How much does Cyber Essentials certification actually cost? The headline certification fee is only part of the picture. This guide breaks down every cost element for Cyber Essentials and Cyber Essentials Plus in 2026: official fees, internal resources, remediation, consultancy, tooling, and annual renewal. Whether you run a five-person startup or a 500-employee mid-market firm, use these figures to build a realistic budget.

Key takeaways

• Basic Cyber Essentials costs £500 to £700 + VAT. IASME sets the assessment fee and bands it by company size, so every certification body charges the same scheme fee.
• The Cyber Essentials Plus cost with Cyphere starts from £1,299 + VAT for organisations under 50 staff, and includes the self-assessment, a readiness check, the technical audit and certification.
• The Cyber Essentials certification fee is rarely the highest cost. Replacing unsupported devices and enabling MFA on every cloud service usually cost more, and take longer.
• Both Cyber Essentials certificates last 12 months, so budget for annual renewal as a fixed annual cost. Eligible UK companies get free cyber insurance with the basic certificate.

Basic Cyber Essentials costs £500 to £700 + VAT, depending on the size of your organisation. The assessment fee is set by IASME, so it is the same through every certification body. Cyber Essentials Plus with Cyphere starts from £1,299 + VAT, or £999 + VAT alongside an eligible security engagement, and covers both levels in one engagement.

We publish our prices because the first question anyone asks is what this will cost, and hiding the answer wastes everyone’s time. The IASME fee is the same everywhere.

This guide is for anyone budgeting for Cyber Essentials certification, whether a buyer has asked for it for government contracts or supply chain work, or you want it as a baseline. This certification proves your organisation follows the five main technical control areas covering the most common cyber attacks. The CE scheme helps IT and security teams to provide a clearer understanding of the organisation’s cyber security level to the senior stakeholders. This could help identify if any IT investments require prioritisation at people, process and/or tech control levels to improve security posture and lower the likelihood of data breaches.

This guide breaks the Cyber Essentials cost down into the scheme fees, what a Cyber Essentials Plus price includes, the additional costs that sit outside the fee, what failing costs, and what annual renewal costs. Cyphere is an IASME-licensed certification body, so the Plus prices below are our own and are published in full on our Cyber Essentials Plus certification page.

We publish them because the first question anyone asks is what this will cost, and hiding the answer wastes everyone’s time.

Cyber Essentials certification levels: What are they?

There are two certification levels, and the price depends on which one you need:

• Cyber Essentials is a verified self-assessment process. You answer the Cyber Essentials questionnaire (IASME’s self-assessment questionnaire), a director or board member signs a declaration, and an assessor at a certification body marks it. There is no technical testing involved here. Cyber Essentials is a verified self-assessment process.
• Cyber Essentials Plus adds independent assurance: a hands-on audit of the same five Cyber Essentials controls on a sample of your devices and every cloud service in scope, carried out by an assessor. Cyber Essentials Plus adds a hands-on audit and requires independent technical testing of live systems.

Our guide to Cyber Essentials vs Cyber Essentials Plus explains which level buyers ask for.

Cyber Essentials certification cost based on the company size

The National Cyber Security Centre (NCSC) owns Cyber Essentials and sets the requirements to protect your business against the most common cyber threats. IASME, the scheme’s delivery partner, sets the assessment fee and licenses the certification bodies that carry out assessments. The fee is banded by company size, using the UK government’s employee-number criteria.

Directly applying for CE with IASME assessment costs you less, with CE prices starting from £320 +VAT for micro businesses. You can find more here IASME’s Cyber Essentials on the IASME website, checked 26 September 2026. These bands have applied since 1 April 2024.

What differs between certification bodies is the certification services around the assessment: agreeing scope, answering questions, and what happens if something comes back non-compliant. We run a transparent pricing structure with no hidden costs, and no support charges on any certification unless agreed in advance.

