Cyber Essentials cost calculator
Four questions, one honest estimate: the assessment fee for your size of business, the time the preparation takes, and what each route to getting ready costs — doing it yourself, using software, or paying a consultant.
Work out your cost
Your estimate
| Route to ready | Typical cost | What you get |
|---|---|---|
| Do it yourself | £0 + your time | The official question set and the NCSC requirements document. Free, accurate, written for assessors. |
| ReadyCert | £149/year (£95 for the first 50 customers) | Plain-English check, a list of what would fail today, click-by-click fixes and your policies drafted. Preparation only — certification is still bought from your certification body. |
| Consultant | £600–£1,200 | Someone walks you through the questions and fixes. Our estimate at a £600 day rate; many also resell the assessment. |
The assessment fee is set by IASME and paid to your IASME-licensed certification body, not to ReadyCert. Fee table checked against iasme.co.uk on 2026-10-18. Time and consultant figures are ReadyCert's estimates and will vary. They follow your starting point (and, for time, the devices and cloud tools you enter) rather than the size band, so for a Medium or Large organisation treat them as a floor. No tool can guarantee a pass.
What you are actually paying for
There are three separate costs in Cyber Essentials, and people often add them up wrong. The first is the assessment fee: a fixed price set by IASME according to the size of your organisation, paid to the IASME-licensed certification body that reviews your answers and issues the certificate. It is the only unavoidable cost. The second is your time — working out what is in scope, switching on MFA everywhere, checking every device is updated and supported, and writing the handful of short policies the scheme expects. The third is any help you buy, which ranges from nothing at all to several days of a consultant's time.
The calculator above separates the three so you can see which one is worth spending on. For most micro and small businesses the fee is the smallest of them; the time is the real cost, and it is the cost that help is supposed to reduce. The full cost guide puts the published 2026 numbers against each of the three.
What usually costs nothing
The technical controls Cyber Essentials asks for are mostly settings in software you already pay for. Multi-factor authentication is included with Microsoft 365, Google Workspace, Xero and almost every other cloud service. Automatic updates and a built-in firewall come with Windows and macOS. Anti-malware is built into Windows and, for phones and tablets, the official app store plus a list of approved apps does the job. The expensive scenario is old hardware: a laptop that cannot run a supported operating system has to be upgraded, replaced, or removed from scope, and no amount of configuration gets round that.
When Plus changes the picture
Cyber Essentials Plus is the same five controls, verified by an assessor who actually tests your devices. You need the basic certificate first, and Plus is quoted individually because the work depends on how many devices there are. If a contract asks for Plus, budget for both fees and for the audit taking real time out of your week; if it just says “Cyber Essentials”, Basic is what is being asked for. The plain-English guide explains the two levels.
Frequently asked questions
How much does Cyber Essentials cost in 2026?
The assessment fee is set by IASME and depends on the size of your organisation: £320 + VAT for micro businesses (0–9 people), £440 + VAT for small (10–49), £500 + VAT for medium (50–249) and £600 + VAT for large (250+). Confirm the current table on iasme.co.uk. On top of that comes your time, and any help you pay for.
Who do I pay the Cyber Essentials fee to?
To an IASME-licensed certification body, when you buy the assessment. ReadyCert does not sell certification and never handles the fee.
How much does Cyber Essentials Plus cost?
Plus is quoted individually by the certification body because it involves a hands-on audit of your devices. As a rough market estimate (not an IASME figure), expect it to start from around £1,350 and rise with the number of devices, on top of the basic assessment fee.
Do I need to pay a consultant to get Cyber Essentials?
No. The self-assessment is designed to be completed by the business itself. A consultant can translate the questions and fix gaps for you, typically at a day rate; software like ReadyCert does the translation and the fix guides for a fixed annual price; or you can work straight from the official documents for free.
Are the time estimates here accurate?
They are ReadyCert's own estimates for a business of 5–50 people, based on how long it takes to inventory devices, switch on MFA for each cloud service and write the short policies the scheme expects. Your own time will vary with how tidy your setup already is.