How much does Cyber Essentials cost in 2026?

The assessment fee, by organisation size

The fee for Cyber Essentials (the basic, self-assessed level) is set by IASME, the body that runs the scheme for the NCSC, and it depends only on how many people work in your organisation. You pay it to the IASME-licensed certification body you choose, when you buy the assessment. If you’re starting from scratch, read what Cyber Essentials is first. The widely published 2026 figures are:

Confirm the current table on iasme.co.uk before you budget — the fee is reviewed from time to time — and note that it is the same whichever certification body you use, because they are all selling the same IASME assessment. Where certification bodies differ is in what else they bundle: some include a call to go through your answers, some sell consultancy on top, some simply take the fee and review what you send.

Cyber Essentials Plus costs more, and is quoted individually

Plus is the same five controls, but verified: an assessor tests a sample of your actual devices rather than taking your word for it. You need the basic certificate first, and the Plus audit is priced by the certification body according to how many devices and locations are involved. Our rough market estimate — not an IASME figure — is that it starts from around £1,350 and rises from there, on top of the basic fee. If a contract only says “Cyber Essentials”, it means the basic level and you do not need to budget for Plus. The comparison guide explains how to tell.

Your time is the real cost

For a business of five to fifty people, the fee is usually the smallest of the three costs. The time goes into four things: working out and writing down what is in scope (every laptop, phone, router and cloud service that touches work data); switching on multi-factor authentication for every user of every cloud service and checking it is actually on; confirming every device runs a supported operating system with automatic updates; and writing a handful of short policies. A tidy business with modern laptops and Microsoft 365 or Google Workspace can do this in a few hours spread over a week or two. A business with shared logins, a couple of old machines and no written processes takes longer — not because the questionnaire is hard, but because the fixes are real work.

The calculator at the top of this page separates the fee from the time and shows what each route to getting ready costs. The time figures are our own estimates and will vary.

What usually costs nothing

The technical controls Cyber Essentials asks for — the requirements, control by control — are mostly settings in software you already pay for. Multi-factor authentication is included with Microsoft 365, Google Workspace, Xero, QuickBooks and almost every other cloud service. Automatic updates and a software firewall are built into Windows and macOS. Anti-malware is built into Windows (Defender counts), and on phones and tablets the official app store, plus a short list of apps you approve, does the job. A password manager is optional and many are free for small teams.

What can cost real money

• Unsupported devices. A laptop that cannot run a supported operating system fails the assessment on its own. It has to be upgraded, replaced, or genuinely removed from scope. This is the one cost that can run to hundreds of pounds per device. See the unsupported software guide.
• A proper firewall if your router cannot be configured sensibly, or if you run something exposed to the internet. Most small offices do not need this.
• Consultancy. Our estimate of typical day rates for walking a business through the questions and fixes is around £600, and a first-time certification can take from half a day to four days depending on where you start — roughly £300 to £2,400 in all. Worth it if you have no time at all; not necessary for most businesses.
• Submitting before you’re ready. The surest way to waste time — and, depending on your certification body’s resubmission terms, possibly money — is to submit answers you have not checked. Find the automatic fails — MFA, the 14-day update rule, unsupported software — before you pay.

The three routes, honestly compared

Do it yourself from the official documents costs nothing but time. The NCSC requirements and the IASME question set are free, accurate, and written for assessors — which is the difficulty. Software such as ReadyCert translates the questions, tells you what would fail, and drafts the policies, for a fixed annual price (£149, or £95 for our first 50 customers) that is less than half the assessment fee. A consultant does the translation and the fixes with you, at a day rate, and is the right choice when nobody in the business has a few hours to give it. None of the three changes the fee, and none of them can guarantee the outcome; only the certification body decides.

What you'll actually pay, all in

Putting the pieces together for a typical micro business (0–9 people) starting from scratch, with nothing needing replacement:

Larger organisations move up the fee table above, and a device that cannot run a supported operating system adds its replacement cost to any route. The consultant day figures and time estimates are our own; the fee is IASME's. Nothing here is paid to ReadyCert except the software price itself.