Cyber Essentials Cost in the UK: Prices by Company Size

Cyber Essentials cost starts at £320 plus VAT for the smallest businesses and rises to about £600 for organisations with 250 or more staff. That covers the basic certificate. The Plus level, which adds an independent technical test, costs roughly three to four times as much. Your final Cyber Essentials cost depends on your size, your provider and how tidy your IT is when you start.

How much does Cyber Essentials cost by company size?

The National Cyber Security Centre says certification starts at £320 plus VAT and depends on organisation size. A supplier price list published for the government’s G-Cloud 15 framework shows how that scales. These are list prices, excluding VAT, so add 20% to see what lands on your invoice.

Those figures come from the G-Cloud 15 pricing document. Treat them as a benchmark rather than a quote. Other certification bodies price differently, and some bundle in support that others charge for separately.

What do you get for the certification fee?

You get an assessment against the five technical controls in the scheme. The NCSC lists them as firewalls, secure configuration, security update management, user access control and malware protection.

The basic level is a self-assessment that a certification body marks and verifies. Plus uses the same requirements but adds hands-on testing. According to the NCSC, that second level checks that the controls work in practice, which gives buyers more assurance.

There is one perk worth knowing about. GOV.UK says certification includes free cyber insurance for businesses with a turnover under £20 million. The NCSC adds that you need to certify your whole organisation to qualify. Check the policy terms before you rely on it.

Why does Cyber Essentials Plus cost so much more?

Plus pushes the Cyber Essentials cost up because a person has to do real work. For the basic level, you answer questions and a body verifies them. For Plus, a technical assessor tests a sample of your devices, your internet gateways and any servers that face the internet. That takes time, and the price follows the size and complexity of your network.

Plus also builds on the basic certificate. As Wikipedia’s summary of the scheme puts it, a verified self-assessment is a prerequisite. So many firms buy the pair as a bundle, as the price list above shows.

What costs sit outside the Cyber Essentials cost on the price list?

The fee is the easy part of the Cyber Essentials cost. The bigger bill often comes from fixing what the assessment finds. Common examples include:

• Replacing laptops or phones that no longer get security updates.
• Switching on multi-factor authentication for cloud accounts.
• Removing admin rights from everyday user accounts.
• Installing outstanding security updates on laptops, servers and network kit.
• Tightening firewall rules on offices and home-working routers.

None of that is wasted money, because each item closes a real route in. But it explains why two firms of the same size can face very different totals. A business that already patches promptly may pay only the fee. One with a pile of unsupported kit may pay several times that in prep.

Who sets the Cyber Essentials cost?

The scheme is run by the NCSC, and since 2020 IASME has been its delivery partner. IASME manages the network of certification bodies and assessors. Those bodies sell the certificate to you, so the final price reflects their own service level as well as the scheme fee. Cheap does not always mean better, and a more expensive provider may include help that saves you time.

When you compare quotes, line up the same things each time:

• The size band the provider has placed you in.
• Whether the quote covers the basic level, Plus, or both.
• Whether it includes a pre-assessment check or hands-on support.
• What happens, and what it costs, if a question or a test fails first time.
• Whether VAT is shown separately.

How long does Cyber Essentials last, and what does renewal cost?

Certification is annual, so you pay again every year. Ask your provider for the renewal price before you sign, and budget for it as a recurring cost rather than a one-off project. A setup that has stayed tidy through the year gives you far less to fix at renewal time.

Is Cyber Essentials worth the money?

For many UK firms, yes. A growing number of buyers ask suppliers to hold it. The NCSC notes that some organisations require certification before you can bid. Central government has asked for it on contracts involving personal and sensitive information since 1 October 2014.

It is also a sensible floor. Used properly, it blocks the cheap, common attacks, such as an unpatched router or a shared admin password. It does not stop a determined attacker who goes after your applications, which is where a different kind of test comes in. Our guide on the difference between the two Cyber Essentials levels goes deeper on what each one proves.

How can you keep the bill down?

1. Get your devices and software current before you apply, so the assessor finds little to fix.
2. Define your scope carefully, since fewer in-scope devices means less testing time.
3. Compare at least two certification bodies, and ask what is included.
4. Ask about re-test fees up front, in case something fails on the first pass.
5. Consider the bundle if you know you will want Plus anyway.

A worked example of the Cyber Essentials cost for a 30-person office

Take a 30-person professional services firm. On the list prices above it sits in the small band. The basic certificate is £440 plus VAT, which is £528 with tax. Adding Plus brings the bundle to £1,974 plus VAT, or £2,368.80 in total.

Now picture the same firm with five old laptops that no longer get updates and no multi-factor authentication on its email. The certification fee has not changed, but the remediation has. New laptops and a few hours of configuration will dwarf the £440. That is the part of the cost of Cyber Essentials most budgets miss.

Where does penetration testing fit in?

Cyber Essentials checks basic hygiene. A penetration test goes further and tries to break in the way a real attacker would, including through your web apps and custom software. If you want help with either, Aardwolf Security can run a scoped penetration test or help you get ready for certification through our Cyber Essentials service. You can also get in touch for a straight answer on what your business needs.

Frequently asked questions

Is Cyber Essentials cheaper for a sole trader?

Yes. The micro tier, covering one to nine staff, is the lowest. It starts at £320 plus VAT according to the NCSC.

Does the price include VAT?

Usually not. The published figures exclude VAT, so a £320 certificate costs £384 once 20% VAT is added.

Can I get Cyber Essentials Plus without the basic level first?

No. The verified basic assessment comes first, and Plus builds on it.

Is the insurance really free?

GOV.UK says it is included for businesses with turnover under £20 million. Read the policy conditions and exclusions, because it is not a substitute for a full cyber cover review.