The Cyber Essentials cost for a UK business is £320 plus VAT for a micro company, rising to £600 plus VAT at 250 staff or more. Since 3 November 2026, eligible businesses applying for a new certificate pay 75% less, £80 to £125 plus VAT, until 31 March 2027 or until the funding runs out.
Those are the scheme's own fees, and they are only part of the bill. What you really pay also depends on how much help you buy, what has to be fixed before you can pass, whether you need Cyber Essentials Plus, and what year two costs. This guide puts every figure side by side, each read from its source on 8 November 2026. If you are weighing up doing it yourself against having it handled, our Cyber Essentials service page sets out the options.
- What Does Cyber Essentials Cost in the UK?
- Can You Get 75% Off Cyber Essentials Right Now?
- What Do Providers Charge on Top of the IASME Fee?
- What Pushes the Cyber Essentials Cost Up?
- How Much Does Cyber Essentials Plus Cost?
- What Does Cyber Essentials Cost After the First Year?
- How Do You Keep the Bill Down?
- Where Does a Web Agency Fit In?
- 7 Frequently Asked Questions
What Does Cyber Essentials Cost in the UK?
The NCSC calls Cyber Essentials the minimum standard of cyber security recommended by the Government for organisations of all sizes, and IASME delivers the scheme for it. A Cyber Essentials price depends on the route you take, and most price pages show only one of them. The chart and table below put five in order, from the discounted scheme fee up to a Cyber Essentials Plus audit. Amounts exclude VAT, which is 20% in the UK.
View data table
| Stage | Typical UK cost (ex VAT) | What sits behind it | Verdict |
|---|---|---|---|
| IASME list fee | £320 to £600 | The assessment fee IASME sets by headcount: £320 micro, £440 small, £500 medium, £600 large | Baseline |
| First Step fee | £80 to £125 | The same fee with 75% off a new certificate for eligible micro, small and medium organisations, until 31 March 2027 or until the money runs out | Best value if you qualify |
| Provider package | £420 to £695 | A package with the IASME fee included. Examples read on 8 November 2026: from £420, and £495 to £695 for 1 to 49 users. Support levels differ | Depends on what is included |
| Full first year | £1,500 to £3,500 | The whole first year with preparation and fixes: one managed IT provider's estimate for most SMEs (22 September 2026), which does not say if VAT is included. Your fixes decide where you land | Depends on your fixes |
| Plus audit | £920 to £3,999 | Cyber Essentials Plus. Audit-only from £920, and a supplier shop lists £1,499 to £3,999. Quoted by network size and complexity | Only if a customer asks |
What does the IASME fee cost for each company size?
IASME sets the fee by headcount, using the UK government's size bands: micro is 0 to 9 employees, small 10 to 49, medium 50 to 249 and large 250 or more. The NCSC says prices start at £320 plus VAT. Add 20% VAT and a micro company pays £384 while a large one pays £720. The fee includes your first certificate, and IASME's Cyber Essentials page and its FAQ both show these figures today.
| Organisation size | List fee (ex VAT) | List fee (inc VAT) | With First Step discount (ex VAT) | Saving (ex VAT) |
|---|---|---|---|---|
| Micro, 0 to 9 employees | £320 | £384 | £80 | £240 |
| Small, 10 to 49 employees | £440 | £528 | £110 | £330 |
| Medium, 50 to 249 employees | £500 | £600 | £125 | £375 |
| Large, 250 or more employees | £600 | £720 | Not offered | None |
Figures from IASME's fee table and its First Step funding page, read on 8 November 2026. The VAT and saving columns are our arithmetic on those figures.
Can You Get 75% Off Cyber Essentials Right Now?
Yes, if you qualify. On 3 November 2026 the government launched the Cyber Essentials First Step Fund, which takes 75% off the cost of a new certificate for eligible organisations. The government says the discount is covered by £2.4 million of funding, expects about 6,000 businesses to benefit, and gives places out on a first come, first served basis. IASME runs it through a dedicated First Step page, and the full terms sit in the GOV.UK funding package.
Who qualifies for the First Step Fund?
IASME lists three tests. Your organisation is a micro, small or medium business registered in the UK, and it has not held Cyber Essentials in the last four years. IASME's Supplier Assurance Tool checks both when you create an account. A company registered in Wales, England, Scotland or Northern Ireland counts, because the test is UK registration. A fourth rule comes from subsidy control law: the small government subsidies a business receives, known as minimal financial assistance, must stay within £315,000 in total, and this discount counts towards that limit. Large organisations with 250 or more employees have no discounted price on IASME's page, and a business that holds a current certificate does not qualify for its renewal.
How do you claim the discount?
The route runs through IASME, and GOV.UK says the discount still applies if you certify through a Certification Body instead of buying direct. Whichever way you go, the steps are the same.
- Confirm your size: count employees against the micro, small and medium bands in the table above.
- Create an account on IASME's First Step page, so the Supplier Assurance Tool can check your organisation details and certification history.
- Register and pay by 31 March 2027, or earlier if the funding runs out first.
- Finish within six months, the same window as a full-price purchase.
A provider's package also includes support, so ask in writing how the 75% appears on the invoice before you pay anyone.
What does the discount not cover?
Both official pages describe the discount as 75% off the assessment and certification. GOV.UK adds that the funding does not guarantee certification, so a fail still means more work and, once the free retry is used, a new fee. Neither page mentions preparation help, fixes or Cyber Essentials Plus, so plan to pay normal prices for those. A separate Cyber Resilience Pledge scheme offers free certification with Cyber Advisor support, but only to small suppliers that a Pledge signatory nominates, and the government expects about 8,000 businesses to benefit before it ends in March 2029. You cannot apply for that one yourself.
