Cyber Essentials has a fixed assessment fee set by IASME, the scheme's delivery partner, which rises with the size of your organisation. Cyber Essentials Plus costs more because an assessor tests your systems in person or remotely. On top of either, budget for any work needed to fix gaps before you apply.
What are the costs?
| Cost | Cyber Essentials | Cyber Essentials Plus |
|---|---|---|
| Assessment fee | A fixed fee set by IASME, banded by organisation size | Set by the certification body; depends on size and how many devices are tested |
| Getting ready | Fixing gaps such as updates, admin rights or unsupported software | The same, plus preparing devices for testing |
| Support (optional) | Help with the question set from a consultancy | Help preparing for and during the technical audit |
| Renewal | Every 12 months | Every 12 months |
IASME publishes the current Cyber Essentials fees on its website. Check the figure for your organisation size there before budgeting, as fees can change.
What makes Cyber Essentials cost more?
- Unsupported software or devices that need replacing before you can pass.
- Missing updates across laptops, servers, phones and network devices.
- Too many admin accounts and default settings left unchanged.
- Cyber Essentials Plus testing across a larger number of devices and locations.
How do you avoid paying twice?
Run a readiness check before you apply, so you fix problems once rather than failing and resubmitting. If you plan to get Cyber Essentials Plus, IASME's guidance is that you don't need to repeat the self-assessment questions if your Cyber Essentials certificate is less than three months old, so time the two together.
Is Cyber Essentials worth the cost?
For most UK businesses, yes. It covers the basic controls that stop the most common attacks, it is required for many public sector and supply chain contracts, and few businesses hold it. The UK government's Cyber Security Breaches Survey 2025 found only 3% of businesses do, so it can set you apart in tenders.
Frequently asked questions
No. The assessment fee is banded by organisation size, with the smallest organisations paying the least. IASME publishes the current fees.
More than Cyber Essentials, because it includes technical testing by an assessor. The price is set by the certification body and depends mainly on your size and the number of devices sampled.
Yes. Cyber Essentials and Cyber Essentials Plus both need renewing every 12 months to stay current.