Independent cost guide
How much does Cyber Essentials cost?
The Cyber Essentials self-assessment is priced by organisation size: £320–£600 +VAT under IASME's published tiers (verify the current price list before budgeting). Cyber Essentials Plus adds an independent technical audit, typically £1,400–£2,500 +VAT for a small organisation in 2026 quotes. Tell us which level you need and your size, and certification bodies who can both prepare and certify you will quote directly.
How it works
- Tell us which level, your organisation size and your deadline. Two minutes, no account.
- We pass your details to relevant Cyber Essentials certification bodies and consultants, and to no one else.
- They contact you directly with their actual price, including preparation help if you want it. Compare, choose, or walk away.
Cyber Essentials Cost is a free introduction service operated by Ellul Solutions Ltd; we pass your details to relevant Cyber Essentials certification bodies and consultants who quote you directly. We may receive a fee from those providers; you pay nothing and are under no obligation. This is an independent guide, not affiliated with or endorsed by the National Cyber Security Centre (NCSC) or IASME, who own and deliver the Cyber Essentials scheme. Nothing here is security or professional advice; scheme fees are as published by IASME at the time of writing and should be verified against the current price list, and audit prices are typical 2026 quotes.
Cyber Essentials costs, 2026
Last updated
What Cyber Essentials certification costs in 2026. Self-assessment fees are set nationally and published by IASME, tiered by organisation size; Cyber Essentials Plus is quoted by individual certification bodies. Verify the self-assessment tiers against IASME's current price list before budgeting.
Self-assessment fees are the size-banded prices published by IASME, the scheme's delivery partner, at the time of writing; they are set nationally, so shopping around does not change them, and they should be verified against IASME's current price list. Cyber Essentials Plus has no fixed national price: certification bodies quote it from organisation size, device sample and locations, and the range shown reflects typical 2026 quotes for small organisations. This is an independent guide, not affiliated with or endorsed by NCSC or IASME.
| Item | Cost (2026) | Notes |
|---|---|---|
| Cyber Essentials self-assessment, micro (0–9 employees) | £320 +VAT | IASME published tier; verify the current price list |
| Cyber Essentials self-assessment, small (10–49) | £440 +VAT | IASME published tier; verify the current price list |
| Cyber Essentials self-assessment, medium (50–249) | £500 +VAT | IASME published tier; verify the current price list |
| Cyber Essentials self-assessment, large (250+) | £600 +VAT | IASME published tier; verify the current price list |
| Cyber Essentials Plus audit | £1,400–£2,500+ +VAT typical | Quoted by certification bodies; scales with devices, locations and size. The self-assessment fee is payable as well |
| Optional consultant support (gap analysis, remediation) | £500–£2,000 typical | Not required by the scheme; common for first-time applicants and fixed deadlines |
- Cyber Essentials self-assessment is priced by organisation size at £320–£600 +VAT under IASME's published tiers (verify the current price list).
- A Cyber Essentials Plus audit typically costs £1,400–£2,500 +VAT for a small organisation in 2026 quotes, on top of the self-assessment fee.
- Cyber Essentials certification is a stated requirement in many UK central government and Ministry of Defence contracts.
- A Cyber Essentials certificate lasts 12 months; staying certified means reassessing every year.
Cite this page
“Cyber Essentials costs, 2026”, Cyber Essentials Cost, https://cyberessentialscost.co.uk/ (updated 2026-08-14). Self-assessment fees are the size-banded prices published by IASME, the scheme's delivery partner, at the time of writing; they are set nationally, so shopping around does not change them, and they should be verified against IASME's current price list. Cyber Essentials Plus has no fixed national price: certification bodies quote it from organisation size, device sample and locations, and the range shown reflects typical 2026 quotes for small organisations. This is an independent guide, not affiliated with or endorsed by NCSC or IASME.
Go deeper
Sourced, dated, kept current.
Cyber Essentials vs Cyber Essentials Plus: which one, what cost
Cyber Essentials is a self-assessment from £320 +VAT; Plus adds an independent technical audit, typically £1,400–£2,500 +VAT. Same five controls, different proof.
Cyber Essentials requirements: the five controls explained
The five Cyber Essentials controls: firewalls, secure configuration, security update management, user access control and malware protection, in plain terms.
Passing Cyber Essentials first time: common failures checklist
Most Cyber Essentials failures are avoidable: unsupported software, missing MFA on cloud accounts, everyday admin accounts, forgotten BYOD devices. Check first.
Frequently asked
How much does Cyber Essentials cost?
The self-assessment is priced by organisation size: £320 +VAT for micro organisations (0–9 staff) rising to £600 +VAT for large ones under IASME's published tiers (verify the current price list). Cyber Essentials Plus adds an audit, typically £1,400–£2,500 +VAT for a small organisation in 2026 quotes.
How long does a Cyber Essentials certificate last?
Twelve months. Certification is annual: to stay certified you reassess each year, paying the then-current fee. Many contracts require certification to be in date at award and throughout delivery, so diarise renewal ahead of any contract milestones.
Do I need Cyber Essentials for government contracts?
Often, yes. Since 2014, UK central government procurement policy (Procurement Policy Note 09/14) has required Cyber Essentials for contracts involving certain personal and sensitive data handling, and many Ministry of Defence contracts require it under the MoD's supplier cyber requirements. Check the exact certification level your contract specifies.
Does Cyber Essentials include insurance?
UK organisations under £20m turnover that certify their whole organisation have cyber liability insurance included with certification at no extra cost (with a £25,000 indemnity limit under the terms published at the time of writing). Verify the current terms and eligibility with IASME before relying on it.
Is Cyber Essentials mandatory?
There is no general legal requirement to hold it. In practice it is contract-driven: government and MoD procurement, supply-chain security policies and some insurers require it. For everyone else it is a voluntary, low-cost way to evidence baseline security controls.
Can a sole trader get Cyber Essentials?
Yes. Sole traders and micro organisations certify at the lowest published fee tier (£320 +VAT at the time of writing; verify current). The same five controls apply, scoped to the devices and cloud services the business uses, which for a sole trader is often a short list.