All services Every engagement has a fixed, published price. Book a strategy call
The real Cyber Essentials cost in the UK: official IASME fees by size band, realistic Cyber Essentials Plus pricing, three realistic all-in budgets, the hidden costs, and how to avoid overpaying.
This guide answers the question directly, with the official numbers first and the honest extras after. It is written by an IASME licensed certification body, which means we assess and certify organisations against Cyber Essentials ourselves, our prices are published, and we have no reason to make the cost sound more complicated than it is.
The short answer. The official Cyber Essentials cost in the UK is £320 to £600 + VAT, set by your organisation size. Cyber Essentials Plus commonly costs £1,500 to £3,000 + VAT in the market. Our published price is £1,150 + VAT, fixed. The number most buyers get wrong is the total: once preparation, fixes and internal time are counted, a typical SME spends somewhere between the official fee alone and a few thousand pounds in year one. Every one of those numbers is broken down below. For a figure specific to your organisation, use our Cyber Essentials cost calculator. Five questions, no email address.
The official Cyber Essentials cost is set by IASME, which runs the scheme for the UK government’s National Cyber Security Centre, and it depends only on the size of your organisation. Every certification body charges the same official assessment fee. Anything above it is services rather than certification.
| Organisation size | Employees | Official fee |
|---|---|---|
| Micro | 0 to 9 | £320 + VAT |
| Small | 10 to 49 | £440 + VAT |
| Medium | 50 to 249 | £500 + VAT |
| Large | 250 and above | £600 + VAT |
That is the whole of the official Cyber Essentials price in the UK. If a quote for basic Cyber Essentials certification is far above these figures, you are being quoted for the fee plus services, and the quote should say so line by line. Later in this guide we cover when those services are worth paying for and when they are padding.
The IASME Cyber Essentials cost buys more than a badge. The fee covers access to the assessment portal, the self-assessment questionnaire, review of your answers by a qualified assessor, a re-submission window if something needs correcting, and the certificate and badge when you pass. Organisations certifying the whole business with under £20 million turnover, and headquartered in the UK, also receive cyber liability insurance with £25,000 of cover included at no extra cost.
Two things the fee does not buy: anyone to prepare your answers, and anyone to fix the gaps the questionnaire exposes. Those are where the real variation in Cyber Essentials pricing UK wide comes from, so they get their own sections below.
Cyber Essentials Plus takes the same controls as basic Cyber Essentials and has an assessor verify them with a hands-on technical audit: vulnerability scans, checks on a sample of devices, email and browser tests. Because there is real audit labour involved, there is no single official fee. Each certification body prices its own assessment. Most UK businesses pay between £1,500 and £3,000 + VAT. Our published Cyber Essentials Plus price is £1,150 + VAT, fixed before we start, delivered in one to three weeks.
| What moves the Cyber Essentials Plus cost | Why it matters |
|---|---|
| Number of devices and device types | The audit tests a sample across every operating system you use. More variety means more testing time |
| Locations and remote workers | Testing is arranged around where devices are. Dispersed estates take longer to coordinate |
| Server estate | Internally hosted systems add scanning scope that a fully cloud-based business does not have |
| Timing | Cyber Essentials Plus must be completed within the required window after your basic certification, so a rushed timeline can add cost |
| Failures and retests | If the audit finds problems, fixing and retesting can add fees. Preparation is cheaper than a second audit |
These three budgets cover most UK SMEs. If you want the same logic applied to your own headcount, devices and support needs, the cost calculator builds your figure in under a minute.
The honest answer to the Cyber Essentials certification cost UK question is a range, because the certificate fee is fixed but organisations are not. These three budgets reflect what we see in practice. Treat them as planning figures rather than quotes.
| Scenario | What it involves | Realistic first year budget |
|---|---|---|
| Micro business, simple IT A handful of laptops, cloud email, no servers | Self-assess using the official portal, fix small gaps yourself as you answer | £320 + VAT plus your own time, typically a day or two spread across the process |
| SME, mixed maturity 10 to 100 staff, some older kit, an IT provider but no security lead | Guided certification: someone who knows the scheme prepares the answers with you and tells you exactly what to fix | Official fee plus support, commonly £800 to £2,500 + VAT all in, depending on how much fixing the estate needs |
| Supplier facing a contract deadline Cyber Essentials Plus required by a customer or framework, on a date | Readiness check first, gaps fixed, then basic certification and the Plus audit inside the required window | Commonly £2,000 to £5,000 + VAT all in. Less if the estate is already tidy |
Notice what drives the differences: not the certificate, but the state of the estate being certified. The Cyber Essentials SME cost question is really a question about how much modernising the business has been putting off, and the scheme simply presents the bill.
Internal time. Somebody has to answer the questionnaire accurately and gather the evidence: what devices exist, what software runs on them, who has admin rights. For a tidy micro business that is hours. For an SME that has never kept an asset list, it is days. This cost is invisible on every quote and real on every certification.
Remediation. The same handful of gaps drive most remediation bills: unsupported operating systems and software still in use, multi-factor authentication not yet enforced on cloud services, day-to-day work done from administrator accounts, security updates applied slower than the required fourteen days, and default or shared passwords. None of these is exotic, and all of them are worth fixing whether or not a certificate is involved.
Failure and retesting. A failed submission or a failed Plus audit costs time, and sometimes fees, to put right. The cheapest insurance against it is an honest readiness check before you submit rather than after you fail.
Renewal. Cyber Essentials lasts twelve months. The official fee is payable every year, and buyers who budget for a one-off purchase are surprised in month thirteen. The good news: year two is nearly always cheaper in effort, because the estate was fixed in year one.
