How much does Cyber Essentials cost? A plain guide to the full cost
Cyber Essentials certification itself is inexpensive. The IASME (opens in new tab) certification fee is banded by organisation size, from £320 + VAT for a micro business up to £600 + VAT for the largest, and Cyber Essentials Plus is quoted separately because it adds an independent technical audit scaled to your devices, users and network complexity. For most UK businesses, most of the cost is the work to meet the five controls before assessment, not the certificate. As a Cyber Essentials certification body, we see that gap decide the total figure.
The short version
People ask what Cyber Essentials costs as though there is one price. There are two numbers: the certification fee, which is small and fixed by size, and the cost of getting ready, which varies with how much good security you already run. A business with tidy Microsoft 365 settings and managed devices may pay little more than the fee. A business starting from scratch pays for the remediation first.
What drives the cost
- Your size. The IASME fee is banded by employee count, so a micro business pays less than a mid-sized one.
- Self-assessment or Plus. Basic Cyber Essentials is a verified self-assessment. Cyber Essentials Plus adds an independent technical audit, which costs more and takes more of your time.
- How ready you are. Multi-factor authentication, supported software, working patching and a clean device build are the common gaps. Closing them is where most of the money goes.
- Who does the work. Doing it yourself costs time. Buying help to implement the controls costs a fee. Preparation and formal assessment are separate pieces of work, priced separately, and you can buy them from different suppliers.
The two costs, separated
IASME certification fee, basic Cyber Essentials (verified self-assessment, banded by size, all + VAT):
| Organisation size | Employees | Fee (+ VAT) |
|---|---|---|
| Micro | 1 to 9 | £320 |
| Small | 10 to 49 | £440 |
| Medium | 50 to 249 | £500 |
| Large | 250+ | £600 |
Figures are IASME's certification fee for basic Cyber Essentials, reviewed 23 August 2026 against IASME (opens in new tab) and the NCSC's Cyber Essentials pages (opens in new tab). Scheme fees change, so we confirm the current fee in writing before you place an order. Cyber Essentials Plus is priced separately.
Everything else:
| Component | Typical scale | Notes |
|---|---|---|
| Cyber Essentials Plus audit | Quoted separately, by size and complexity | Independent technical test on top of the basic assessment. The price scales with the number of devices, users and network complexity, so it is quoted rather than banded. Our own Cyber Essentials Plus prices, all excluding VAT, are on our Cyber Essentials page, and how our pricing works covers the rest |
| Getting ready (remediation) | Nil to low thousands | MFA, patching, supported software, device configuration |
| Ongoing (annual renewal) | The fee again, each year | Certification lasts twelve months |
What changed in April 2026 (and why it can raise the getting-ready cost)
In April 2026 two of the five controls got stricter and now cause an automatic fail. Multi-factor authentication is required on all cloud services where it is available, and high-risk or critical security updates must be installed within 14 days. The current question set, and the date it applies from, are published by IASME (opens in new tab). If those are not already in place, they are the first things to budget for, because you cannot pass without them.
Cyber Essentials vs Cyber Essentials Plus
Basic Cyber Essentials is a self-assessment that an appointed certification body verifies. Cyber Essentials Plus covers the same five controls but adds a technical audit, where an assessor tests a sample of your devices and accounts to confirm the controls work. Plus costs more and is often the version required for government and defence-related contracts. Central government has required Cyber Essentials certification on certain contracts since 2014, under Procurement Policy Note 09/14 (opens in new tab). If a tender asks for "Cyber Essentials", check whether it means basic or Plus before you budget.
An indicative range, clearly labelled
For a small UK business that already runs managed, up-to-date devices, basic Cyber Essentials can come in close to the certification fee alone. Where controls are not yet in place, the getting-ready work is the larger number, and Plus adds an audit cost on top. We give a firm figure once we have seen your setup, because guessing helps no one. See how our pricing works, or read more about our wider cyber security services.
How to keep the cost sensible
- Fix the common gaps first: MFA everywhere, remove unsupported software, confirm patching works.
- Scope honestly. A tighter, accurate scope is cheaper to certify and easier to keep.
- Keep preparation and formal assessment clear in your plan. They are separate pieces of work, and independently assured help to get ready can be bought separately from the assessment itself.
- Treat it as annual. Building the controls into how you run day to day makes renewal routine rather than a scramble.
Common questions
How much does Cyber Essentials certification cost in the UK?
The IASME certification fee for basic Cyber Essentials is banded by size: £320 + VAT for a micro business (1 to 9 people), £440 for small (10 to 49), £500 for medium (50 to 249) and £600 for large (250+). Reviewed 23 August 2026 against IASME (opens in new tab). Scheme fees change, so we confirm the current fee in writing before you place an order. Cyber Essentials Plus is priced separately.
How much does Cyber Essentials Plus cost?
Plus adds an independent technical audit, so it costs more than the basic certification. The price scales with the number of devices and users and the complexity of your network, so it is quoted rather than banded. Our own Cyber Essentials Plus prices, all excluding VAT, are published on our Cyber Essentials page.
Is the certificate the main cost?
Usually not. For most businesses the larger cost is the work to meet the five controls before assessment, such as multi-factor authentication and patching.
How long does Cyber Essentials take?
Basic certification can be quick once the controls are in place. The variable is how much needs fixing first.
Is Cyber Essentials worth it?
For most UK businesses, yes. It is a recognised baseline, it is often required to bid for public sector and defence-linked work, and the controls block a large share of common attacks.
Want a figure for Cyber Essentials?
We are a Cyber Essentials certification body. Tell us your size and setup and we will give you a figure. Preparation and formal assessment are separate pieces of work, and we will tell you which you need.