Cyber Essentials costs a UK firm £320 to £600 plus VAT, set by headcount. Cyber Essentials Plus, which adds a hands-on technical audit, has no list price and is quoted for each network. Most small firms start with the basic certificate and add Plus when a client or tender asks for it. Budget for the fee and for any patching or MFA work you need to do before you submit.
How much does Cyber Essentials certification cost in the UK?
The assessment fee depends on how many people work for you. IASME, the NCSC's delivery partner, lists £320 plus VAT for 0 to 9 employees, £440 for 10 to 49, £500 for 50 to 249 and £600 for 250 or more.
What you get for that money is a verified self-assessment. You work through the questions in an online portal, someone senior signs them off, and a qualified assessor marks the result. A certification body that helps you prepare may charge for that support on top of the fee.
Cyber Essentials assessment fee by organisation size
IASME's published fee for the basic Cyber Essentials assessment, excluding VAT, by number of employees.
View the data
| Category | Fee in £ excluding VAT |
|---|---|
| 0 to 9 staff | £320.00 |
| 10 to 49 staff | £440.00 |
| 50 to 249 staff | £500.00 |
| 250+ staff | £600.00 |
How much does a full Cyber Essentials Plus assessment cost?
Plus has no published price list. IASME says each audit is quoted individually, because the cost follows the size and complexity of your network. Licensed certification bodies can run it remotely or in person, and IASME's form returns quotes from three of them.
So the honest answer to "how much?" is to ask for three quotes with the same scope. Give each one the same device count, the same cloud services and the same locations, and the quotes become comparable.
Do you need Plus or is the basic certificate enough?
Start with who is asking. Government has required suppliers bidding for certain public contracts to hold Cyber Essentials or Cyber Essentials Plus since 2014, and Procurement Policy Note 014 asks central government and NHS buyers to require one of them where a supplier handles citizens' personal data or OFFICIAL-level information.
If a tender names Plus, you need Plus. If it says "Cyber Essentials", the basic certificate meets it. Where nobody has asked for Plus, many small firms sensibly certify to the basic level first and add the audit later.
What does the technical audit actually test?
Plus adds independent testing to the same five controls. The NCSC's test specification starts with a remote vulnerability assessment and then checks a representative sample of devices rather than every machine. Cloud services are tested using a representative sample of user accounts.
One result to plan for is that a missing fix older than 14 days is recorded as a fail. Patch cycles are therefore the first place to look before you book an assessor.
What changed in the 2026 requirements?
Assessments started from 27 April 2026 use version 3.3 of the Requirements for IT Infrastructure, the Danzell question set. The bigger change is scope, not new controls. Version 3.3 says cloud services cannot be left out of scope, and multi-factor authentication must be on wherever users sign in to a cloud service.
Fixes for critical or high-risk vulnerabilities have to be applied within 14 days of release. If you run Microsoft 365 or Google Workspace, confirm MFA is on for every user, shared and service accounts included, before you pay the fee.
How do you choose a certification body or advisor?
Ask what is included in the price, not only the headline. Check whether remediation help, a second attempt and Plus testing are in the quote, and whether the Plus audit will be remote or on site.
Look for a body licensed by IASME, and consider an NCSC-assured Cyber Advisor if you want help closing gaps before assessment. A good provider will tell you which of your devices and accounts are in scope and will not promise a pass before looking at your setup.
Which UK MSPs can deliver Cyber Essentials Plus for councils?
Any IASME-licensed Certification Body can deliver Cyber Essentials Plus to a council, and IASME's Find a Certification Body search lists them by location. IASME says many of them are micro or small firms, spread across the UK and Crown Dependencies. For a council contract, ask each one for recent public sector Plus audits and for its audit dates. The NCSC describes two routes: self-led, where you register with IASME, pay and complete the assessment yourself, or supported, where a certification body helps you understand the questions.
A council or other public body buying from suppliers can lean on the same rules. PPN 014 binds central government and the NHS, and other public sector bodies may choose to apply the same approach. If you are renewing, treat it as a fresh assessment against the current requirements, because applications started before 27 April 2026 could still follow version 3.2 but new ones do not.
For a UK SME the short answer to the common questions is this. A full assessment at the basic level costs £320 to £600 plus VAT, a Plus audit is quoted per network, and a recertification is simply a new assessment, so budget the same fee again each year. Which MSPs can help? Any IASME-licensed certification body, so ask three for the same scope. There is no separate regulator to approach, because IASME is the NCSC's delivery partner and runs the scheme.
Which body trains and licenses Cyber Essentials assessors?
IASME does. IASME licenses companies as Certification Bodies once one of their staff has completed its assessor training and passed the assessment. Every assessor must work for a Certification Body based in the UK or the Crown Dependencies, and at least 70% of each body's Cyber Essentials certifications must be for UK organisations. If you want to train as an assessor, IASME is the place to start, not a private course.
Guided platform or self-filing, and how long does it take?
Self-led is the cheaper route when your devices are already patched and MFA is switched on. A supported route suits a firm that is unsure what is in scope. The fee table above still applies, with any support charged on top.
The basic certificate is quick if you prepare. IASME says a firm that has drafted its answers from the free question set can fill in the self-assessment in about an hour. Most assessors aim to return results within 3 days, a failed submission gets 2 working days to fix and resubmit, and the portal account lasts 6 months from payment.
Neither IASME nor the NCSC publishes a standard turnaround for Plus, so ask each certification body for dates in writing. If you need Plus this quarter, book the audit early and sort patching and MFA first, since a fail on either delays everything.
Is there free help, and who trains the advisors?
Some firms can get the work done at no cost. Under the NCSC's Funded Cyber Essentials Programme, eligible organisations get hands-on support from a Cyber Advisor, delivered through IASME's network of NCSC Assured Service Providers. Any software or hardware the advisor says you need is not paid for.
Those advisors are vetted. Every Cyber Advisor delivering the programme must complete training and pass assessments and exams first. Cyber Advisors also offer free 30-minute consultations to help small businesses get started.
What else do you get for the fee?
IASME's insurance terms say a UK-domiciled organisation with a turnover under £20m that certifies its whole organisation to Cyber Essentials is entitled to cyber liability insurance. The total limit of indemnity is £25,000, which IASME itself says may not cover a serious incident, so read the terms before you rely on it.
Certification is annual, so build the renewal into next year's budget. Procurement guidance also says that where a buyer requires Cyber Essentials it must be renewed every year for the length of the contract.
Sources
- IASME, Cyber Essentials frequently asked questions, 2026
- IASME, Cyber Essentials Plus find out more, 2026
- NCSC, Cyber Essentials Requirements for IT Infrastructure v3.3, April 2026
- NCSC, Cyber Essentials Plus Test Specification v3.2
- NCSC, Cyber Essentials overview
- NCSC, Cyber Essentials help and resources
- Cabinet Office, PPN 014 Cyber Essentials scheme, February 2025
- IASME, Cyber Essentials cyber liability insurance, 2026
- IASME, Find a Certification Body
- IASME, Deliver this scheme
- NCSC, Funded Cyber Essentials Programme
- NCSC, Helping small businesses with free, hands-on cyber consultancy
