Cyber Essentials guide
How much does Cyber Essentials cost in 2026?
The assessment fee for Cyber Essentials is fixed: IASME, the NCSC's delivery partner, sets it by the number of people you employ. Since 3 November 2026 most small firms getting their first certificate pay a quarter of it. Cyber Essentials Plus has no fixed price, and the fee may not be the largest cost: the fixes, the staff time and a failed submission can cost more. This guide sets out each cost, what the new funding covers, and three worked budgets.
Last checked 10 November 2026 against IASME's Cyber Essentials page and GOV.UK's Cyber Essentials funding package of 3 November 2026. Details from IASME's FAQ and insurance page and the NCSC's Plus test specification are as we checked them for our other guides on 9 November 2026. All prices are before VAT unless we say otherwise. This is general information. Tagnator is not part of, approved by or endorsed by the NCSC or IASME.
1. The short answer
| Cost | How much | Who sets it |
|---|---|---|
| Cyber Essentials assessment | £320 to £600 plus VAT, by number of employees | IASME, the same price everywhere |
| First certificate for an SME, until 31 March 2027 | £80 to £125 plus VAT (75% off), while funding lasts | The government's First Step Fund |
| Help with the questions | 30 minutes free; more is charged by the hour or as a package | Each Cyber Advisor or certification body |
| Cyber Essentials Plus audit | A quote, on top of the basic fee; one certification body lists it from £1,495 plus VAT for up to nine users | Each certification body |
| Fixes and staff time | Anything from nothing to the price of new laptops | What your devices and cloud services need |
| Renewal | The full fee again every 12 months | IASME |
2. The assessment fee by size
IASME publishes one price per size band. You pay it when you buy the assessment, from IASME's site or through a certification body, and it covers marking and, if you pass, the certificate. The First Step Fund column applies only to a first certificate (see the next section); large organisations are not eligible.
| Employees | Fee | With the First Step Fund |
|---|---|---|
| 0 to 9 (micro) | £320 + VAT | £80 + VAT |
| 10 to 49 (small) | £440 + VAT | £110 + VAT |
| 50 to 249 (medium) | £500 + VAT | £125 + VAT |
| 250 or more (large) | £600 + VAT | Not eligible |
With VAT at 20%, a micro firm pays £384 in full or £96 with the discount, and a small firm £528 or £132. VAT-registered firms reclaim the VAT in the usual way.
The fee buys one attempt with a short second chance. IASME's FAQ gives you 6 months from buying to submit, after which "your account may be closed and you would have to apply and pay again". If the assessor finds problems you have 2 working days to correct them, and "if you still fail after these two days you will have to reapply and pay the assessment fee again". Paying twice is the avoidable cost to plan around.
3. The November 2026 funding package
On 3 November 2026 the government published a Cyber Essentials funding package with two offers. Both are delivered through IASME.
The Cyber Essentials First Step Fund takes 75% off the fee "for SMEs seeking a new Cyber Essentials certificate". IASME's conditions: you are a UK-based micro or SME organisation, you have "not held Cyber Essentials in the last four years", and you "register and purchase your assessment by 31 March 2027", all "subject to eligibility and available funding". GOV.UK says the scheme runs "until the end of March 2027 (or until funding runs out)", so a firm that qualifies should not wait for the deadline. You claim it through IASME's site, and GOV.UK confirms that "the discount is still applicable if organisations choose to certify through a Certification Body".
The Cyber Resilience Pledge: Cyber Essentials for Suppliers Grant pays the whole fee and adds "tailored support from an NCSC-assured Cyber Advisor". You cannot apply for it yourself: organisations that have signed the government's Cyber Resilience Pledge choose suppliers and notify them. It runs until the end of March 2029. If a large customer has asked you to certify, ask whether it has signed the pledge and will nominate you.
What the funding does not cover:
- A pass. GOV.UK: "Funding covers the cost of assessment and, where the assessment is passed, certification. It does not guarantee certification." If you fail and have to pay again, the second fee is your own unless you qualify again.
- Renewals. The four-year rule means most renewing firms pay the full fee. Our renewal guide explains why letting a certificate lapse to qualify again costs more than it saves.
