How much does Cyber Essentials cost?

Last reviewed 2 November 2026 against the Cyber Essentials requirements v3.3 (Danzell question set).

1. The IASME assessment fee (2026 price list)

Every organisation applying for basic Cyber Essentials pays IASME’s published assessment fee, based on the total number of employees in the scope of your certification (including full-time and part-time staff). Some certification bodies charge slightly less or bundle the fee with other services:

What that fee covers: Access to the online assessment portal, marking of your self-assessment by an IASME-licensed Certification Body, your official certificate and badge for 12 months, listing on the public register, and — for UK-domiciled organisations certifying their whole organisation with an annual turnover under £20m that opt in — £25,000 of complimentary cyber liability insurance. Remember: certificates last 12 months, and the assessment fee applies again each year at renewal.

2. How Cyber Essentials Plus pricing works

Unlike the basic self-assessment, Cyber Essentials Plus (CE+) has no single fixed national price because an independent assessor must run hands-on vulnerability scans and test a sample of your laptops, servers and phones within 90 days (3 months) of your basic certificate (IASME FAQ). Certification bodies price the Plus audit based on:

• Your total number of end-user devices and servers in scope.
• How many different operating system builds you run (for example, Windows 11, macOS, iOS and Android each add to the sample).
• Whether testing is carried out remotely or on site.

Because the Certification Body’s audit fee depends on your size and device mix, we quote a fixed price for Cyber Essentials Plus once we know your systems.

3. The hidden costs people forget to budget for

The assessment fee is often the smallest part of the real cost. Before your director can honestly sign the declaration, you may need to spend time or money on:

• Your team’s time: Auditing every device, router and cloud app and answering the question set takes 8 to 20+ hours if you do it yourself from scratch.
• Licence upgrades: Moving from Microsoft 365 Business Standard (£10.80/user/month + VAT) to Business Premium (£16.90/user/month + VAT) if you need Intune, Conditional Access and Defender for Business to manage laptops and personal phones centrally.
• Paid MFA tiers on third-party cloud apps: Under the April 2026 Danzell rules, if a cloud app charges extra for Multi-Factor Authentication (MFA), you must pay for it, put it behind Single Sign-On, or replace the app.
• Replacing unsupported hardware or software: Upgrading or replacing Windows 10 PCs that cannot run Windows 11 (or buying Microsoft Extended Security Updates at US$61+ per device), replacing Office 2016, 2019 or 2021, or swapping an end-of-life office router.

4. Our preparation pricing

If you want our team to check your systems, fix the gaps in Microsoft 365 and guide you through the assessment — with our record that none of the clients we’ve prepared has ever failed — we offer two clear options:

• One-off Guided Cyber Essentials preparation: Starts from £295 + VAT (plus the IASME assessment fee above). Covers checking your devices, accounts and cloud services against v3.3, fixing anything that would fail, and helping you complete the assessment. We confirm your exact itemised total before we start.
• Monthly Cyber Posture plan: £395 + VAT/month (on an annual plan), which includes 4 hours/month of security management, continuous monitoring, a quarterly report and annual Guided Cyber Essentials readiness.

We are not a certification body: your assessment is marked and your certificate is issued by an IASME-licensed Certification Body.