Cyber Essentials Plus certification
Cyber Essentials Plus is Cyber Essentials with a technical audit by an independent assessor, who tests your devices and accounts. Our package costs £2,495 a year for 1 to 9 people, excluding VAT, and includes Cyber Essentials, the Plus audit and our pre-audit check. The audit must be completed within 3 months of your Cyber Essentials certificate.
from £2,495a year for 1 to 9 people, excluding VAT. Cyber Essentials included.
About three minutes. We reply within 2 business hours, Monday to Friday.
- Every price is on this page, excluding VAT, for 1 to 99 people
- Certification fee through an IASME-licensed certification body. The assessor decides the result.
- Nothing starts until you agree a written quote. We reply within 2 business hours.
What it costs
One yearly price by team size. It includes the Cyber Essentials certificate, the Plus audit and our check of your setup before the assessor looks.
Most providers quote Plus by the size and complexity of your network, and the NCSC lists it as a quoted price. Ours is fixed by headcount.
| Package | 1 to 9 people | 10 to 19 people | 20 to 49 people | 50 to 99 people |
|---|---|---|---|---|
| Cyber Essentials Plusa year, Cyber Essentials included | £2,495 | £2,995 | £3,895 | £5,095 |
| Plus audit onlya year, if you already hold Cyber Essentials | £1,495 | £1,79510 to 49 people | £2,195 | |
| Plus on our Managed or Secure plana year, while you are on the plan | £2,195 | £2,595 | £3,295 | £4,295 |
Per organisation, per year, excluding VAT. Invoiced yearly in advance. More than 99 people: quoted.
Fixes are separate. Fixing what the review finds is £95 an hour on a support plan, £125 otherwise, or a fixed price once we've checked your setup. Many fixes, such as MFA and updates, are already part of our Managed and Secure support plans.
About three minutes. We reply within 2 business hours, Monday to Friday.
What's included
Everything the Plus package covers, and the Cyber Essentials package it builds on. You don't need to be on our support plan: device protection and app patching are in the price.
- Everything in Cyber Essentials
- The Cyber Essentials Plus audit: a remote technical test by an assessor
- Our pre-audit check, and we coordinate the assessor
- GDPR toolkit and policy templates
Cyber Essentials, which Plus builds on, includes:
- The Cyber Essentials certification fee, through an IASME-licensed certification body
- We review your answers and support your submission
- Device protection agent for up to 5 devices per person
- Automatic app patching for Windows and Mac
- Ready-made security policy templates
- Free cyber insurance with the certificate, if you qualify
- We handle your renewal each year
The free cyber insurance is arranged by IASME for UK organisations with turnover under £20m that certify the whole organisation and opt in. It covers incident response up to £25,000.
Certification is decided by the assessor. We prepare you and support the submission.
What the Plus audit tests
An assessor follows the NCSC Cyber Essentials Plus test specification, which has five tests. They run on a sample of your devices and user accounts. In our package the audit is remote.
- A remote vulnerability checkThe assessor scans what your business exposes to the internet and looks for known weaknesses.
- An authenticated scan of your devicesSigned in to the sample devices, they check that operating systems and apps are patched and still supported.
- Malware protectionThey confirm each sampled device blocks malicious files and websites.
- Multi-factor authenticationThey check MFA is turned on for your cloud services, including Microsoft 365.
- Separate admin and user accountsThey check day-to-day work is done in standard accounts, not admin accounts.
The controls behind these tests are explained in our Cyber Essentials requirements guide.
Old laptops are the usual reason firms fail. IASME says any company using unsupported software in scope will fail to achieve certification. Our cost guide covers devices that can no longer get updates.
How it works
Seven steps from the form to your certificate, then a yearly renewal.
Answer the form. About three minutes: your team size, your devices and whether you hold Cyber Essentials now.
Written quote. We confirm the price for your headcount. Nothing starts until you agree it.
Our check of your setup, and fixes. We review your devices and accounts against the five controls and list anything the assessor would fail.
Cyber Essentials submission. You answer the question set, we review every answer, and we support the submission through the certification body.
Assessor booked at least 3 weeks ahead. We coordinate the audit date with you and the assessor.
Audit completed within 3 months of the certificate. The assessor tests a sample of devices and accounts. Certification is their decision.
