Most people asking what Cyber Essentials costs have been sent looking by someone else — an insurer, a principal firm, or a client who put it in a contract. They want a number so they can budget for it.
The number they usually find is the assessment fee, which is the smallest part of the bill. This is the honest breakdown: what the certificate costs, what Cyber Essentials Plus costs, and what actually lands on your card in year one.
The assessment fee
Cyber Essentials is administered by IASME on behalf of the NCSC. The assessment fee is set by organisation size, and at the time of writing the 2026 fees are:
| Organisation size | Assessment fee | |---|---| | Micro (1–9 people) | £330 + VAT | | Small (10–49) | £400 + VAT | | Medium (50–249) | £450 + VAT | | Large (250+) | £500 + VAT |
That is the fee for the self-assessment route: you answer the questionnaire for your own estate, a director signs it off, and nobody visits.
Why quotes range from £300 to £800 for the same thing
You will find certification bodies charging anywhere from about £300 to £800 or more. It is worth being clear about what that difference buys, because it is not the certificate.
Every IASME-licensed certification body issues the same government-backed certificate. A £300 certificate and an £800 certificate are identical on the wall. What varies is the service around it: how fast they turn it round, whether a failed submission can be resubmitted without paying again, and how much hand-holding you get on the questionnaire.
If you are confident in your answers, the cheap end is genuinely fine. If you are not, the resubmission policy is the thing to check before you buy — failing and re-paying is the most common way a £400 certificate becomes an £800 one.
Cyber Essentials Plus
Plus is the same five controls, independently tested. An assessor probes your machines rather than taking your word for it. Pricing starts around:
| Organisation size | Cyber Essentials Plus | |---|---| | Micro (0–9) | from £1,399 + VAT | | Small (10–49) | from £1,699 + VAT | | Medium (50–249) | from £2,399 + VAT | | Large (250+) | from £3,499 + VAT |
Two things to know. First, you need a valid Cyber Essentials certificate before you can sit Plus, so the fees stack. Second, "from" is doing real work in those figures — the audit is priced on the size and messiness of your estate, so a 30-person firm with three offices and a pile of unmanaged laptops will not pay the headline number.
Only go for Plus if something specifically requires it. Plenty of firms buy Plus because it sounds better, when the contract that prompted the whole exercise only asked for the base certificate.
The part nobody quotes you for
Here is where the real money is. The questionnaire assumes you already have five controls in place. It does not ask you to buy them — it asks you to confirm they exist. If they do not, you have two options: fix them, or answer dishonestly and hold a certificate that will not survive contact with an incident.
Typical remediation for a small firm that has never done this:
- Multi-factor authentication across every cloud account. Usually free on the licences you already own, but it costs time and a fortnight of people grumbling.
- Replacing unsupported software and hardware. The certificate killer. Any machine on an operating system past end-of-life fails you outright, and a handful of ageing laptops is a real capital cost.
- Patching within 14 days for high-severity fixes. Free in theory. In practice it means something has to actually check and report, rather than everyone assuming Windows sorted itself out.
- Malware protection on every device, properly managed rather than whatever shipped with the machine.
- Removing accounts and admin rights nobody should still have. Free, tedious, and almost always finds something.
For a typical 25-person firm starting from a standing start, realistic first-year spend lands around £1,800–£3,500 once remediation is included. The £400 assessment fee is roughly a fifth of it.
One thing that offsets the cost
A valid Cyber Essentials certificate includes £25,000 of cyber liability cover through IASME, provided you meet the eligibility criteria — broadly, a UK-registered organisation under £20m turnover with the whole organisation in scope.
It is not a substitute for a proper cyber policy, and the limits are modest. But if you were going to certify anyway, it is worth checking you qualify rather than discovering afterwards that a scoping decision cost you the cover.
What we would tell you to budget
- Certificate only, systems already in decent shape: £330–£500 + VAT, done in a couple of weeks.
- Certificate plus honest remediation, small firm: £1,800–£3,500 in year one, most of it one-off.
- Plus, where a contract demands it: add £1,399–£2,399 + VAT on top, and expect the audit to find things.
- Every year after: the assessment fee again, plus whatever it costs to keep the controls true.
That last line is the one firms forget. Cyber Essentials is annual. A certificate earned by a scramble in March is a scramble again next March, unless the controls stayed in place in between.
Doing it so it stays done
The firms that find recertification painless are not the ones that spent the most. They are the ones where patching, MFA, device encryption, and account hygiene run continuously, so the questionnaire is a description of how things already are rather than a project.
We built Telebyte Shield for that: managed security for small and regulated firms, running the same stack we use across our own estate. Encryption, patching, MFA, threat protection, and a compliance dashboard from £25 per user per month, with Cyber Essentials certification available as an add-on on the Compliance+ tier — so the certificate is the by-product of controls that genuinely exist.
If you are pricing this up because someone asked you for it, tell us what you have been asked for and we will tell you honestly whether you need Plus or whether the base certificate closes it.
Fees quoted are IASME's published 2026 assessment fees and typical market rates for Plus at the time of writing. Certification bodies set their own prices above the assessment fee, so check what your quote includes before you buy.