Cyber Essentials Plus Certification cost: what certification includes

You cannot hold Cyber Essentials Plus without basic Cyber Essentials, and the Plus audit must be completed within 90 days of the basic certificate. Our Cyber Essentials Plus certification price therefore covers both levels in one engagement.

What’s included in the above costs?

• The Cyber Essentials self-assessment (VSA)
• A readiness check (a £499 value)
• The Cyber Essentials Plus technical audit
• A 30-day remediation window on any findings
• Certification

What is not included?

• Any findings from the readiness check or audit are not included.

If you are not sure you would pass today, a standalone Cyber Essentials Plus gap analysis costs from £499 + VAT and is fully credited against certification if you go ahead within 60 days.

What the audit involves?

A qualified assessor connects remotely to test a sample of your devices and every cloud service in scope against the five controls: firewalls, secure configuration, security update management, user access control and malware protection. That includes two vulnerability scans: an authenticated scan of the sampled devices to find high and critical updates missing for more than 14 days, and an external vulnerability scan of your internet-facing systems. Malware tests and MFA checks complete the audit.

What sets the cost?

• The cost band is set by headcount, and organisations over 500 staff are quoted individually.
• If you have already passed basic Cyber Essentials with another certification body in the last three months, we quote the Plus audit alone.

Remote or on-site

We carry out the Cyber Essentials Plus audit remotely for the vast majority of organisations, including the device sampling and technical checks. If your environment genuinely needs on-site testing, tell us at scoping, and we will plan for it.

Why £999 alongside a security engagement?

Where Cyphere is already carrying out cyber security work for you, such as an annual IT security health check, CREST pentesting or a cyber security audit, the Cyber Essentials Plus cost drops to a fixed price of £999.

Cost-saving points

• First-time applicants get two working days to correct non-compliant answers at the basic level, and 30 days to fix and retest Cyber Essentials Plus findings inside the 90-day window, at no extra cost.
• Both Cyber Essentials certificates are valid for 12 months.
• Complete the Plus audit within 90 days of your basic certificate, so the basic assessment does not need repeating.

Suggested read: Cyber Essentials Plus checklist.

Free download: Cyber Essentials changes April 2026 (Willow to Danzell)

Additional costs: the Cyber Essentials cost planning checklist

Financial planning for Cyber Essentials is not only the certification fee. For most UK companies, the additional costs sit in getting the estate ready. These are the costs your budget needs to cover.

Time for the basic assessment

• After a readiness check with Cyphere, provided your official questionnaire sheet is ready, the submission itself shouldn’t take more than an hour to complete.
• Human cost-wise, the actual preparation for Cyber Essentials typically requires 20 to 60 person-hours.
• Allow preparation time to gather the information the question set asks for; the readiness check and consultations cover this.
• Our assessors aim to mark the basic Cyber Essentials certification submission within two business days, and most are marked within one.
• If any answer is non-compliant, you have two working days to correct and resubmit.
• Cyber Essentials certificates can arrive in your inbox within minutes of passing.

Hidden technical costs for Cyber Essentials Plus

• Every device in scope must run supported operating systems and software; this is non-negotiable. Budget for upgrading unsupported systems, or for segregating them into a sub-set with no internet traffic.
• High and critical security updates must be applied within 14 days of release, so patching has to be reliable before the audit, not fixed for the audit, and the audit’s vulnerability scans will find anything older than 14 days. If a managed service provider patches for you, their delay is still your fail.
• Every cloud service in scope must use MFA. Where a cloud service provider charges extra for multi-factor authentication, that licence is a real cost.
• Some cyber security measures, configuration changes, minor documentation and policy work may be needed where the basic prerequisites are not in place. Policy templates are not required by the scheme; the assessment tests technical controls.
• Resource time to get the environment ready. We prepare customers to pass first time rather than enter a fail and retry cycle.
• Consultancies that charge additional fees can range from £50 to £200 per hour. Pre-assessment guidance can add £1,000 to £1,500 to costs. Cyphere charges you £499 for gap analysis for 1-50 staff companies.

