Cyber Essentials Cost in 2026: The Full Price for UK Firms
The Cyber Essentials certificate costs £320 to £600 plus VAT a year, set only by how many staff you have. The full Cyber Essentials cost is usually higher, because many firms must fix gaps before they pass and then renew every year. Cyber Essentials Plus adds an audit, which published prices put at roughly £1,000 to £2,700 plus VAT for firms under 50 staff.
On this page
Prices below exclude VAT unless we say otherwise.
The Cyber Essentials certificate fee in 2026
IASME, which delivers the scheme for the National Cyber Security Centre (NCSC), sets one fee by employee numbers.
| Organisation size | IASME fee | Including VAT at 20% |
|---|---|---|
| 0 to 9 employees | £320 | £384 |
| 10 to 49 employees | £440 | £528 |
| 50 to 249 employees | £500 | £600 |
| 250 or more employees | £600 | £720 |
Fees are from IASME's Cyber Essentials page, and the VAT column is our sum.
What the fee buys
- Access to the online assessment platform, with up to six months to complete it.
- Marking by a qualified assessor from a certification body, within three working days.
- The chance to update and resubmit if the assessor needs more information.
- A certificate and a digital badge, valid for 12 months.
- Free cyber insurance, if you qualify.
What it does not buy
The fee pays for marking, not fixing. It includes no help changing settings, no new software and no replacement laptops.
A board member or equivalent must also sign off your answers as accurate. Since the April 2026 update, that declaration also accepts your duty to stay compliant for the whole year.
Cyber Essentials Plus cost
Cyber Essentials Plus checks the same five controls, but adds a technical audit by an assessor. You must pass Cyber Essentials first. IASME says the audit must be completed within three months of your most recent Cyber Essentials certification.
There is no fixed price. IASME says it depends on the size and complexity of your network, which sets what the assessor must test:
- an external vulnerability scan of each public IP address in scope
- a representative sample of devices, including each operating system you use
- checks on servers, desktops, laptops, tablets and phones
- checks that staff use MFA on every cloud service in scope
The audit can be remote or on site. These are the published Plus prices we found in October 2026, from four providers' price lists:
| Organisation size | Lowest published price | Highest standard package |
|---|---|---|
| 1 to 9 staff | £966 | £2,338 |
| 10 to 49 staff | £1,575 | £2,717 |
| 50 to 249 staff | £1,973 | £3,095 |
These prices sit on top of the Cyber Essentials fee. The most expensive packages we saw started at £6,500.
The pass bar is higher than for Cyber Essentials. A high or critical vulnerability must be fixed and rescanned before you can pass. If you fail the update test, the retest covers a new sample of devices too. A second failure revokes your Cyber Essentials certificate.
Our guide to who needs Cyber Essentials Plus explains when it is worth paying for.
The hidden costs
Fixing the gaps
Much of the real cost is closing the gaps the questions expose. Four matter most, because two of them now fail you automatically.
- MFA on every cloud service. For applications started from 27 April 2026, a cloud service without MFA, where MFA is available, is an automatic fail. That applies whether the MFA is free, included or a paid extra.
- Security updates within 14 days. High-risk and critical updates must be installed within 14 days of release. Missing that is now an automatic fail too.
- Unsupported software. Everything in scope must be licensed and supported, or removed. Office 2016 and 2019 lost support in October 2025, and Office 2021 followed in October 2026.
- Admin rights. Administrators need separate accounts, used only for admin tasks. Nobody should read email or browse the web with admin rights.
In Microsoft 365, security defaults turn on MFA at no extra cost. Text message codes still count under the scheme. But Microsoft's own SMS and voice codes retire for most users on 1 February 2027. Our guide to the SMS and voice MFA change explains the options.
Our Cyber Essentials requirements guide covers all five controls, and the Microsoft 365 security checklist shows where each setting lives.
Devices that can no longer get updates
Old PCs are a cost many budgets miss. For most editions, Windows 10 support ended on 14 October 2025. IASME says a Windows 10 PC used after that date must be enrolled in Microsoft's Extended Security Updates (ESU) to stay compliant.
Microsoft prices ESU for organisations at $61 per device for year one, doubling each year. ESU is cumulative, so joining in year two, which runs to 12 October 2027, means paying for year one too.
That is $183 per PC, about £137 at the European Central Bank rate on 22 October 2026. Both figures are our sums, and UK reseller prices will differ.
