Cyber Essentials is the UK government-backed scheme that shows your business is protected against the most common cyber attacks. If a customer, a tender or your insurer has asked for it, the first question is usually: what will it cost? Here’s a straight answer for 2026.
The short answer
- The certification fee is set by IASME, the organisation that runs the scheme, and depends on the size of your organisation. Published prices for 2026 are £320 + VAT for organisations with 1 to 9 staff and £440 + VAT for 10 to 49, with larger organisations paying more.
- Getting ready is where costs vary: checking your systems and fixing anything that would fail.
- Cyber Essentials Plus, which adds a hands-on technical audit, costs more. Published prices for small organisations start at around £1,500 + VAT.
- It renews every year, and the fee applies again each time.
Fees change from time to time, so check the current figures with IASME or your certification body before you budget.
What the certification fee covers
Basic Cyber Essentials is a self-assessment. You answer a set of questions about your devices, accounts, network and cloud services, a director signs it off, and an IASME-licensed certification body marks it. If you pass, you get a certificate valid for 12 months.
The fee pays for that assessment. It doesn’t pay for anyone to check your systems beforehand or fix what isn’t compliant, and that’s where many businesses come unstuck.
The costs people forget
Most of the cost of Cyber Essentials isn’t the fee. It’s getting your IT to the standard. The things that most often need money or time spent on them:
- Multi-factor authentication on every cloud service. Since April 2026 this is a hard requirement wherever a service offers it, even if switching it on means paying for an add-on. That often catches accounting, CRM and file-sharing apps, not just Microsoft 365.
- Unsupported software and devices. Anything that no longer gets security updates, such as an old version of Windows or an ageing router, has to be upgraded, replaced or taken out of scope.
- Security updates. Critical and high-risk updates must be installed within 14 days of release, on every device in scope, including laptops at home.
- Admin accounts. Staff shouldn’t use administrator accounts for everyday work, which can mean reorganising who has access to what.
- Your time. Answering the questions accurately takes a few hours if you know your systems well, and much longer if you don’t.
What does Cyber Essentials Plus cost?
Cyber Essentials Plus includes everything in the basic certificate, plus an assessor testing your systems: scanning for vulnerabilities, checking a sample of devices and testing your email and web protection. Because it involves an assessor’s time, it costs considerably more. Published prices for small organisations start from around £1,500 + VAT and rise with the number of devices and locations.
Plus is worth it if a contract demands it, or if you want independent proof that your controls work. Most small businesses start with the basic certificate.
What about renewal?
Certificates last 12 months, and renewal isn’t discounted: you pay the fee again and answer the current question set. The requirements are updated regularly, most recently in April 2026, so something that passed last year might not pass this year.
If your IT is managed well all year round, renewal is quick. If it’s done in a rush once a year, each renewal tends to turn into a project.
How to keep the cost down
- Check before you submit. A failed assessment wastes time and can delay a contract. Find the gaps first.
- Fix things properly. Multi-factor authentication, supported software and managed updates protect you every day, not just on assessment day.
- Keep it up all year. If the controls stay in place, renewal becomes paperwork.
What we charge
Our Cyber Essentials service starts from £295 + VAT. That covers checking your systems, fixing anything that would fail and helping you complete the assessment. It doesn’t include the IASME assessment fee, which is charged separately at the rates above. We’ll confirm the total before we start, and every business we’ve prepared for Cyber Essentials has passed.
For businesses whose IT we already manage, most of the work is done: we keep every system we look after to the Cyber Essentials standard, certified or not. Find out how our Cyber Essentials service works, or book a call.