- Cyber Essentials Plus. Both offers are described as a discount on "the cost of a Cyber Essentials certificate". Neither GOV.UK nor IASME says they reduce a Plus audit.
- Fixes and help. The First Step Fund pays toward the fee only. Only the pledge grant includes a Cyber Advisor.
4. Self-led or supported
IASME offers two routes. Self-led: you answer the questions yourself using the free material, and the fee is the whole price. Supported: you "pay for support from a Cyber Advisor or Certification Body". Cyber Advisors work for NCSC Assured Service Providers and can help you make the changes; assessors work for certification bodies, mark the assessment and can explain the questions.
Supported prices are set by each provider. As one example, Forensic Control, a licensed certification body, lists Cyber Essentials from £495 plus VAT a year with the £320 IASME fee included, so about £175 for its support for a micro firm (prices it gives as correct in September 2026). Other providers price support differently, so compare what each includes. Before paying for support, take the two free steps: IASME's free Readiness Tool and its 30 minutes free with a Cyber Advisor.
Support is worth paying for if nobody in the firm can find the update, MFA and admin settings in your devices and cloud services. It is poor value if you only need the questions read to you: the question set is free to preview, and our guide to the question set explains each section.
5. What Cyber Essentials Plus costs
IASME publishes no price for Plus. It says Plus is "a technical audit of your IT systems, priced according to the size and complexity of your network", and sends you to a certification body for a quote. Neither IASME nor the NCSC publishes a day rate for the audit either. The certification body below lists a yearly package price by number of users rather than a day rate.
You also need a current Cyber Essentials certificate with the same scope, so the basic fee is always paid as well. IASME's FAQ says that if you achieved Cyber Essentials "less than 3 months before certifying to Cyber Essentials Plus you will not need to repeat the self‑assessment questions stage", so book the audit within three months of the basic certificate.
For a sense of scale, one certification body's published list (Forensic Control, correct as of September 2026, all per year and before VAT):
| Users | Plus | Basic and Plus together |
|---|---|---|
| 1 to 9 | £1,495 + VAT | £1,895 + VAT |
| 10 to 49 | £1,995 + VAT | £2,495 + VAT |
| 50 or more | Quote | Quote |
That is one firm's list, which includes a year of vulnerability scanning; other certification bodies charge more or less and include different things. Get two or three quotes.
What moves a Plus quote follows from what the assessor has to test. The audit covers "a representative set of user devices, all internet gateways, and all servers with services accessible to the internet". Under the NCSC's test specification (v3.2) the assessor scans every internet-facing IP address, runs an authenticated vulnerability scan on a sample of devices, tests malware protection, logs in to every cloud service you declared with a normal user and an administrator to check MFA, and checks that everyday accounts lack admin rights. The sample size is calculated by IASME's method from the devices in scope. So expect a quote to depend on the number of people and devices, the number of different device types and operating systems, the number of cloud services and the number of sites. Ask each certification body:
- Is the IASME certification fee included, and is the basic Cyber Essentials assessment included or extra?
- How many devices will you sample, and how did you calculate it?
- Is testing remote or on site, and is travel charged?
- If a test fails, is a retest after we fix it included, and within what time?
The audit fails on "any single Fail" unless the specification allows an exception, and a missed critical update older than 14 days is a fail. A failed audit means paying for more assessor time, so fix before the audit, not after.
6. The costs that are not on the price list
- Replacing unsupported devices and software. Every operating system and application in scope must still be supported by its maker. A laptop that cannot run a supported version of its operating system, or an old server, has to be upgraded, replaced or taken out of scope. This can cost more than the assessment itself.
- MFA and device management. Every cloud service that offers MFA must have it on for every user and administrator. That is usually a setting, but phones and tablets used for work are devices in scope too, and some firms choose a mobile device management tool to control them.
- Staff and IT provider time. Listing every device and cloud service, changing settings, writing answers and getting a director to read and sign them. If an IT provider does the changes, that is billable time.
- A second fee. Missing the 2-working-day correction window or the 6-month submission window means paying again, at the full price if your discount was used.
- Plus out of step. A Plus audit more than three months after the basic certificate means repeating the self-assessment stage.
