How much does Cyber Essentials cost in 2026?

Short answer

The certificate: £320 to £600 plus VAT, set by IASME according to headcount. Every certification body charges at least this.
Cyber Essentials Plus: an extra audit, quoted individually. Around £1,400 for a small, simple business by IASME's own estimate, and more for complex setups.
Getting ready: anything from a few hours of your own time to several thousand pounds if devices need replacing or accounts need tidying up.

Most businesses with 10 to 50 staff on modern Microsoft 365 or Google Workspace spend under £1,500 in the first year. Older setups spend more, mostly once.

The certification fee

IASME, the National Cyber Security Centre's delivery partner for the scheme, sets the fee for the basic self-assessment by the number of people in your organisation. These are the current fees, excluding VAT:

Organisation size	Staff	Fee (ex VAT)
Micro	0 to 9	£320
Small	10 to 49	£440
Medium	50 to 249	£500
Large	250 or more	£600

You'll see older, lower figures on some websites. Check the IASME page in the sources before you budget. Some certification bodies bundle extras such as guidance calls, which is where quoted prices above these fees come from.

The certificate lasts 12 months, so this is a yearly cost.

What Cyber Essentials Plus costs

The basic certificate is a self-assessment: you answer the questions and an assessor checks your answers. Plus adds a hands-on audit where an assessor tests a sample of your devices, checks for missing updates, tests that malware protection works and confirms two-factor logins are switched on.

Because it depends on how many devices, sites and systems you have, there is no fixed price. IASME's rough guide is around £1,400 for a small, simple company. Medium-sized businesses with several offices or a mix of Windows, Mac and mobile commonly pay £2,000 to £3,500 or more. You need the basic certificate first, and the Plus audit has to be completed within three months of it.

Only get Plus if a customer or contract asks for it, or you want the outside check for your own peace of mind. For most small businesses the basic certificate is the sensible starting point.

Where the real cost is: getting ready

The fee is the small part. The bill depends on what needs fixing before you can honestly answer yes to every question. These are the gaps we see most often:

Unsupported devices and software. Anything that no longer gets security updates fails, including Windows 10 PCs without paid extended updates and old phones. Replacing a laptop typically costs £500 to £900.
Two-factor logins on every cloud service. Since April 2026 this must be switched on wherever a service offers it, not just for email. That includes your accounting software, CRM and file sharing.
Updates within 14 days. Critical and high-risk security updates must be installed within 14 days of release, and you need to show you have a process for it.
Admin accounts. People should use a normal account day to day and a separate admin account only when they need it.
Phones and home working. Devices used for work, including personal phones that open work email, are usually in scope.
Your own time. Someone has to gather the information and make the changes. Budget a few days for a 25-person business doing it for the first time.

What changed in 2026

On 27 April 2026 the scheme moved to version 3.3 of the requirements, with a new question set called Danzell replacing the old one, Willow. The five areas it covers are the same: firewalls, secure configuration, security updates, user access control and malware protection. The marking is stricter:

Missing two-factor logins on cloud services that offer it is now an automatic fail.
The questions on installing critical updates within 14 days are now automatic fails too.
You have to describe and justify anything you leave out of scope.

Accounts started under the old Willow questions had six months to finish, until 27 October 2026. From now on, every new assessment and renewal uses Danzell. If you passed comfortably last year, check the two-factor and patching answers again before you renew.

Is it worth it?

The government's Cyber Security Breaches Survey 2025/2026 found that 43% of UK businesses identified a breach or attack in the previous 12 months, with phishing the most common. Yet only about 5% of businesses said they follow Cyber Essentials.

Three reasons it usually pays for itself:

Contracts. Most UK government contracts require it, and larger customers increasingly ask suppliers for it. One lost tender costs more than the certificate.
Insurance. If you are based in the UK, turn over less than £20 million and certify your whole organisation, you can opt in to £25,000 of cyber liability insurance included with the certificate. Insurer data quoted by the NCSC says organisations with Cyber Essentials are 92% less likely to make a cyber insurance claim. That is a correlation rather than proof, but it is a big one.
It fixes the basics. The five controls block the common, automated attacks most small businesses actually face.

Two worked examples

1. A 25-person agency on Microsoft 365

Recent laptops, Microsoft 365 Business, a handful of other cloud tools. The main gaps are two-factor logins on three tools that don't have it switched on and a shared admin login.

Certification fee (small)	£440 + VAT
Fixes	None to buy, about two days of internal time
Optional outside help	£0 to £1,000
First year	about £440 to £1,440 + VAT

2. A 60-person wholesaler with an older setup

Eight warehouse PCs still on Windows 10, staff reading work email on personal phones, no device management, and admin rights for everyone. A customer has asked for Cyber Essentials Plus.

Certification fee (medium)	£500 + VAT
Replace eight PCs at about £600 each	£4,800
Set up device management, two-factor and admin accounts	£1,500 to £2,500 with outside help
Cyber Essentials Plus audit	£2,000 to £3,000
First year	about £8,800 to £10,800

Most of that is one-off. From year two, the wholesaler pays the two fees and keeps on top of updates, so the ongoing cost falls to a few thousand pounds a year at most.

How to keep the cost down

Read the questions first. IASME publishes the full question set free. Answer it honestly in a spreadsheet before you pay anything.
Get your scope right. A separate guest Wi-Fi or a clearly separated part of the business can be left out if you justify it properly.
Switch on two-factor everywhere now. It is free on almost every service and is now an automatic fail if missed.
Replace old kit on your normal cycle. Plan device replacements around your renewal date rather than in a rush before it.
Start with the basic certificate. Move to Plus only when someone asks for it.
Keep it running all year. Automatic updates and a monthly check make the renewal a formality rather than a project.

Want help getting ready?

Our Cyber Essentials readiness starts at £950 plus the certification fee. We check your setup against the current questions, fix the gaps with you and take you through the assessment.

Questions

How much is Cyber Essentials for a small business?

The certification fee is set by IASME by headcount: £320 plus VAT for 0 to 9 staff, £440 for 10 to 49, £500 for 50 to 249 and £600 for 250 or more. What you spend getting ready on top of that depends on how much needs fixing.

How much does Cyber Essentials Plus cost?

Plus is quoted individually because an assessor tests a sample of your devices. IASME's own rough guide is around £1,400 for a small, simple organisation. Larger or more complex setups commonly pay £2,000 to £3,500 or more, on top of the basic certificate.

How long does Cyber Essentials take?

If your setup already meets the requirements, you can complete the questionnaire in a day or two and the assessment is usually returned within a few working days. Most of the time goes on fixing gaps first, which can take a few weeks.

Is Cyber Essentials a legal requirement?

No. It is voluntary, but many UK government contracts require it and a growing number of larger companies, banks and insurers ask suppliers for it.

How long does a Cyber Essentials certificate last?

Twelve months. You renew every year by completing a fresh assessment against the requirements in force at the time.

Sources

Fees and figures were checked on 31 October 2026. IASME reviews its fees and requirements periodically, so check its website before you budget.