How Much Does Cyber Essentials Cost in 2026, and Is It Worth It?
Cyber Essentials costs £320 plus VAT for organisations with 0–9 employees and £440 plus VAT for 10–49 employees, according to IASME’s published pricing checked in October 2026. Larger organisations pay more. Preparation and support can add to the total. Whether it is worthwhile depends on your current controls, customer requirements and the value of independent certification.
Key takeaways
- IASME lists £320 + VAT for 0–9 employees, £440 + VAT for 10–49, £500 + VAT for 50–249 and £600 + VAT for 250 or more.
- Cyber Essentials assesses five technical control areas: firewalls, secure configuration, security update management, user access control and malware protection.
- Cyber Essentials Plus checks the same five controls but adds independent technical testing.
- Budget for the time needed to inventory devices, fix unsupported software, configure MFA, remove unnecessary administrator rights and document the environment.
What is the official Cyber Essentials price in 2026?
IASME lists £320 + VAT for 0–9 employees, £440 + VAT for 10–49, £500 + VAT for 50–249 and £600 + VAT for 250 or more. These are the assessment fees, not a promise that every business will be ready without additional work. Check IASME pricing again before paying.
What is included in Cyber Essentials certification?
Cyber Essentials assesses five technical control areas: firewalls, secure configuration, security update management, user access control and malware protection. The standard uses a verified self-assessment process. It does not replace a wider security programme, continuous monitoring or a full penetration test.
How is Cyber Essentials Plus different?
Cyber Essentials Plus checks the same five controls but adds independent technical testing. Its price is quoted individually based on the organisation and environment. Businesses often choose Plus when customers want stronger evidence that controls are working rather than documented alone.
How much should you budget beyond the assessment fee?
Budget for the time needed to inventory devices, fix unsupported software, configure MFA, remove unnecessary administrator rights and document the environment. External consultancy, remediation and Cyber Essentials Plus testing are separate commercial decisions. Ask for a written scope that distinguishes the IASME assessment from preparation and support.
Free download: get the Cyber Essentials Readiness checklist and Cyber Essentials: A Practical Guide to turn this advice into a repeatable process.
How long does Cyber Essentials take?
IASME says a prepared applicant may complete the questionnaire in about an hour, but remediation can take considerably longer. Assessors generally aim to return an initial result within three days after submission. Build time for internal approvals, evidence gathering and any fixes.
Is Cyber Essentials worth it for a small business?
It is particularly useful when procurement teams ask for certification, when you want a defined baseline or when leadership needs a practical improvement project. Certification does not guarantee immunity from attacks. The value comes from implementing the controls properly and maintaining them after the certificate is issued.
What should you do before applying?
Confirm scope, identify every device and user, review the five controls and complete a readiness checklist. Fix gaps before submitting. If a supplier promises certification without reviewing your real environment, ask exactly how they validate the answers.
What should you do next?
If you are unsure where your current setup stands, Be Tech Secure can help you identify priorities and explain practical next steps. Request a free security risk review or book a short discussion.
Frequently asked questions
Is Cyber Essentials Plus included in the basic fee?
No. Cyber Essentials Plus involves independent technical testing and is priced separately. The certification body provides a quote based on your environment. The same five control areas apply to both levels, but Plus provides a higher level of assurance through testing.
Can we do this without an in-house IT team?
Yes. A small business can assign internal ownership while using an external provider for technical changes and monitoring. The key is to agree who approves access, who receives alerts and who responds to incidents. Do not assume those responsibilities are included in a support contract.
How often should we review our arrangements?
Review important accounts and alerts routinely, and schedule a wider review at least every six months. Reassess sooner after a significant staffing, supplier, licence or system change. Record what was checked, what was fixed and which risks remain open.
Will one product solve the problem?
No single product covers people, processes, devices, email, identity and recovery. Choose a combination of controls that fits your actual risks. Ask vendors to explain what they do not cover, how incidents are handled and which tasks remain your responsibility.
