Cyber Essentials and Cyber Essentials Plus cost in the UK (2026)
This guide sets out what Cyber Essentials and Cyber Essentials Plus cost in the UK in 2026, from IASME's published fees and the prices Certification Bodies publish for Plus. Naq is a UK compliance platform for companies selling into regulated buyers, and teams use it to prepare the controls and evidence behind their Cyber Essentials answers.
Cyber Essentials costs £320 to £600 + VAT, a fee set by IASME according to how many people you employ. Cyber Essentials Plus has no national fee. Each Certification Body quotes for its own audit. The lowest Plus prices published by four of them run from £1,250 to £1,735 + VAT, and they cover different things: Intertek NTA's £1,320 includes the Cyber Essentials assessment, while IT Governance's £1,735 is for organisations already certified. Both certificates expire after 12 months, so the Cyber Essentials certification cost comes round every year.
All prices on this page exclude VAT unless stated, and were checked on 9 November 2026.
Cyber Essentials and Plus costs at a glance
| Cyber Essentials | Cyber Essentials Plus | |
|---|---|---|
| Who sets the price | IASME, the NCSC's delivery partner for the scheme | Each Certification Body |
| Price | £320 to £600, by number of employees | Quoted individually. Lowest published prices from four providers: £1,250 to £1,735, covering different things |
| What is assessed | Your answers to the question set, marked by an assessor | The same controls, tested by an assessor on a sample of your devices |
| If you fail | Two working days to fix simple issues at no extra charge, then the fee is paid again | IASME sets a 30-day fix window for a failed first sample. Retest charges are set by each Certification Body |
| Renewal | Every 12 months | Every 12 months, with the audit inside three months of your Cyber Essentials certificate |
How much does Cyber Essentials cost in 2026?
IASME publishes one fee for each of four organisation sizes, using the UK government's definition of size by number of employees.
| Organisation size | Employees | IASME fee (ex VAT) | With VAT at 20% |
|---|---|---|---|
| Micro | 0 to 9 | £320 | £384 |
| Small | 10 to 49 | £440 | £528 |
| Medium | 50 to 249 | £500 | £600 |
| Large | 250 or more | £600 | £720 |
The fee buys the assessment. Once you pay, IASME sends login details for its online assessment portal, and you have six months to complete the assessment before the account is deleted. An assessor from an IASME-licensed Certification Body marks your answers.
Two things change what the fee is worth. A UK-domiciled organisation with turnover under £20m that certifies its whole organisation and opts in is entitled to cyber liability insurance with a £25,000 limit and a 24-hour incident helpline, according to IASME. IASME also offers 75% off to UK-based micro and SME organisations that have not held Cyber Essentials in the last four years, "subject to eligibility and available funding", for assessments registered and bought by 31 March 2027.
Assessments bought now use IASME's Danzell question set, Version 16.3 (May 2026), against the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3 (April 2026). They are separate documents, and our explainer on the 2026 changes covers what Danzell now fails automatically.
How much does Cyber Essentials Plus cost?
IASME says a Cyber Essentials Plus assessment "has to be quoted for individually", because the price depends on the size and complexity of your network. Its quote form passes your details to up to three Certification Bodies. The audit covers a representative set of user devices, all internet gateways and every server with services reachable from the internet.
Four Certification Bodies that publish a Plus price are compared below. Three list what their price covers, and the lists differ. URM gives an indicative figure without one.
| Certification Body | Published Plus price (ex VAT) | What the provider says it covers | Date of price |
|---|---|---|---|
| URM Consulting | From £1,250 | A small, non-complex organisation. Every Plus assessment is quoted | Undated page, read 9 Nov 2026 |
| Intertek NTA | £1,320 without support, £1,920 with support | Example packages including the Cyber Essentials assessment at the £320 micro fee, an external scan of fewer than 4 hosts and an onsite review of fewer than 3 devices in South East England | G-Cloud 15 pricing document, 29 Jan 2026 |
| Forensic Control | £1,495 for 1 to 9 users, £1,995 for 10 to 49 | 12 months of vulnerability scanning, and the provider says all its prices include the applicable IASME fee. Both certificates together: £1,895 and £2,495 | "Prices correct as of September 2026" |
| IT Governance (GRC Solutions) | £1,735 | An upgrade for organisations certified to Cyber Essentials in the last three months: up to ten sample devices at one location, an external scan of up to 20 IP addresses and one free retest (conditions apply). Sold as an annual subscription with automatic renewal | Read 9 Nov 2026 |
Larger organisations are harder to compare. Forensic Control quotes individually from 50 users, URM quotes every assessment, and Intertek NTA says tailored pricing may be needed for complex scenarios or large organisations. IT Governance offers its package to organisations of all sizes, and charges extra past ten sample devices. The Cyber Essentials Plus explainer sets out how the two levels differ and which buyers ask for Plus.