- Every year. Certificates expire after 12 months and renewal is a full assessment at the full fee. Budget for it as a yearly cost, not a one-off.
7. What you get back
Insurance. A UK-domiciled organisation with a turnover under £20m that certifies its whole organisation is entitled to cyber liability insurance arranged by IASME at no extra cost, with a £25,000 limit and a 24-hour incident helpline. IASME itself says the limit "might be sufficient for a small breach or incident but inadequate for a serious problem", so it does not replace a proper policy, but it does come with the fee.
Contracts. Central government and NHS bodies must ask for Cyber Essentials or Cyber Essentials Plus on contracts that handle personal data or OFFICIAL information (Procurement Policy Note 014), and every Ministry of Defence supplier needs Cyber Essentials (Def Stan 05-138, control 0001). For a firm bidding for that work, the fee is the cost of being allowed to bid. Our guide to Cyber Essentials or Plus sets out who asks for which.
8. Three worked budgets
These use IASME's fees and the one published Plus list above. They leave out fixes, which depend on what you already have.
| Firm | Year one | Each year after |
|---|---|---|
| 4 people, everything in Microsoft 365 or Google Workspace, first certificate, self-led | £80 + VAT (£96) with the First Step Fund | £320 + VAT (£384) |
| 25 people, certified last year, self-led renewal | £440 + VAT (£528); no discount, because it held a certificate in the last four years | £440 + VAT (£528) |
| 30 people, first certificate, a contract needs Plus | £110 + VAT basic with the discount, plus £1,995 + VAT for Plus at the list above: £2,105 + VAT in all | £440 + VAT basic plus £1,995 + VAT for Plus: £2,435 + VAT in all |
The third firm shows why Plus is the cost to plan for: the discount saves £330 once, while the audit is paid every year. If a customer asks for Plus, check the contract's technical requirements first; many ask for "Cyber Essentials or equivalent", which the basic certificate meets.
9. How to keep the cost down
- Check the First Step Fund before you buy. If you have not held Cyber Essentials in the last four years, buy by 31 March 2027, earlier if funding may run out. If a large customer is pushing you to certify, ask whether it will nominate you for the pledge grant.
- Use the free help first. The Readiness Tool and the question preview cost nothing, and IASME gives 30 minutes with a Cyber Advisor free.
- Fix, then buy. The 6-month window and the 2-day correction window start when you pay. Get updates, MFA and admin accounts right before you submit.
- Certify the whole organisation if you can. It is simpler to describe, and it is the only scope that qualifies for the insurance.
- For Plus, book the audit with the basic assessment so it falls within three months, and get quotes that answer the four questions in section 5.
- Keep your records so that next year's renewal is a review, not a rebuild.
Most of the cost of Cyber Essentials is preparation: knowing what you have and showing that the five controls are in place. Our Cyber Essentials Preparation Kit (£39 plus VAT) gives you the asset register, a walkthrough of every question number with the evidence to keep, and the short policies and approval forms behind the processes the questions ask about. It does not include the questions themselves, which are free from IASME, and it does not replace a certification body.
Related guides: Cyber Essentials for small UK businesses · Cyber Essentials or Cyber Essentials Plus? · Renewing Cyber Essentials
10. Sources
- Cyber Essentials, IASME: the fees by size, the 75% discount and its conditions, the self-led and supported routes, the free 30 minutes with a Cyber Advisor, and Plus "priced according to the size and complexity of your network".
- Cyber Essentials funding package, GOV.UK, 3 November 2026: the First Step Fund, the Cyber Resilience Pledge grant, what the funding covers and when each scheme ends.
- Frequently Asked Questions, IASME: the 6 months to submit, the 2-working-day correction window and paying again, the 12-month expiry and the 3-month rule for Plus.
- Cyber Liability Insurance, IASME: eligibility and the £25,000 limit.
- Cyber Essentials Plus Test Specification v3.2, NCSC, April 2025: the five test cases, sampling and the success rule.
- PPN 014: Cyber essentials scheme, GOV.UK, updated February 2025: which public contracts require the certificate.
- How much does Cyber Essentials Plus cost?, Forensic Control: one certification body's published prices for Cyber Essentials and Plus, correct as of September 2026.