The assessment fee for Cyber Essentials is set by IASME and depends on how many people you employ. Every certification body charges the same fee for the basic assessment.
| Business size | Employees | Assessment fee |
|---|---|---|
| Micro | 0 to 9 | £320 + VAT |
| Small | 10 to 49 | £440 + VAT |
| Medium | 50 to 249 | £500 + VAT |
| Large | 250 or more | £600 + VAT |
What the fee includes
The fee covers your online assessment and the assessor's review. You get six months from purchase to submit, and if something needs correcting you get two working days to fix it without paying again.
UK businesses with a turnover under £20 million that certify their whole organisation can also opt in to £25,000 of cyber liability insurance, which includes a 24 hour incident response helpline.
What Cyber Essentials Plus costs
There is no fixed price for Plus. Each certification body sets its own fee based on how many devices, users and sites need testing. Get a quote from more than one.
The costs businesses forget
- Replacing unsupported devices. Old laptops, phones or servers that no longer get updates must be replaced or removed from scope.
- Licences. Turning on MFA or proper anti-malware may need a licence upgrade.
- Time. Someone has to gather the answers and fix the gaps. That is where most of the real cost sits.
- A failed attempt. If you miss the correction window, you pay for a new assessment.
Getting help before you apply costs less than a failed assessment and a rushed fix. See how I can help.
Prices correct at the date shown. Check IASME for current fees before you buy.
Still not sure what this means for you?
Send me one quick question about your own setup and I'll give you a plain English answer, usually within one working day.