Blog › Article
What Cyber Essentials costs in 2026
The certificate itself is cheap and the price is fixed. What varies is everything around it: getting ready, fixing what the questionnaire turns up, and keeping it true for the year the certificate claims to cover.
How much does Cyber Essentials cost?
The assessment fee is set by IASME, the scheme's delivery partner, and depends only on how many people the organisation employs — not how many devices are in scope.
| Organisation size | Employees | Cyber Essentials fee |
|---|---|---|
| Micro | 0–9 | £320 + VAT |
| Small | 10–49 | £440 + VAT |
| Medium | 50–249 | £500 + VAT |
| Large | 250 or more | £600 + VAT |
Headcount is the whole organisation, even if only part of it is in scope. The fee covers the self-assessment questionnaire, the assessor's review, and the certificate if you pass. UK organisations with a turnover under £20 million also get cyber liability insurance bundled with the certificate.
Some certification bodies charge a little more for guided help; a few charge less. The underlying fee is the same everywhere, so a quote well above these figures is buying consultancy, not the certificate.
How much does Cyber Essentials Plus cost?
Cyber Essentials Plus is priced by each certification body rather than by IASME, because it involves a technical audit: an assessor tests a sample of your devices and scans what faces the internet, instead of taking your answers on trust. Most UK organisations pay somewhere between £1,500 and £3,000 + VAT, depending on the number of devices sampled and the number of sites. That is on top of the Cyber Essentials fee, which you need first.
Plus has to be completed within three months of passing Cyber Essentials, so the two are usually bought together.
The costs that aren't on the price list
For most small organisations the certificate is the smallest part of the bill. The larger parts are these.
Getting ready
Someone has to work out the scope, answer several dozen questions accurately and gather the evidence behind the answers. For a business without IT staff, that usually means paying an MSP or consultant for a few hours to a few days.
Fixing what the questionnaire finds
This is where budgets go wrong. The current question set has four automatic-fail questions, covering MFA on cloud services and high-risk updates applied within fourteen days. Fixing either can be free, or it can mean replacing hardware — an unsupported operating system cannot be patched, so a Windows 10 machine in scope has to be upgraded, replaced or removed, or moved into a separate subset with no internet access at all.
Internal time
Staff time spent answering questions, chasing laptop users and changing settings is real, even when nobody invoices for it.
The year after
A certificate lasts twelve months, and renewal costs the same fee again. The expensive renewals are the ones where nothing was checked in between, and a year's worth of drift — paused updates, a new laptop nobody set up, an admin account that should have gone — all has to be found and fixed in the fortnight before the deadline.
A realistic first-year budget for a small business is the fee plus one to three days of help, plus whatever hardware the questionnaire says must go. The fee is predictable. The remediation is not, which is why it pays to look before you buy.
What MSPs charge on top
Many MSPs sell Cyber Essentials as a package: the fee, the preparation and the submission for a fixed price. A growing number also sell the year in between as a monthly service — checking patch status, catching drift and keeping the evidence — so that renewal is a formality rather than a project. For the client, that turns an annual scramble into a known monthly cost. For the MSP, it turns a one-off job into recurring work.
If you're a business choosing an IT provider, ask them one question: can you show me how far behind each of our machines was on updates in any given month? The answer tells you whether the certificate will still be true in six months.
Quick answers
Is Cyber Essentials a one-off cost?
No. The certificate is valid for twelve months, and renewing costs the same fee again.
Is the price per device?
Not for Cyber Essentials, which is priced on headcount. Cyber Essentials Plus pricing usually does depend on how many devices are sampled.
Can I do it myself?
Yes. The questionnaire is designed to be answered by the organisation. Paying for help is optional, though it often costs less than failing and resubmitting.
Fees are IASME's published Cyber Essentials fees, excluding VAT. Cyber Essentials Plus prices are typical market ranges and vary by certification body. Check the current figures with your certification body before budgeting.