How Much Does Cyber Essentials Cost?

Cyber Essentials has no single price. What you pay is the assessment fee plus whatever it takes to get your systems to pass.

This post covers what moves each part of that cost, for Cyber Essentials and for Cyber Essentials Plus. It ends with the information you need for an accurate quote.

Your size band

IASME, the NCSC's Cyber Essentials delivery partner, sets the assessment fee by the number of people you employ. It publishes four size bands and their fees (opens in a new tab), from micro to large organisations.

The band sets the assessment fee. The work around it is what changes most from one organisation to the next.

Until 31 March 2027, eligible small organisations can get 75% off through the First Step Fund.

What's in scope

Scope is the part of your organisation the certificate covers. The NCSC's requirements expect the whole of your IT infrastructure or, if necessary, a well-defined sub-set kept apart from the rest by a firewall or VLAN.

A sub-set can shrink the work, but you have to justify the exclusion to your assessor. Cloud services can't be left out, and a scope without end-user devices isn't acceptable.

Certifying the whole organisation has a financial upside. UK organisations under IASME's turnover limit that certify the whole organisation get cyber liability insurance arranged by IASME.

Home working and personal devices widen the scope. Every device used for your organisation's work at home is in scope, and so is any personal phone or laptop that reaches organisational data or services.

Home routers you didn't supply are out of scope, so those laptops need a software firewall turned on. Phones used only for native calls and texts are out of scope, as are devices used only for an MFA app.

Getting ready often costs more than the assessment

The fee covers the assessment, not the fixes. The work to meet the five controls is a separate cost, and it's often the larger one.

MFA on every cloud service that offers it. Since the April 2026 changes, leaving it off fails the assessment even when MFA is a paid extra, so licence upgrades can land here.
Replacing unsupported software and devices. Everything in scope has to be licensed and supported, so an old operating system means an upgrade or a replacement, unless you move it into a sub-set with no internet access.
Patching within 14 days. High-risk and critical updates have to be installed within 14 days of release, so you need automatic updates and someone who checks they've worked.
Firewall and admin account changes. Default admin passwords on firewalls and routers have to go, and admin work moves to separate accounts used for nothing else.

Our Cyber Essentials guide goes through each control, so you can see where you stand before you ask for a quote. If you've still got Windows 10 devices, check how they're covered first.

What changes the cost of Cyber Essentials Plus

Cyber Essentials Plus checks the same controls with a hands-on technical audit. The NCSC says it's priced on the size and complexity of your network, so it's quoted rather than taken from a fee band.

You need Cyber Essentials first, and the Plus audit uses the same scope. IASME asks for the audit within three months of your last Cyber Essentials certificate, and after that you complete the self-assessment again as part of Plus.

The audit tests a sample, not every device. The assessor picks a representative sample of your devices and servers, plus at least one normal account and one admin account on every cloud service.

The more your device builds vary, the larger the sample. Standard builds managed centrally keep it small, while a mix of builds and personal devices makes it grow.

IASME allows the audit on site or remotely. A remote audit saves travel, which matters most if you have several sites.

We certify Cyber Essentials Plus ourselves. Since November 2026 our assessor carries out the technical audit and we issue the certificate.

Renewal every 12 months

Both certificates expire after 12 months. Renewal is a full new assessment against whichever question set is current, so budget for it every year.

Government contracts that ask for Cyber Essentials expect you to renew for as long as the contract runs. Between renewals, the cost is keeping the controls in place, such as patching on time and replacing devices before support ends.

What failing costs

A failed assessment costs time as well as money. You fix the gaps and go again, while a contract or tender may already be waiting on the certificate.

For Plus, a failed patching test now leads to a retest of the original sample and a new random sample of devices. Fixing only the devices tested the first time won't get you through.

Ask whether a retest is included in your quote. A check on a sample of devices before the audit shows what fails while there's still time to fix it.

How to get an accurate quote

Have these to hand when you ask for a quote.

The number of people you employ, for your IASME size band.
What you want certified: the whole organisation or a named sub-set.
How many devices and servers you have, and the operating systems they run.
Whether staff use personal phones or laptops for work email or files.
The cloud services you use, such as Microsoft 365, and whether MFA is on for each.
How many sites you have, and whether people work from home.
Whether you need Plus, and the date a contract or tender needs the certificate by.
The date of your current certificate, if you have one.

As an IASME-accredited Certification Body, we certify Cyber Essentials directly. We scope and quote any work to get you ready before it starts.

Sources

Common questions