Certification process costs

• Unlimited consultations with the Cyphere team, online and by phone, are included.
• A director or board member’s time for the declaration each time an application or resubmission is submitted.
• If you also need penetration testing, combining it with Cyber Essentials Plus is cheaper and quicker than running the two separately.
• Ongoing time for the staff member who owns Cyber Essentials internally, and support from your IT provider where the controls sit with them.

Remediation

• Two working days to resubmit at basic, at no extra cost; 30 days to fix and retest Cyber Essentials Plus findings, inside the 90-day window.
• The cost of implementing any security improvements the readiness check or audit finds.

From the assessor’s desk

Often, the management may find these items as hidden costs: replacement of hardware, licensing fees for unsupported operating systems, a firewall vendor hasn’t updated as you didn’t pay for a higher tier, or similar costs. If your environment is taking care of unsupported software and hardware already, there shouldn’t be such surprises, and the Cyber Essentials certification process should be straightforward.

Harman Singh, IASME-licensed Cyber Essentials assessor, Cyphere

Did the April 2026 changes affect the cost?

The IASME scheme fees for Cyber Essentials certification did not change with Danzell. What changed is preparation. Under the Danzell (v3.3) question set, cloud services cannot be excluded from scope, and three areas are automatic fails: unsupported software, a cloud service without MFA, and high or critical updates not applied within 14 days.

Cyber Essentials Plus also adds a second sample to confirm fixes were applied across the estate. Most organisations that had not listed their cloud services or tracked patching closely now spend more time getting ready. See the April 2026 Danzell changes.

What does it cost if you fail?

At the basic level, you have two working days to correct non-compliant answers and resubmit, at no extra cost. At CE Plus, you have 30 days to fix failed items and have them retested, including re-running the vulnerability scans, inside the 90-day window.

Failing again, or missing the correction window, generally means paying the assessment fee again. That is why a readiness check before you submit, as a sense check against the five controls, tends to be the cheapest part of the process. See why organisations fail Cyber Essentials.

Annual renewal: how much does Cyber Essentials cost each year?

Both Cyber Essentials certificates last 12 months from the day the application is assessed and marked as a pass, and annual renewal is a fresh assessment, so the same certification fee applies each year for your size band. If your headcount moves you into a different band, the fee moves with it.

Internal and remediation costs usually fall after year one, because once you are certified, the controls and evidence are already in place. The exception is operating systems that go out of support during the year; Windows 10 was the 2025 example, and replacing those devices is a renewal cost. See our renewal guide.

Does the free cyber insurance offset the cost?

Organisations domiciled in the UK or Crown Dependencies with annual turnover under £20 million that certify their whole organisation can opt in to cyber liability insurance with the basic certificate, at no extra charge, with a £25,000 limit (IASME’s insurance page).

It does not reduce the fee, but for a small organisation without cover it offsets part of it. Read the policy wording before relying on it. Our guide on whether Cyber Essentials is worth it covers the insurance in more detail.

Ways to reduce the cost of Cyber Essentials

Funded help

• The NCSC’s Funded Cyber Essentials Programme, which gave small organisations in high-risk sectors free support from Cyber Advisors, is now closed.
• IASME and the NCSC announce funded programmes for particular sectors from time to time, so check the IASME website and the NCSC’s guidance before you budget.
• There is no current government grant for the certification fee itself.

Get a readiness check before the assessment

• Use IASME’s free readiness tool, the question set preview and the control-by-control guidance on the IASME website to find gaps before you pay for an assessment.
• Put the basics in place first: supported software, automatic updates, multi-factor authentication on every cloud service, separate administrator accounts (user access control) and a firewall on every device. Our requirements guide covers each control.
• Read the question set and the process before you start the clock: once you have portal access, you have six months to submit before the account is deleted.

