Cyber Essentials certification for UK businesses
Cyber Essentials is the UK government-backed certificate that shows your business meets five basic cyber security controls. Our package costs £995 a year for 1 to 9 people, excluding VAT. It includes the certification fee, a check of your answers before you submit, device protection, app patching and yearly renewal. Most assessors aim to return results within 3 days.
from £995a year for 1 to 9 people, excluding VAT
About three minutes. We reply within 2 business hours, Monday to Friday.
- Every price is on this page, excluding VAT, for 1 to 99 people
- Certification fee through an IASME-licensed certification body. The assessor decides the result.
- Free cyber insurance with the certificate if you qualify, arranged by IASME
What it costs
One yearly price by team size. It includes the certification fee, our check of your answers, the protection and patching the controls need, and the renewal.
| Package | 1 to 9 people | 10 to 19 people | 20 to 49 people | 50 to 99 people |
|---|---|---|---|---|
| Cyber Essentialsa year | £995 | £1,295 | £2,245 | £3,195 |
| Cyber Essentials on our Managed or Secure plana year, while you are on the plan | £795 | £995 | £1,495 | £1,995 |
Per organisation, per year, excluding VAT. Invoiced yearly in advance. More than 99 people: quoted.
Can you do it yourself for less? Yes. IASME's own fee, if you apply yourself, is £320 to £600 plus VAT depending on size, as published on iasme.co.uk. Our package adds a check of your answers before you submit, the device protection and patching the controls need, and the renewal each year. Our cost guide works through the full do-it-yourself cost, including fixes.
About three minutes. We reply within 2 business hours, Monday to Friday.
What's included
Seven things, from our price list.
- The Cyber Essentials certification fee, through an IASME-licensed certification body
- We review your answers and support your submission
- Device protection agent for up to 5 devices per person
- Automatic app patching for Windows and Mac
- Ready-made security policy templates
- Free cyber insurance with the certificate, if you qualify
- We handle your renewal each year
Certification is decided by the assessor. We prepare you and support the submission.
What Cyber Essentials checks
The scheme is built on five technical controls against the most common internet-based attacks. One line each here; our requirements guide has the full checklist.
- FirewallsYour internet connection and your devices block unwanted traffic.
- Secure configurationDefault passwords changed, unused software removed and auto-run turned off.
- Security update managementSoftware supported and patched, with critical and high-risk fixes applied within 14 days of release.
- User access controlStandard accounts for daily work, admin accounts kept separate, and MFA on cloud services.
- Malware protectionEvery device blocks malicious files, websites and unknown apps.
Since 27 April 2026 (requirements v3.3), MFA on cloud services is mandatory wherever it is available. IASME says a business without it will now automatically fail. Our Microsoft 365 security checklist shows where to turn it on.
How it works
Nine steps from the form to the certificate, then a yearly renewal.
The form. About three minutes: team size, devices and whether this is your first certificate.
Written quote. We confirm the price for your headcount. Nothing starts until you agree it.
We check your setup. Your devices and Microsoft 365 against the five controls, with a list of anything that would fail.
Fixes. Fixing what the review finds is £95 an hour on a support plan, £125 otherwise, or a fixed price once we've checked your setup. Many fixes, such as MFA and updates, are already part of our Managed and Secure support plans.
You answer the question set, we review it. The questions follow the official assessment. We check every answer before anything is submitted.
Submission. Through an IASME-licensed certification body, with the fee included in your price.
The assessor marks it. IASME says most assessors aim to return results within 3 days. If something fails, you have 2 working days to fix it and resubmit at no extra charge.
Certificate. Valid for 12 months, with the free insurance if you qualify.
Renewal each year. We handle it, and keep the protection and patching running in between.
Free cyber insurance
The free cyber insurance is arranged by IASME for UK organisations with turnover under £20m that certify the whole organisation and opt in. It covers incident response up to £25,000.
IASME lists four conditions. The whole organisation is certified, it is domiciled in the UK or Crown Dependencies, turnover is under £20m, and you opt in when you apply.
The policy includes a 24-hour helpline and incident response up to a total limit of £25,000. A £1,000 excess applies, and the cover lasts 12 months with the certificate. Details are on IASME's insurance page.
Need Plus?
Cyber Essentials Plus adds a hands-on technical audit of a sample of your devices and accounts. Contracts that name Plus, and Ministry of Defence contracts at DCC Levels 2 and 3, need it.
Our Cyber Essentials Plus package starts at £2,495 a year for 1 to 9 people and includes everything on this page. The Plus audit must be completed within 3 months of your Cyber Essentials certificate, so plan both together.
Already on our support plan?
Your plan already protects and patches your computers, so you don't pay for extra tools. You pay for the certificate and our help, and we fill in the answers from the setup we already manage.
For Managed and Secure clients, Cyber Essentials costs £795 a year for 1 to 9 people and £995 for 10 to 19. It is £1,495 for 20 to 49 and £1,995 for 50 to 99, excluding VAT, while you are on the plan. See the IT support plans.
Your IT provider set things up and you want an independent check first? Our Microsoft 365 security audit is £395 fixed for up to 25 users and maps its findings to the Cyber Essentials controls.
Common questions
How much does Cyber Essentials cost?
IASME's certification fee is £320 plus VAT for 0 to 9 employees, rising to £600 for 250 or more. Our package is £995 a year for 1 to 9 people, excluding VAT. It includes the certification fee, a check of your answers, device protection, app patching and renewal.
How long does it take to get Cyber Essentials?
Most of the time goes on fixes before you apply. Once you submit, IASME says most assessors aim to return results within 3 days. If something fails, you get 2 working days to fix it and resubmit without paying again.
Is Cyber Essentials mandatory?
It is required when a customer, tender or contract asks for it. Under PPN 014, central government and NHS bodies ask for it, or equivalent controls, on certain higher-risk contracts. Every level of the Ministry of Defence's Defence Cyber Certification also needs it.
Does Cyber Essentials include insurance?
UK-domiciled organisations with turnover under £20m that certify the whole organisation, and opt in, get free cyber liability insurance arranged by IASME. It includes a 24-hour helpline and incident response up to a total limit of £25,000, with a £1,000 excess.
How long does Cyber Essentials certification last?
Certificates expire after 12 months, so you renew every year. Our package handles the renewal.
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Both use the same five controls. Cyber Essentials is a self-assessment checked by an assessor. Plus adds hands-on technical tests of a sample of your devices and accounts. Our Plus package starts at £2,495 a year for 1 to 9 people.
Guides that go deeper
Plain-English guides on the rules, the costs and the settings behind this service.
Cyber Essentials Cost in 2026: The Full Price for UK Firms
The real Cyber Essentials cost in 2026: the £320 to £600 fee plus fixes, old PCs, Plus and renewals. Worked examples for firms of 4 to 40 staff.
Read the guide
Cyber Essentials Requirements 2026: Plain-English Checklist
Cyber Essentials requirements in plain English: scope, the five controls, the 14-day patch, password and MFA rules, a checklist and Microsoft 365 settings.
Read the guide
Cyber Essentials or Cyber Essentials Plus: Who Needs Which?
Cyber Essentials or Cyber Essentials Plus? See what UK government, MoD, NHS, education, legal and construction rules ask for, with sources and worked examples.
Read the guideReady to get Cyber Essentials?
Tell us your team size, your devices and whether this is your first certificate. We reply within 2 business hours, then send a written quote at the price on this page.
About three minutes. We reply within 2 business hours, Monday to Friday. Or email support@cloud365.io.