Search for Cyber Essentials pricing UK and you will find quotes from a few hundred pounds to several thousand for what sounds like the same certificate. The certificate is the same. The difference is what is wrapped around it, and whether the wrapping is declared.
Resellers add a layer. Many firms selling Cyber Essentials are not certification bodies. They collect your details, add a margin, and pass the assessment to a body like ours. The certificate is identical. If you are paying more than the official fee for basic certification, you should know exactly what service you are getting for the difference.
Bundles hide the split. Quotes that mix the official fee, a software platform, per-user charges and consultancy into one number make comparison impossible, which is usually the point. A good quote shows the official assessment fee on its own line and prices every service separately, so you can decline the parts you do not need.
Day rates attach themselves. Some consultancies treat Cyber Essentials as an entry point for open-ended security work billed by the day. Preparation help is genuinely valuable for many organisations. Open-ended is the part to refuse. Fixed prices exist in this market, so insist on them.
Urgency costs money. A certificate needed in a fortnight for a contract leaves no room to shop around or fix things calmly. If a customer requirement is likely, start before the deadline exists: the same certification costs less when nobody is panicking.
Six moves keep the total close to the official fee. First, self-assess if you have capable IT: the questionnaire is designed to be answerable by the organisation itself, and the portal fee includes assessor review. Second, fix the usual suspects before you submit: supported software, updates within fourteen days, multi-factor authentication on cloud services, separate admin accounts, and no default passwords. Third, scope honestly: whole-organisation certification is what most customers and the insurance benefit expect, so do not pay to certify a sliver that will not satisfy anyone. Fourth, use the re-submission window rather than paying anyone to panic on your behalf. Fifth, buy from a certification body directly, or from a reseller who declares their margin and adds real service for it. Sixth, if you need Cyber Essentials Plus, book it with the basic certification so both land inside the required window: doing them together is cheaper than doing them twice.
A certification body is licensed by IASME to assess and certify organisations. Its assessors mark your questionnaire and, for Plus, carry out the audit. A reseller sells you the process and hands the assessment to a certification body. Neither is wrong, but you should know which one you are buying from, because the answer explains the price. Intelance is an IASME licensed certification body: when we certify an organisation, our own assessors do the assessing, the official fee is passed through at cost, and everything we add is a published fixed price. That is also why we can say, without a sales agenda, that a capable micro business should often just self-assess for £320.
For most UK organisations, yes, for three unglamorous reasons. First, eligibility: many UK government contracts involving personal data or certain technical services require Cyber Essentials, and a growing number of large private buyers ask for it in supplier onboarding, so the certificate increasingly decides whether you can bid at all. Second, the insurance benefit: eligible organisations certifying the whole business receive £25,000 of cyber liability cover with the certificate. Third, and most practically: the five control areas the scheme tests are the boring, effective hygiene that stops the most common attacks. The certificate is evidence. The controls are the value. An organisation that would not pass Cyber Essentials is carrying risk it has not priced, and the certification fee is the cheapest line in that particular ledger.
Everything is published, so this section is short. Basic Cyber Essentials certification: the official fee of £320 to £600 + VAT by size, nothing added, with a guided option at £950 + VAT if you want our assessors to prepare the submission with you and tell you exactly what to fix. Cyber Essentials Plus: £1,150 + VAT, fixed before we start, one to three weeks. If your estate is not ready, we say so before you spend audit money, because a readiness conversation is cheaper than a failed audit. Weigh our view as you would any provider writing about its own market. The reason the prices are on the pages is so you can check the comparison without talking to us.
A small business with 10 to 49 employees pays the official fee of £440 + VAT to self-assess. With guided support the typical all-in figure is commonly £800 to £2,500 + VAT, depending on how much fixing the IT estate needs first.
£320 + VAT for micro organisations (0 to 9 employees), £440 for small (10 to 49), £500 for medium (50 to 249) and £600 for large (250 and above). The fee is the same through every certification body.
Most UK businesses pay between £1,500 and £3,000 + VAT, because each certification body prices its own audit. Intelance’s published price is £1,150 + VAT, fixed, delivered in one to three weeks.
The certificate fee is fixed, so variation comes from what is wrapped around it: reseller margins, bundled platforms, per-user charges and consultancy days. A good quote shows the official fee on its own line and prices every service separately.
Internal time to answer the questionnaire and gather evidence, remediation of common gaps such as unsupported software and missing multi-factor authentication, retest costs after a failure, and the annual renewal fee.
Yes. Certification lasts twelve months and the official fee applies at each renewal. Renewal effort is usually much lower than the first year because the estate was brought up to standard the first time.
Yes: self-assess if your IT is capable, fix the common failures before submitting, certify the whole organisation rather than paying for an unsatisfying subset, buy from a certification body directly, and book Cyber Essentials Plus together with the basic assessment so both land inside the required window.
Eligible UK organisations that certify the whole business and have under £20 million turnover receive cyber liability insurance with £25,000 of cover included with certification at no extra cost.
For most SMEs, yes: it is required by many UK government contracts and increasingly requested in supplier onboarding, it includes the insurance benefit, and the five control areas it tests are the basic hygiene that stops the most common attacks.
Written by Emmanuel Olatunji, Chief Enterprise Architecture Partner at Intelance, an IASME licensed certification body for Cyber Essentials and Cyber Essentials Plus. Last reviewed 8 July 2026.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with a licensed assessor. You leave knowing which route applies to you, what it costs and what to do first.
Talk to a senior adviser