ESU ends on 10 October 2028 at the latest, and Microsoft calls it a temporary bridge. A PC that cannot meet Windows 11's requirements, such as TPM 2.0, needs replacing by then.
Windows 11 Home and Pro PCs on version 24H2 stopped getting updates on 13 October 2026, so they must move to a newer version.
A device can also sit outside the scope on a separate network that blocks all internet traffic. That can suit workshop PCs that run machinery. You must justify that exclusion to the assessor, and check with IASME whether it affects the free insurance.
Staff time
Someone has to read the questions, check every device and write the answers. Phones and home laptops used for work are in scope, which adds to the checking. The examples below estimate the hours.
Renewal every year
A certificate lasts 12 months, so the fee, and any Plus audit, comes round every year. Renewal is quicker when the controls stay in place between assessments.
Free cyber insurance and other returns
The free insurance
According to the NCSC, any UK-based organisation with turnover under £20m that certifies its whole organisation gets free cyber liability insurance arranged by IASME. It offers a 24-hour helpline to report an incident, with crisis management and incident response up to a total limit of £25,000.
There are two catches. A partial scope does not qualify, and £25,000 is a total limit. Treat it as a starting point, not a replacement for a full policy, and read the terms with IASME before you rely on it.
Contracts
Under PPN 014, central government departments and NHS bodies ask for Cyber Essentials on higher-risk contracts. Suppliers must hold it, or show equivalent controls, before the contract is awarded. They must then renew it every year for the life of the contract.
Defence work goes further. Defence Cyber Certification Levels 0 and 1 need Cyber Essentials, and Levels 2 and 3 need Plus. Our guide to Defence Cyber Certification explains the levels.
In the year to June 2026, nearly a quarter of Cyber Essentials certificates were sought for a commercial or government contract. The most common reason, at about four in ten, was to give customers confidence. Those shares are our sums from DSIT's management information.
Insurer questions
The NCSC's insurance guidance says buying a policy might require information about your security controls. It adds that some insurers offer discounts for recognised defences, such as those certified by Cyber Essentials. A current certificate means an assessor has already checked your answers on the basic controls. In the same government data, about 2% of certificates were sought because an insurer required one.
Doing it yourself or paying for help
IASME offers two routes. Self-led means you use the free resources and pay only the fee. Supported means you pay a Cyber Advisor or a certification body to help.
| Self-led | Paid help | |
|---|---|---|
| What you pay | The IASME fee only | The fee, plus the adviser's or provider's charges |
| Who it suits | Under 10 staff, all in the cloud, modern devices | Older kit, servers, Plus or a contract deadline |
| Your time | More hours, much of it learning | Fewer hours, mostly answering questions |
| Main risk | Missing an automatic fail, such as one app without MFA | Paying for work you could have done |
Our honest view: if you are small and cloud-only, and someone is comfortable changing settings, do it yourself. Some NCSC-assured Cyber Advisors also offer eligible small firms a free 30-minute consultation.
Pay for help when the fixes, not the form, are the hard part. Old PCs, a server, home workers and a Plus audit are where experience counts.
The full Cyber Essentials cost: three worked examples
These examples are illustrative, not quotes. Each starts from the IASME fee and adds the work we would expect for that setup. We cost IT work at £95 an hour, which is our own rate for clients on one of our support plans. Without a plan our rate is £125 an hour, and other providers charge more or less. Staff time is shown in hours, because its value differs for every firm. All figures exclude VAT.
A four-person design studio works entirely in Microsoft 365 on modern laptops. MFA is off, the owner uses an admin account every day, and one old design app no longer gets updates.
A 15-person accountancy practice has MFA on in Microsoft 365, but not in its cloud practice software. Staff are local administrators on their PCs. Two PCs run Windows 11 24H2 Pro, and two older PCs cannot run Windows 11.
