Cyber Essentials Cost: UK Fees and Budget Guide

Cyber Essentials cost is one of the first questions we hear from directors who have just seen the words "Cyber Essentials required" in a tender or an insurance renewal. The short answer is that the certificate itself is the smaller part of the bill. What you spend on getting your devices, accounts and settings into a passable state is usually the bigger number.

This guide explains how much Cyber Essentials costs in practice, what drives the price up or down, and how to budget for the whole job rather than just the assessment fee. It also covers the insurance that comes with certification, so you can judge whether "free Cyber Essentials" claims stand up. Every figure quoted comes from IASME (the NCSC's delivery partner for the scheme) or the NCSC, and where a number is not published we say so rather than guess.

What does Cyber Essentials cost cover?

When people ask how much Cyber Essentials costs, they usually mean one of four different things. Separating them stops quotes being compared unfairly.

• The assessment fee: the published price for the self-assessment that leads to the basic Cyber Essentials certificate.
• Preparation and remediation: the time and spend needed to bring devices, firewalls, accounts and updates up to the standard before you submit.
• Cyber Essentials Plus: the separate technical audit, which is quoted individually.
• Support: consultancy or managed IT help, if you do not want to do the work in-house.

Only the first item has a fixed public price. The rest depend on how tidy your environment is today. For the full process from start to finish, see our Cyber Essentials certification guide.

Cyber Essentials price: assessment fees by organisation size

The assessment fee for basic Cyber Essentials is tiered by headcount. At the time of writing, IASME publishes the following prices, all excluding VAT.

The NCSC describes pricing in the same way, with basic certification starting at £320 plus VAT. Check the current IASME price list before you commit to a budget, as published fees can change.

What the fee includes

The fee covers the marking of your verified self-assessment, which a board member or equivalent must sign off. IASME's FAQs also say that if you fail, you have two working days to correct simple problems and resubmit without paying again. After that, you reapply and pay the fee again, so it is worth getting the answers right first time.

Why a Certification Body may charge more

You can certify through IASME directly or use a licensed Certification Body that helps you interpret the questions. A Certification Body sets its own pricing, so a quote may differ from the headline fee. Ask what is included and whether the quote covers the full assessment fee.

The hidden part of Cyber Essentials fees: remediation

Remediation is where most small businesses find the real Cyber Essentials fees. The assessment tests five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. If your estate already meets them, remediation costs little. If not, it adds up quickly.

Typical cost drivers include:

• Unsupported software: operating systems and applications that no longer receive security updates must be replaced or removed from scope. Our guide to the Windows 10 end of life and ESU explains why this affects many firms right now.
• Multi-factor authentication: enabling it on cloud services is often free or covered by existing Microsoft 365 licences, but licensing gaps can add cost.
• Admin and access clean-up: removing shared accounts and unnecessary admin rights takes staff time.
• Firewall and router settings: default passwords and open ports need fixing, and older kit may need replacing.
• Patching and device management: without a way to push updates, someone must do it by hand.

Firms already on a managed service tend to spend less here. If you use Microsoft 365, many of the access and security settings can be configured within what you already pay for.

Cyber Essentials Plus cost

There is no fixed public price for Cyber Essentials Plus. IASME states that the audit is priced according to the size and complexity of your network, and that you request quotes from licensed Certification Bodies. Audits can be carried out remotely or on site.

Plus uses the same five controls as the basic scheme, but an independent assessor tests that they work in practice rather than relying on your answers. The NCSC overview of Cyber Essentials describes it as giving higher assurance.

What moves the quote:

• The number of devices and the variety of operating systems.
• The number of sites, and whether testing is remote or on site.
• How many cloud services and user groups are in scope.
• How much remediation the assessor finds, since failed tests mean retesting.

Plus is normally a second step after basic certification. Our guide to the Cyber Essentials Plus audit walks through what the assessor checks, and our comparison of the difference between Cyber Essentials and Cyber Essentials Plus helps you decide whether you need it at all.

Get at least two quotes and ask each provider to state exactly what is included, including any retest.

It also helps to confirm timing. Plus audits are normally booked after your basic certificate is in place, so a tender deadline that requires Plus means you need to plan the audit date, and any fixes it triggers, well ahead of submission. Leaving it late tends to increase both the price and the pressure.

Consultancy and managed support: what to expect

Some businesses complete the self-assessment alone. Others pay for help, and this is the most variable line in any Cyber Essentials budget because providers price differently. Some charge a project fee, some a day rate, and some fold it into a monthly support agreement.

Three common routes

• Do it yourself: lowest outlay, but it needs someone who understands the requirements and has time to gather evidence.
• Certification Body support: a licensed body helps you interpret the questions and assesses your submission.
• Managed IT partner: a provider that already looks after your devices and accounts fixes gaps as part of normal work. See our Cyber Essentials service for how NetMonkeys helps businesses prepare and support their certification.

If you do not have an in-house team, outsourced IT support can carry most of the technical preparation. A wider cyber security audit is worth considering if you want a view of risks beyond the five controls.

Free Cyber Essentials and cyber insurance

The phrase "free Cyber Essentials" needs care. The certification itself is not free: you still pay the assessment fee above. What is included is cyber liability insurance, arranged through IASME.

According to IASME's cyber liability insurance page, the cover is available when:

• The organisation is UK-domiciled (including Crown Dependencies).
• Annual turnover is under £20m.
• The whole organisation is certified, not just part of it.
• You opt in. IASME states the certification cost is the same whether or not you do.

What the included cover looks like

The base policy has a total limit of £25,000, which IASME itself says may not be enough for a serious or multiple incident. It includes incident response support, and the policy covers areas such as event management costs and extortion threats. It does not cover money stolen electronically through cyber fraud. There is also an excess, and a retention before network interruption cover applies.

Higher limits are available for an extra premium through the administering broker or your own broker. The policy runs for 12 months from certification and cannot be renewed alone, so you must renew the certificate or buy a standalone policy. You also cannot claim on two policies, so check whether an existing policy already meets your needs.

The detail matters more than the headline. Read the policy wording, and see how certification affects premiums in our guide to Cyber Essentials for tenders and insurance.

How to budget for Cyber Essentials

A realistic budget has four lines, and you can fill most of them in before you pay anything.

Cost lines at a glance

Do not forget renewal. Certificates expire after 12 months and you re-enter your information each year, so the cost of Cyber Essentials certification for a small business is a recurring one.

Ways to keep the cost down

Cost control comes from preparation, not from cutting corners on the assessment.

• Remove what you do not need. Old devices, unused accounts and forgotten cloud services all add scope.
• Replace unsupported systems on your own timetable. Rushed replacement is always dearer.
• Use the licences you already own. Many access controls are available in existing Microsoft plans.
• Answer carefully. A failed submission beyond the two-day correction window means paying the fee again.
• Standardise devices. Fewer configurations make both the self-assessment and a Plus audit simpler.
• Time it with other needs. If a tender or renewal date is fixed, work backwards so you are not paying for urgency.

Smaller firms with a handful of laptops often find the process straightforward. Our guide to IT support for small businesses covers how a lean setup can stay compliant without much overhead.

Conclusion: Cyber Essentials cost in context

Cyber Essentials cost starts with a published assessment fee, £320 to £600 plus VAT depending on size according to IASME, but the total depends on your remediation, any Plus audit and the support you choose. Cyber Essentials Plus is quoted individually, and the insurance that comes with certification is useful but limited at the base level.

Budget for the whole job, check the current IASME price list, and ask every provider exactly what their quote includes. If you want help preparing, get in touch with our team.

Frequently asked questions