Why do some Certification Bodies charge more than IASME for Cyber Essentials?
Some Certification Bodies charge more when their price includes help as well as the assessment. The scheme has two routes. On the self-led route you buy the assessment from IASME, prepare with its free resources and pay only the fee in the table above. On the supported route you pay a Cyber Advisor or a Certification Body for help. A Certification Body's package can include the IASME fee, as Forensic Control's does.
Published examples show the gap. Forensic Control charges £495 for 1 to 9 users, including the £320 IASME fee. IT Governance starts at £420. Intertek NTA lists optional pre-assessment support at £600 on top of the assessment. The certificate at the end is the same scheme certificate, so the difference pays for whatever the provider adds.
What drives the total cost of Cyber Essentials certification?
The assessment fee is one line of the cost. Five things drive the total.
Organisation size
Size sets the IASME fee directly. For Plus it sets how many devices the assessor samples, which IASME puts at typically around 10 per cent, picked at random. IT Governance's package covers ten sample devices and charges for more, and Intertek NTA prices its external scan by host count, from £200 for fewer than 4 hosts to £1,000 for fewer than 20. Where the audit is onsite, location counts as well: Intertek NTA's onsite test runs from £800 in South East England to £995 in the West Country, Wales, Northern England and Scotland, expenses included.
Scope
Your scope decides what has to meet the controls, and URM says the cost of Plus varies with the size of the scope and the number of devices sampled. Cloud services cannot be excluded from scope, and the Plus scope has to match the Cyber Essentials scope.
Remediation
No assessment fee covers the fixes. An in-scope operating system without vendor support stops certification, and Windows 10 devices past 14 October 2025 have to be in Microsoft's Extended Security Update programme. Multi-factor authentication counts as available even where it is a paid option, so a licence upgrade can become a cost of passing. For Plus, a high or critical vulnerability has to be fixed and rescanned before a pass. Under IASME's current process, a failed first sample gives 30 days to fix the issue across the whole scope, and a second sample is tested inside those 30 days. If the same vulnerabilities appear again, Plus fails and the Cyber Essentials certificate is revoked. Smaller estates follow adjusted rules.
Staff time
Staff time appears on no invoice. A board-level representative, business owner or equivalent has to approve the answers. The person named as responsible for IT has to be a member of your organisation, and cannot be employed by your outsourced IT provider. The Plus audit has to fall within three months of your Cyber Essentials certificate, so the preparation for both runs to one timetable. Our guide to how long Cyber Essentials takes sets out realistic timings.
Retests
Failing adds cost too. IASME gives two working days to fix simple issues and resubmit without charge, and after that you reapply and pay the fee again. Certification Bodies set their own retest terms for Plus: IT Governance includes one free retest, conditions apply, and Intertek NTA lets a failed element be repurchased within two weeks.
How often do you pay for Cyber Essentials?
Every year. Cyber Essentials and Cyber Essentials Plus certificates both expire after 12 months, and renewal means a new assessment at the fee in force at the time. Plus renewal means a new audit as well. Our article on what a lapsed certificate costs covers the renewal date and what happens to contracts when it passes.
Where does Cyber Essentials software fit in the cost?
Cyber Essentials software sits in the preparation, before the assessment fee is paid. Naq is GRC software where you choose the frameworks you are measured against, from Cyber Essentials and ISO 27001 to DSPT and GDPR, and hold one set of controls across them. A control mapped for Cyber Essentials counts in every other framework it meets.