A 40-person engineering firm has a customer that now asks for Plus. It has a file server, home workers and six workshop PCs whose machine software only runs on Windows 10.
| Design studio, 4 staff | Accountancy practice, 15 staff | Engineering firm, 40 staff | |
|---|---|---|---|
| IASME fee | £320 | £440 | £440 |
| IT work to close gaps (estimate) | 4 hours, £380 | 10 hours, £950 | 24 hours, £2,280 |
| Old devices | None | ESU for 2 PCs, about £274 | 6 PCs moved to a network with no internet, inside the IT hours |
| Plus audit | Not needed | Not needed | £1,575 to £2,717 |
| Staff time (estimate) | 6 to 8 hours | 10 to 14 hours | 20 to 30 hours |
| First year (estimate) | £700 | £1,664 | £4,295 to £5,437 |
| Each renewal (estimate) | £415 | £630, plus ESU year three or new PCs | £2,395 to £3,537 |
How we built the estimates
- Design studio: MFA and staff registration, 1.5 hours. A separate admin account, 0.5 hours. Updates, firewall and malware checks, 1.5 hours. Removing the old app, 0.5 hours, with any replacement app extra.
- Accountancy practice: MFA on the practice software, 1.5 hours. Removing local admin rights, 3 hours. Moving two PCs to a newer Windows 11 version, 3 hours. Firewall and malware checks, 2 hours. ESU setup, 0.5 hours.
- Engineering firm: MFA on cloud services and remote access, 2 hours. Admin rights, 4 hours. A 14-day update routine for PCs, server and router, 6 hours. Separating the workshop PCs, 6 hours. Phones and home laptops, 2 hours. A pre-audit check, 4 hours. New network equipment would be extra.
- Renewals: the fee, one to four hours of checks, and the Plus audit again where needed.
For the engineering firm, ESU on all six workshop PCs would cost about £821 this year, and year three costs more. Separating them is the cheaper long-term fix, if the machines never need the internet.
If the studio owner did it all alone, the cash cost would be the £320 fee. The trade is more of their own time, which we estimate at 10 to 15 hours.
How to keep the cost down
- Prepare before you pay. Your six months start when you buy, so preview the free questions and use the Readiness Tool first.
- Use what you already have. Security defaults give Microsoft 365 users MFA at no extra cost, and moving staff to passkeys costs nothing extra.
- Turn on automatic updates everywhere. The rules require them where possible, and they make the 14-day deadline far easier to meet.
- Decide about old PCs early. ESU is cumulative, so joining late still means paying for the years you missed.
- Certify the whole organisation. A partial scope must be justified to the assessor, and it loses you the free insurance.
- Book Plus promptly. The audit must fall within three months of your Cyber Essentials certificate, or you will need a newer certificate first.
- Keep the controls running all year. Renewal then becomes a check, not a project.
- Use your support plan. On our Managed or Secure plan, our Cyber Essentials package costs less, from £795 a year.
How cloud365.io can help
We prepare you for Cyber Essentials and support your submission. The certification body decides whether you pass.
Our package starts at £995 a year plus VAT for 1 to 9 people. It includes the certification fee, a review of your answers, device protection, automatic app patching, policy templates and your yearly renewal. Fixes are £95 an hour on a support plan and £125 otherwise, or a fixed price once we have checked your setup.
On our Managed or Secure plan, the package starts at £795, because the plan already patches and protects your computers. Prices for every size, and for Plus, are in our Cyber Essentials packages.
Common questions
How much does Cyber Essentials cost in 2026?
The IASME fee depends on staff numbers. It is £320 plus VAT for 0 to 9 employees and £440 for 10 to 49. It is £500 for 50 to 249 and £600 for 250 or more. Many firms also spend money and staff time fixing gaps first, such as turning on MFA or replacing unsupported software.
How much does Cyber Essentials Plus cost?
Providers set their own Plus prices, based on the size and complexity of your network. Published prices we found in October 2026 ran from £966 to £2,717 plus VAT for firms with 1 to 49 staff. That is on top of the Cyber Essentials fee, and premium packages cost more.
Do you have to pay for Cyber Essentials every year?
Yes. A certificate is valid for 12 months, so you pay the fee again to renew, and Plus is renewed every year too. Under PPN 014, suppliers on central government and NHS contracts that require it must renew every year for the life of the contract.
Does Cyber Essentials come with free insurance?
Yes, if you qualify. Any UK-based organisation with turnover under £20m that certifies its whole organisation gets cyber liability insurance arranged by IASME. It includes a 24-hour helpline and incident response up to a total limit of £25,000.
Can we do Cyber Essentials ourselves without paying for help?
Yes. The self-led route uses free resources, such as the question set and IASME's Readiness Tool, and you pay only the fee. It suits small firms with modern devices and someone comfortable changing settings. Some NCSC-assured Cyber Advisors offer eligible small firms a free 30-minute consultation.
