How Much Does Cyber Essentials Cost? An Honest Breakdown

Published: 2 July 2026 · Updated: 6 October 2026

Ask “how much does Cyber Essentials cost?” and most answers give you the assessment fee and stop there. That’s honest as far as it goes — but it’s like quoting the cost of a driving test without mentioning the lessons. The full picture has three parts: the certification fee, the optional Plus audit, and the remediation work to bring your systems up to the standard. Only the first one has a price tag you can look up.

The certification fee: £320–£600 + VAT

Basic Cyber Essentials is a verified self-assessment, and the fee is set by IASME, the NCSC’s delivery partner for the scheme, banded by organisation size. The current fees are £320 + VAT for a micro organisation (0–9 employees), £440 for a small one (10–49), £500 for a medium one (50–249) and £600 for 250 or more (IASME). Certification bodies sometimes sell support or bundles on top, but the assessment fee itself is IASME’s. Fees do change, so check the current figures rather than trusting any blog, including this one.

For a typical SME, then: the certificate itself costs about as much as a decent office chair. If that were the whole story, everyone would have one.

Cyber Essentials Plus: typically £1,500–£3,000+

Plus covers the same five control areas but adds an independent technical audit — an assessor tests a sample of your devices, checks your builds and verifies the controls really exist. Pricing isn’t fixed the way the basic fee is: it depends on your size, number of locations and device sample, and each certification body quotes individually. For most SMEs it lands somewhere between £1,500 and £3,000+ ex VAT, on top of the basic certification, which you need first. Since April 2026 the stakes on the audit are higher too: if your sample fails, the retest covers a fresh random sample as well, and a second failure revokes your basic certificate (IASME).

Is it worth the difference? If a contract, framework or insurer specifically asks for Plus — common in defence supply chains, and government contracts can require Cyber Essentials or Plus under PPN 014 — then yes, because nothing else satisfies the requirement. If nobody is asking, the honest answer is that basic certification plus genuinely maintained controls beats a Plus badge on top of drifting ones.

What changed in April 2026

Assessments bought from 27 April 2026 use version 3.3 of the requirements and IASME’s “Danzell” question set (NCSC requirements v3.3). Two changes matter most for cost, because they turn things that used to be weak spots into automatic fails:

• MFA on every cloud service where it’s available, for admins and users alike, whether the MFA option is free, included or paid. Answer “no” and you fail.
• Patching within 14 days for critical and high-risk updates, now explicitly including router and firewall firmware, not just Windows.

Cloud services also can’t be quietly left out of scope any more, and the director’s declaration now covers staying compliant for the whole year, not just on the day of assessment. In practice that means less room to scrape through, and more value in fixing things properly first.

The real cost: getting ready to pass

Here’s the part the fee-only articles skip. Cyber Essentials requires every in-scope device to run supported software, users without admin rights for daily work, MFA on cloud services, firewalls configured properly and malware protection everywhere. If your environment already meets that, remediation costs you nothing. Most environments we assess don’t.

The common gaps, and what they really mean: a handful of machines on an out-of-support Windows version (replacement or upgrade — potentially hundreds of pounds per device); staff working day-to-day with local admin rights (engineering time to remove safely without breaking the awkward application that caused it); no MFA on email or cloud services (an automatic fail since April, and mostly rollout effort and user wrangling rather than licence cost); an internet router with the default config from whoever installed the broadband (a proper firewall review); unmanaged personal devices reading company email (policy decisions before technical ones).

That’s why quoting remediation without an assessment is guesswork. For one business it’s a quiet afternoon; for another it’s several thousand pounds of catch-up spending — usually accumulated over years of “we’ll sort that later”. Anyone who quotes you a flat remediation price before looking at your environment is guessing with your money.

It’s annual — budget for the habit, not the event

Certification lasts twelve months. The renewal fee is the same banded assessment fee each year — but the meaningful annual cost is keeping the controls true between certificates. A business that lets things drift for eleven months buys itself a small remediation project every renewal; a business whose IT is managed to the standard continuously finds renewal is mostly paperwork. Over three years, the second business pays less in total and is safer the whole time.

Can you just do it yourself?

Genuinely, sometimes yes. If you’re a small, cloud-only business with modern devices, no server room and a competent IT-literate owner, the self-assessment is within reach: read the requirements carefully, fix what falls short, answer truthfully. The scheme was designed to be accessible and we’d rather tell you that than pretend otherwise.

Where DIY goes wrong is scale and honesty. As soon as there are more than a dozen devices, legacy kit, or nobody with time to do the fixing, the questionnaire becomes a list of things you now know are broken. And the worst outcome isn’t failing — it’s passing by answering generously, which leaves you with a certificate that misdescribes your real position. If that’s ever tested by an insurer after an incident, the generous answers become the problem.

How we price it: included, not itemised

Our approach is different, and it’s the honest reason this article exists: for NorthMSP managed clients, Cyber Essentials — the remediation and the certification — is built into onboarding, with no upfront project fee. The onboarding assessment scopes exactly what your environment needs, the work is amortised into the monthly service rather than billed as a surprise project, and the controls are then maintained continuously so renewal stays boring. Cyber Essentials Plus isn’t included: its audit is carried out by an independent certification body, so we quote it separately. (Hardware, licensing and larger transformation projects are scoped and quoted separately — we’d rather say that plainly than hide it.)

Want to know where you stand before spending anything? Our free Cyber Essentials readiness check gives you an honest read in a couple of minutes (IASME also publishes its own readiness tool), or see how our certification support and secure onboarding fit together.