In Naq, evidence sits in one Evidence Library attached to the controls it supports, and a control drops back to needs review when its evidence expires. Policies start from templates with your organisation's details filled in, and come back on their review date. Approvals, reviews and expiries collect in one to-do list, so the work for the next renewal is in view all year. Every suggestion from Naq AI is confirmed by a named member of your team. See how multi-framework management works.
The certification route stays as the scheme sets it. You hold your own IASME account when you buy direct, and you enter your answers on IASME's online assessment platform whichever way you buy. A Certification Body licensed by IASME marks your answers and issues the certificate. Naq is licensed by IASME as one, and using the Naq platform does not award a certificate. For Plus, you choose a Certification Body licensed to run the audit.
Frequently asked questions
Is Cyber Essentials free?
No. IASME charges £320 to £600 + VAT for the assessment, depending on the number of employees. The question set is free to download and IASME's Readiness Tool is free to use, and eligible UK-based micro and SME organisations that have not held Cyber Essentials in the last four years may get 75% off assessments bought by 31 March 2027.
Does the Cyber Essentials price include VAT?
No. IASME's fees are quoted plus VAT, so the micro fee of £320 is £384 with VAT at 20% and the large-organisation fee of £600 is £720. The four Certification Bodies compared in this guide quote Plus prices ex VAT too.
How much does it cost to renew Cyber Essentials?
Renewal costs IASME's full fee for your size, because each renewal is a new assessment. The 75% discount applies only to organisations that have not held Cyber Essentials in the last four years. Certificates expire after 12 months. Plus renewal needs a new audit, priced by your Certification Body.
Do I have to pay again if I fail Cyber Essentials?
Not straight away. IASME gives you two working days to fix simple issues and resubmit without an extra charge. If the assessment still fails after that, you reapply and pay the fee again.
Can I get Cyber Essentials Plus without Cyber Essentials?
No. Plus tests the same controls as Cyber Essentials, and the audit has to take place within three months of your most recent Cyber Essentials certificate, on the same scope. The guide to passing Cyber Essentials Plus covers what the assessor tests.
Sources
Checked 9 November 2026.
- IASME, Cyber Essentials (fee table and 75% discount), https://iasme.co.uk/cyber-essentials/
- IASME, Cyber Essentials frequently asked questions, https://iasme.co.uk/cyber-essentials/frequently-asked-questions/
- IASME, Cyber Liability Insurance, https://iasme.co.uk/cyber-essentials/cyber-liability-insurance/
- IASME, Cyber Essentials Danzell Question Set, Version 16.3, May 2026, https://iasme.co.uk/cyber-essentials/questions/danzell/pdf
- NCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3, April 2026, https://www.ncsc.gov.uk/sites/default/files/2026-11/Cyber-Essentials-Requirements-for-IT-Infrastructure-v3-3.pdf
- IASME, Important update: changes to Cyber Essentials for April 2026, 12 February 2026, https://iasme.co.uk/articles/important-update-changes-to-cyber-essentials-for-april-2026/
- IASME Knowledge Hub, How to certify to Cyber Essentials Plus, https://ce-knowledge-hub.iasme.co.uk/space/CEKH/4412801084
- IASME Knowledge Hub, Scope FAQ, https://ce-knowledge-hub.iasme.co.uk/space/CEKH/2646707066
- IASME Knowledge Hub, Danzell update: new CE+ internal vulnerability and remediation process, https://ce-knowledge-hub.iasme.co.uk/space/CEKH/4245947085
- URM Consulting, https://www.urmconsulting.com/faq/how-much-does-a-cyber-essentials-plus-assessment-cost
- Intertek NTA, G-Cloud 15 pricing document, 29 January 2026, https://assets.applytosupply.digitalmarketplace.service.gov.uk/g-cloud-15/documents/93266/925629646042789-pricing-document-2026-01-29-1703.pdf
- Forensic Control, https://forensiccontrol.com/guides/how-much-does-cyber-essentials-plus-cost/
- IT Governance (GRC Solutions), https://uk.grcsolutions.io/product/cyber-essentials-plus-certification-upgrade and https://grcsolutions.io/cyber-essentials/
