What Cyber Essentials Plus costs, and what drives the quote
Unlike the basic level, Plus has no fixed national price: it is a hands-on audit, priced by the certification body doing the work. Our rough market estimate — not an IASME figure — is that quotes start from around £1,350 on top of the basic fee. Here is what moves the number and how to budget without surprises.
Why there is no price list
The basic assessment is a review of written answers, so IASME can set one fee per organisation size. Plus is different in kind: an assessor tests a sample of your actual devices against the Plus test specification, and the effort scales with what you have. More devices and more device types mean a bigger sample; more locations mean more arranging; servers and unusual setups mean more work. So each certification body quotes your situation. Our rough estimate of the floor is around £1,350 for a simple small business, rising from there — and treat any quote as covering their defined scope of work, which is worth reading.
The full budget, honestly
- The basic assessment first. Plus requires the basic certificate, at the IASME-set fee for your size — see the cost guide for the tiers. Some bodies bundle both; check what a quote includes before comparing two of them.
- The Plus audit itself — the quoted figure.
- Your team’s time on the day(s). The audit needs devices available and people present; it is real time out of the diary.
- The timing rules. There are rules about how soon after the basic certificate the Plus assessment must be completed — ask your certification body when you book, because they shape when you should buy each part.
- Retesting, if something fails. Ask up front what a failed test costs to re-run. This is where “cheapest quote” can stop being cheapest.
Keeping the number down without cutting corners
Since every body assesses to the same standard, comparing quotes is legitimate — the certificate is identical. Beyond that, the honest levers are readiness and simplicity: walk in with the basic level genuinely clean (the audit verifies what your answers claim, so gaps become retests), keep the estate current and uniform (ten identical laptops sample more cheaply than ten oddities), and don’t carry devices you don’t need into scope. What doesn’t work is treating Plus as a paperwork upgrade — it is testing, and it finds things.
Check you actually need it
Plus is typically demanded for higher-risk work; the majority of small businesses asked for “Cyber Essentials” are being asked for the basic level. Read the contract wording literally, and if it is ambiguous, ask — the Basic vs Plus guide shows how to tell. A five-minute email has saved many businesses a four-figure audit they didn’t need.
Frequently asked questions
How much does Cyber Essentials Plus cost in 2026?
There is no fixed national price: certification bodies quote it individually because Plus is a hands-on audit whose work scales with your devices and locations. As a rough market estimate (not an IASME figure), quotes start from around £1,350 on top of the basic assessment fee, and get two or three quotes — the assessment standard is identical everywhere.
Is the basic Cyber Essentials fee included in a Plus quote?
Usually not — you need the basic certificate first, at the IASME-set fee for your organisation size, and Plus is priced on top. Some bodies bundle the two; check what a quote includes before comparing.
What makes a Plus quote higher?
More devices and device types to sample, more locations, servers, and anything unusual to test. A ten-laptop, one-office, no-server business sits at the affordable end.
Can I reduce the cost of Plus?
Honestly, yes: be genuinely ready (a failed test means retesting), keep the estate simple and current, and get the basic level clean first — the Plus audit verifies what the basic answers claim. Choosing by lowest quote alone is fine on price grounds since the standard is fixed, but check what retesting costs if something fails.