The short version
People ask what Cyber Essentials costs as though there is one price. There are two numbers: the certification fee, which is small and fixed by size, and the cost of getting ready, which varies with how much good security you already run. A business with tidy Microsoft 365 settings and managed devices may pay little more than the fee. A business starting from scratch pays for the remediation first.
What drives the cost
- Your size. The IASME fee is banded by employee count, so a micro business pays less than a mid-sized one.
- Self-assessment or Plus. Basic Cyber Essentials is a verified self-assessment. Cyber Essentials Plus adds an independent technical audit, which costs more and takes more of your time.
- How ready you are. Multi-factor authentication, supported software, working patching and a clean device build are the common gaps. Price any required changes separately from the assessment fee.
- Who does the work. Doing it yourself costs time. Buying help to implement the controls costs a fee. Preparation and formal assessment are separate pieces of work, priced separately, and you can buy them from different suppliers.
The two costs, separated
IASME certification fee, basic Cyber Essentials (verified self-assessment, banded by size, all + VAT):
| Organisation size | Employees | Fee (+ VAT) |
|---|---|---|
| Micro | 0 to 9 | £320 |
| Small | 10 to 49 | £440 |
| Medium | 50 to 249 | £500 |
| Large | 250+ | £600 |
Figures are IASME's certification fee for basic Cyber Essentials, reviewed 13 September 2026 against IASME (opens in new tab) and the NCSC's Cyber Essentials pages (opens in new tab). Scheme fees change, so we confirm the current fee in writing before you place an order. Cyber Essentials Plus is priced separately.
Everything else:
| Component | Typical scale | Notes |
|---|---|---|
| Cyber Essentials Plus audit | Quoted separately, by size and complexity | Independent technical test on top of the basic assessment. The price scales with the number of devices, users and network complexity, so it is quoted rather than banded. Our own Cyber Essentials Plus prices, all excluding VAT, are on our Cyber Essentials page, and how our pricing works covers the rest |
| Getting ready (remediation) | Nil to low thousands | MFA, patching, supported software, device configuration |
| Ongoing (annual renewal) | The fee again, each year | Certification lasts twelve months |
What changed in April 2026 (and why it can raise the getting-ready cost)
IASME uses the Danzell question set for purchases from 27 April 2026, aligned to NCSC requirements v3.3. The five control areas remain the same. Cloud services are explicitly in scope; cloud MFA and timely security updates need to be implemented, not merely planned. These are current requirements, rather than entirely new controls introduced in April. Use the IASME question set (opens in new tab) and NCSC requirements v3.3 (opens in new tab) for the assessment account you are using.
Cyber Essentials vs Cyber Essentials Plus
Basic Cyber Essentials is a self-assessment that an appointed certification body verifies. Cyber Essentials Plus covers the same five controls but adds a technical audit, where an assessor tests a sample of your devices and accounts to confirm the controls work. Plus costs more and is often the version required for government and defence-related contracts. Central government has required Cyber Essentials certification on certain contracts since 2014, under Procurement Policy Note 09/14 (opens in new tab). If a tender asks for "Cyber Essentials", check whether it means basic or Plus before you budget.
For current public procurement, PPN 014 (opens in new tab) replaces PPN 09/14 and PPN 09/23. It sets out when in-scope public buyers should require Cyber Essentials, Plus or equivalent controls. The tender determines the required level and scope; the older PPN link above is historical context.
An indicative range, clearly labelled
For a small UK business that already runs managed, up-to-date devices, basic Cyber Essentials can come in close to the certification fee alone. Where controls are not yet in place, the getting-ready work is the larger number, and Plus adds an audit cost on top. We give a firm figure once we have seen your setup, because guessing helps no one. See how our pricing works, or read more about our wider cyber security services.
How to keep the cost sensible
- Review required MFA, supported software and completed updates before the assessment.
- Scope honestly. Agree an accurate scope that meets the scheme and buyer’s requirements; do not exclude required systems to reduce the fee.
- Keep preparation and formal assessment clear in your plan. They are separate pieces of work, and independently assured help to get ready can be bought separately from the assessment itself.
- Treat it as annual. Building the controls into how you run day to day makes renewal routine rather than a scramble.
Common questions
How much does Cyber Essentials certification cost in the UK?
The IASME certification fee for basic Cyber Essentials is banded by size: £320 + VAT for a micro business (0 to 9 people), £440 for small (10 to 49), £500 for medium (50 to 249) and £600 for large (250+). Reviewed 13 September 2026 against IASME (opens in new tab). Scheme fees change, so we confirm the current fee in writing before you place an order. Cyber Essentials Plus is priced separately.
How much does Cyber Essentials Plus cost?
Plus adds an independent technical audit, so it costs more than the basic certification, and the price scales with your device and user count and the complexity of your network. Our own prices, excluding VAT, are banded by size: £1,299 for a micro organisation, £1,699 up to 49 people, £2,199 up to 249, and from £2,999 above that, each including the base certification. Every one of those prices includes the Cyber Essentials certification itself, because you cannot hold Plus without it. Full detail is on our Cyber Essentials Plus page.
Is the certificate the main cost?
It depends on the starting point. If the controls are already in place, the assessment fee may be the main external cost. If devices, access or updates need work, remediation adds to the total. Ask for separate assessment and preparation figures.
How long does Cyber Essentials take?
Basic certification can be quick once the controls are in place. The variable is how much needs fixing first.
Is Cyber Essentials worth it?
It can be useful where a buyer requires certification or you want an independently assessed technical baseline. It addresses common internet-based threats within the certified scope. It is not a guarantee against compromise or a replacement for wider risk management.