What does Cyber Essentials cost in 2026?
The certificate fee is set centrally by size of business. For most small firms the real cost is the work to get ready, not the fee itself.
The certificate fee
Basic Cyber Essentials is a self-assessment checked by an assessor. The fee is set by IASME, the NCSC's delivery partner, so it is broadly the same whichever certification body you use:
| Business size | Standard fee | With 75% First Step funding |
|---|---|---|
| Micro (0–9 staff) | £320 + VAT | £80 + VAT |
| Small (10–49 staff) | £440 + VAT | £110 + VAT |
| Medium (50–249 staff) | £500 + VAT | £125 + VAT |
Funding is for businesses that haven't held a certificate in the last four years, while the fund lasts. See how the funding works.
Cyber Essentials Plus
Plus covers the same five controls but adds a hands-on technical audit by an assessor. You need basic Cyber Essentials first. Plus is priced by each certification body, and for small businesses it typically runs from around £1,500 to £3,000 + VAT, depending on how many devices and sites are tested. What the Plus audit involves →
The costs people forget
- Getting ready. Many certification bodies sell a pre-assessment check or hands-on help filling in the questionnaire.
- Fixing what fails. Common examples: turning on multi-factor login for every cloud service, replacing old laptops or phones that no longer get security updates, and removing unsupported software.
- Renewing every year. The certificate lasts 12 months, so budget for the fee annually.
- Ongoing IT support. Some businesses choose a provider who also keeps them compliant all year.
Ready to get certified?
Tell us about your business and we'll introduce you to accredited certification bodies — free, no obligation.
Get matched