How Much Does Cyber Essentials Cost?

The IASME assessment fee

The base fee is set by IASME (the NCSC's delivery partner) and banded by your total employee count, not just the people in scope:

• Micro (0–9 employees): £320 + VAT
• Small (10–49): £440 + VAT
• Medium (50–249): £500 + VAT
• Large (250+): £600 + VAT

That fee covers access to the assessment portal, an assessor's review of your submission, and the certificate and badge if you pass. Eligible UK organisations (turnover under £20m) also get IASME's cyber-liability insurance included at no extra cost.

The cost that isn't the fee

For most organisations the assessment fee is the small part. The real spend is remediation — putting the controls right before you submit (MFA everywhere, patching within the required window, tidy access control). A realistic first-year total for a typical small business, including prep, remediation and internal time, is often £1,500–£3,500. If your controls are already in decent shape, you'll spend far less.

What about Cyber Essentials Plus?

Cyber Essentials Plus is priced separately by each certification body, based on how many devices are in scope — commonly £1,500–£8,000 + VAT, on top of the base Cyber Essentials fee. The range is wide because it's a hands-on technical audit; the more devices, the more testing.

How we price it

We quote a clear, fixed price up front — the IASME fee plus our guided support — with no surprise add-ons. If remediation is needed, we tell you what and roughly how much before you commit, so there are no shocks.

Common questions