How Much Does Cyber Essentials Cost?
The Cyber Essentials assessment fee runs from £320 to £600 + VAT depending on your size — but that's only part of the story. Here's what you'll actually spend, and what's included.
The IASME assessment fee
The base fee is set by IASME (the NCSC's delivery partner) and banded by your total employee count, not just the people in scope:
- Micro (0–9 employees): £320 + VAT
- Small (10–49): £440 + VAT
- Medium (50–249): £500 + VAT
- Large (250+): £600 + VAT
That fee covers access to the assessment portal, an assessor's review of your submission, and the certificate and badge if you pass. Eligible UK organisations (turnover under £20m) also get IASME's cyber-liability insurance included at no extra cost.
The cost that isn't the fee
For most organisations the assessment fee is the small part. The real spend is remediation — putting the controls right before you submit (MFA everywhere, patching within the required window, tidy access control). A realistic first-year total for a typical small business, including prep, remediation and internal time, is often £1,500–£3,500. If your controls are already in decent shape, you'll spend far less.
What about Cyber Essentials Plus?
Cyber Essentials Plus is priced separately by each certification body, based on how many devices are in scope — commonly £1,500–£8,000 + VAT, on top of the base Cyber Essentials fee. The range is wide because it's a hands-on technical audit; the more devices, the more testing.
How we price it
We quote a clear, fixed price up front — the IASME fee plus our guided support — with no surprise add-ons. If remediation is needed, we tell you what and roughly how much before you commit, so there are no shocks.
If you already know the level you need and just want the price and a start date, you can buy Cyber Essentials direct from us as an appointed Certification Body, at a fixed fee with the certificate issued by the people who assessed you.
Ready to buy?
Transparent, fixed pricing based on your organisation size. By default we give you access to the IASME portal to complete your Cyber Essentials assessment yourself, and once you submit it we aim to assess within one business day. You can preview the Cyber Essentials self-assessment questions to see where you stand first. There is no call or consultation as standard; we simply send you the questionnaire to complete. Your submission is reviewed by a qualified, certified assessor, never fed into AI. Need it faster? Add urgent turnaround below. Want us to review your setup against the controls before you apply? That is a gap analysis, quoted separately: ask for one using the contact button under the form.
An appointed IASME Certification Body: your certificate comes directly from us. Verify our credentials on the BlockMark registry, and find us listed on the IASME website.
Common questions
Is the £320 the total cost?
It's the IASME assessment fee for a micro organisation. The total also depends on any remediation needed to pass and your internal time. If your controls are already in order, the fee plus our support is close to the whole cost.
Why does the price go up with company size?
IASME bands the fee by total employee count to reflect the complexity of assessing larger organisations. It's based on your whole headcount, not just the staff in scope.
Is cyber insurance really included?
Yes — eligible UK organisations with turnover under £20m that certify their whole organisation get IASME's cyber-liability insurance included with Cyber Essentials at no extra charge.
How much is Cyber Essentials Plus?
It's priced by device count on top of the base fee, commonly £1,500–£8,000 + VAT. We give you a fixed quote once we know your scope.
Related
Free, no obligation
Understand your exposure
An attacker’s first move is not an attack, it is a look. So we look first, and send you what we find, worst first.
- Services and ports you did not know were open
- Security misconfigurations on anything public facing
- Known vulnerabilities already indexed by engines like Shodan
- Company credentials sitting in known breach data
The only question is: do you know where and how to look?
We reply within one business day. Prefer to talk first? 01902 288763 or info@solusec.co.uk.
Nothing is touched on your systems. It is all public and already indexed, just scattered. We pull it together, which is what an attacker does first.
Get a fixed price for Cyber Essentials
Tell us your size and setup. We'll quote a clear, fixed price up front — and flag any remediation before you commit.