Professional standards are only as credible as the organisations entrusted to uphold them.

It would be easy to assume that a strong reputation in cyber security automatically translates into readiness to deliver professional registration. In practice, that is not always the case.

Delivering professional registration requires more than technical expertise. Organisations need robust governance, assessment processes that can withstand scrutiny, effective quality assurance arrangements, and assessors who are appropriately trained and supported. They must also be willing to have their own decisions and processes reviewed.

Not every organisation is ready for that level of responsibility.

That selectiveness is therefore deliberate. When an organisation becomes a Licensed Body, it joins a relatively small community of organisations trusted to make recommendations that contribute directly to the credibility of professional registration. Maintaining that credibility requires confidence not only in their expertise, but in their ability to demonstrate that their processes and decisions stand up to scrutiny.

Why this matters

For cyber professionals considering registration, there should be reassurance in knowing that Licensed Bodies are not simply appointed and forgotten. They are expected to demonstrate capability before operating, evidence quality while operating, and continually improve throughout their relationship with the Council.

For Licensed Bodies themselves, there is perhaps a different message.

Membership of this community carries responsibility. It means joining a relatively small group of organisations trusted to uphold standards on behalf of the wider profession. It means being willing to have your own processes examined with the same rigour that applicants should expect when they seek professional recognition.

Ultimately, that benefits everyone.

The Council is selective about which organisations become Licensed Bodies because the consequences of getting it wrong extend beyond any single organisation. Every assessment recommendation contributes to the credibility of professional registration as a whole.

For that reason, approval is not treated as a permanent endorsement. Licensed Bodies are expected to demonstrate, through pilots, monitoring and ongoing quality assurance activity, that they continue to meet the standards expected of them.

Ultimately, the purpose of this oversight is not to assess intentions, but delivery. Approval provides assurance that a Licensed Body can meet the Council's requirements; pilots and ongoing monitoring through moderation and periodic reporting provide assurance that it does.

The Council's approval process answers the question, "Can this organisation deliver professional registration services?" The period that follows approval answers the more important question: "Can it evidence that it is delivering them as expected?"

That is why approval is an important milestone, but not the end of the process. It is the point at which capability has to be demonstrated in practice.

If you would like to know more about becoming a Licensed Body please contact james.cairns@ukcybersecuritycouncil.org.uk.

Want to find out more about starting your application for a Professional Cyber Security Title? Take a look here.