Renewal each year. Both certificates expire after 12 months. We handle the renewal and book the next audit.
The Plus audit has to be completed within 3 months of your Cyber Essentials certificate being issued. Book it at least 3 weeks ahead.
IASME's knowledge hub states the rule: the audit must be completed within three months of your most recent Cyber Essentials certification.
Who asks for Plus
Central government departments, their agencies and NHS bodies can ask for Cyber Essentials or Plus on higher-risk contracts, under PPN 014.
Ministry of Defence contracts at DCC Levels 2 and 3 need Cyber Essentials Plus, according to IASME's DCC applicant guide. See our DCC certification page.
For sector detail, read who needs Cyber Essentials Plus.
Not sure you'll pass?
Our pre-audit check comes first in every Plus package, so problems can be fixed before the assessor sees them. Certification is still decided by the assessor.
If you want a verdict before you commit, book a Cyber Essentials Plus readiness check on its own. It costs £1,250 for up to 25 devices, excluding VAT, and lists what passes, what fails and what to fix first.
Fixes are £95 an hour on a support plan, £125 otherwise, or a fixed price once we've checked your setup.
Already on our support plan?
Your plan already protects and patches your computers, so you don't pay for extra tools. You pay for the certificate and our help, and we fill in the answers from the setup we already manage.
For Managed and Secure clients, Plus costs £2,195 a year for 1 to 9 people and £2,595 for 10 to 19. It is £3,295 for 20 to 49 and £4,295 for 50 to 99, excluding VAT, while you are on the plan.
Not a client yet? Managed and Secure include device patching, Huntress EDR and Microsoft Defender, which cover the patching and malware protection the audit tests. See the IT support plans.
Common questions
How much does Cyber Essentials Plus cost?
Our Cyber Essentials Plus package is £2,495 a year for 1 to 9 people and £2,995 for 10 to 19. It is £3,895 for 20 to 49 and £5,095 for 50 to 99. Prices exclude VAT and include Cyber Essentials, the Plus audit and our pre-audit check. If you already hold Cyber Essentials, the Plus audit alone starts at £1,495.
How long does Cyber Essentials Plus take?
The Plus audit must be completed within three months of your most recent Cyber Essentials certificate, so plan both together. Book the assessor at least 3 weeks ahead. Any fixes our pre-audit check finds come first.
Do I need Cyber Essentials before Cyber Essentials Plus?
Yes. Plus begins with the Cyber Essentials verified self-assessment, then adds the technical audit. Our Plus package includes both.
What does the Cyber Essentials Plus audit test?
An assessor follows the NCSC test specification, which has five tests. They are a remote vulnerability assessment, an authenticated scan to check patching, and malware protection checks. The last two check multi-factor authentication and that admin and user accounts are separate. Tests run on a sample of your devices and users.
Is Cyber Essentials Plus mandatory?
It is required when a customer, tender or contract asks for it. Central government and NHS bodies ask for Cyber Essentials or Plus on certain higher-risk contracts under PPN 014. Ministry of Defence contracts at DCC Levels 2 and 3 need Plus.
How long does a Cyber Essentials Plus certificate last?
Cyber Essentials Plus is renewed every year, and certificates expire after 12 months. Our package is priced per year and covers the yearly renewal.
Guides that go deeper
Plain-English guides on the rules, the costs and the settings behind this service.
Cyber Essentials or Cyber Essentials Plus: Who Needs Which?
Cyber Essentials or Cyber Essentials Plus? See what UK government, MoD, NHS, education, legal and construction rules ask for, with sources and worked examples.
Read the guide
Cyber Essentials Requirements 2026: Plain-English Checklist
Cyber Essentials requirements in plain English: scope, the five controls, the 14-day patch, password and MFA rules, a checklist and Microsoft 365 settings.
Read the guide
Cyber Essentials Cost in 2026: The Full Price for UK Firms
The real Cyber Essentials cost in 2026: the £320 to £600 fee plus fixes, old PCs, Plus and renewals. Worked examples for firms of 4 to 40 staff.
Read the guideReady for Cyber Essentials Plus?
Tell us your team size and whether you hold Cyber Essentials now. We reply with a written quote at the price on this page, and nothing starts until you agree it.
About three minutes. We reply within 2 business hours, Monday to Friday. Or email support@cloud365.io.