Choose the right certification body

• The basic fee is fixed, so compare what sits around it: the readiness check, access to an assessor, resubmission terms and Plus pricing.
• Some certification bodies work mainly with particular sectors or a particular business size; relevant experience shortens the process.
• Check the body is licensed on IASME’s certification body directory. Our guide to choosing a certification body covers what to confirm before you buy.

DIY or supported: is the cheapest option a false economy?

• You will see basic Cyber Essentials certification offered at the bare scheme fee, as monthly subscriptions, and as “guaranteed pass” packages. None is wrong, but read what each includes; buyers awarding government contracts check the IASME register of certified organisations, not the package you bought. The scheme fee buys one assessment and one correction window. A subscription spreads the cost but still pays the scheme fee each year.
• No certification body can guarantee a pass, because the assessor marks your estate against the requirements; a “guarantee” usually means free resubmission, which is useful but different. What you pay for above the fee is the work that produces a first-time pass.

How Cyphere prices Cyber Essentials certification

From the assessor’s desk

What you pay us for is the readiness check, an assessor you can speak to, unlimited consultations, and one engagement covering both levels, minimising your risk and leading you to a first-time pass. If we are already doing security work for you, the scoping is done, so Cyber Essentials Plus drops to £999. No fluff, just how it is.

Harman Singh, IASME-licensed Cyber Essentials assessor, Cyphere

Get a fixed Cyber Essentials Plus certification quote

Cyber Essentials cost FAQs

How much does Cyber Essentials cost for the basic certification?

£500 to £700 + VAT, banded by organisation size: £500 for micro companies with 0 to 9 employees, £600 for small, £650 for medium and £700 for large.

How much does Cyber Essentials Plus cost?

With Cyphere, Cyber Essentials Plus certification costs from £1,299 + VAT for organisations under 50 staff, £1,599 for 50 to 249 and £1,999 for 250 to 500, with larger organisations quoted individually. The price includes the self-assessment, a readiness check, the technical audit and certification, and is £999 + VAT alongside a Cyphere security engagement.

Is Cyber Essentials free?

No. The assessment fee applies to every assessment. The National Cyber Security Centre’s Funded Cyber Essentials Programme, which paid for advisor support rather than the fee, has closed, and funded programmes for particular sectors appear from time to time, so check the NCSC and IASME websites.

Is Cyber Essentials an annual cost?

Yes. Cyber Essentials certification is an annual cost: both certificates last 12 months and annual renewal is a fresh assessment, so the certification fee for your size band applies each year. Remediation and internal costs usually fall after the first year.

What does Cyber Essentials Plus include?

An independent technical audit of the five controls on a sample of your devices and every cloud service, delivered remotely by Cyphere for the vast majority of organisations: vulnerability scans, malware tests, MFA and account separation checks. Our Cyber Essentials Plus certification price also covers the basic verified self-assessment, consultations and a readiness check.

Is a readiness check cheaper than failing?

Yes, almost always. The first correction is free, but failing again or missing the window generally means paying for a new assessment, and a lapsed timetable can cost you a tender. Our readiness check is included in the Cyber Essentials Plus price.

Can we reduce the cost by narrowing the scope?

A narrower scope can reduce remediation work, but the limits are strict. Under v3.3, cloud services cannot be excluded, and a scope that does not include end-user devices is not acceptable. A sub-set is named on your certificate instead of your whole organisation, and some buyers in public sector supply chains will not accept it.

The fee itself does not fall: IASME sets the band by organisation size, using the UK government’s employee-number criteria, not by what sits inside the scope. See our scope guide.

Is Cyber Essentials cheaper than ISO 27001?

Yes, considerably. Basic Cyber Essentials certification costs hundreds of pounds and, for a prepared organisation, takes one to two weeks; ISO 27001 involves months of implementation, audit fees and annual surveillance audits. See Cyber Essentials vs ISO 27001.

Related Cyber Essentials guides

• What is Cyber Essentials?
• Cyber Essentials vs Cyber Essentials Plus: which level you need
• How long does Cyber Essentials take?
• Is Cyber Essentials worth it?
• Cyber Essentials renewal