Buying early secures the discount, but it also starts the clock. The fund closes in March 2027 or when the £2.4 million is spent, whichever comes first. IASME's terms say an assessment not submitted within six months is not marked and the fee is not refunded. Buy when you can finish.
What Do Providers Charge on Top of the IASME Fee?
Buying direct from IASME means you answer the questions yourself. Most businesses that want help pay a Certification Body or an IT provider for a package, and the package price includes the IASME fee. UK providers' own pages, read on 8 November 2026, show how wide the spread is. Packages for micro and small organisations start at £420 plus VAT on one page, and run from £495 for 1 to 9 users to £695 for 10 to 49 users on another. One managed IT provider puts the full first-year spend at £1,500 to £3,500 for most SMEs once preparation and fixes are counted.
Why do packages cost more than the scheme fee?
A package pays for time. The provider explains the questions, checks your devices and accounts, and fixes gaps before the assessor sees your answers. IASME says the questions take an hour or two once your answers are ready, so the paid part is mostly preparation. IASME's route page splits the choice in two: self-led with the free resources, or supported by a Cyber Advisor or Certification Body. It also separates the jobs, since Cyber Advisors help you prepare while assessors at a Certification Body mark the answers. IASME's terms say the fee follows its published scale "or as advised by the Certification Body", so the direct IASME fee is a useful reference point, not the price floor.
How can you tell a stale price guide?
Check three things before you trust any Cyber Essentials price page: its date, its tier fees and what the price includes. IASME's current fees are £320, £440, £500 and £600 plus VAT. Several guides, including at least one marked as updated in September 2026, still print £300, £400, £450 and £500, which are older figures. A guide that predates 3 November 2026 cannot mention the 75% discount at all. The same applies to a quote: ask whether it includes the IASME fee, VAT and a resubmission.
Four questions to ask any provider before you pay. Does the price include the IASME fee? Does it include VAT? Is a resubmission included if the assessor sends answers back? How does the 75% discount show on my invoice? Get the answers in writing.
What Pushes the Cyber Essentials Cost Up?
The fee is fixed, so extra cost comes from the clock and from your own setup. Two things move the total most: a failed assessment and a system that does not meet the rules. The diagram shows where the clock and the money meet.
Does a failed assessment cost extra?
IASME gives you one free further assessment if you resubmit quickly. Its terms say within 48 hours of the failure notice, while its FAQ and Knowledge Hub say two working days. The pages disagree, so plan for 48 hours. Miss the window and any further attempt counts as a new application with a new fee. IASME says assessors aim to mark within 3 working days. Since April 2026 two things fail an application outright: a cloud service that offers multi-factor authentication without it switched on, and high-risk or critical updates not installed within 14 days. IASME explains both in its April 2026 update.
What do unsupported systems and missing MFA cost?
Windows 10 stopped receiving security updates on 14 October 2025, and IASME says machines running it are not compliant. The point in time that counts is the day your certificate is issued, so systems must be supported on that date. You either move to Windows 11 or enrol the machine in Microsoft's Extended Security Updates programme, which IASME says is sold in 12-month blocks. IASME's page gives no price, so check Microsoft's current figure before you budget. Multi-factor authentication works the same way: a cloud service must use it wherever it is offered, whether that is free, included or a paid option. List each cloud plan you use and check what switching it on costs.
Which small fees catch people out?
IASME's terms and conditions list the charges after your first certificate: £100 to change the name or address on it, £50 to correct a simple error and £10 for each extra legal entity certificate. Cancel before you submit and IASME refunds the fee minus a £25 administration charge. Cancel after you submit and nothing comes back. Login details arrive as soon as you pay, so the six months run from that day, and an account left unsubmitted after six months is deleted with no refund.
How Much Does Cyber Essentials Plus Cost?
Cyber Essentials Plus is a separate technical audit on top of the basic assessment, and nobody publishes one fixed price. IASME and the NCSC both say Plus is priced by the size and complexity of your network, and each Certification Body quotes for itself. You can compare the two levels on our Cyber Essentials page.
What sets the Plus price?
The audit tests a sample of your devices, so more devices and more complicated setups take longer. IASME's FAQ says the assessor tests a random sample, typically around 10 per cent, of the in-scope systems. Prices read on 8 November 2026 show the spread. One certification body lists the Plus audit alone from £920 plus VAT for people who already hold a current certificate. Another says a small, non-complex organisation starts at £1,250. A third lists £1,495 for 1 to 9 users and £1,995 for 10 to 49 users, and a supplier shop shows £1,499 to £3,999. A managed IT provider quotes £5,000 to £8,000 for 101 to 250 devices. All of these exclude VAT. IASME's quote form sends your details to three Certification Bodies. If you passed the basic assessment less than three months earlier, you do not repeat the questions. The First Step discount does not mention Plus.
What Does Cyber Essentials Cost After the First Year?
Cyber Essentials lasts 12 months, so the cost repeats every year. IASME says a renewed certificate runs for 12 months from the day you submit, not from the old expiry date, so renewing too early wastes the unused time. The First Step discount is for a new certificate and the government describes eligible organisations as not certified in the last four years, so it does not cover a renewal. Your second year costs the list fee for your size, plus any support you buy again. IASME's fee table shows one price per size and no separate renewal price.
What does three years look like?
The table shows the IASME fee only, excluding VAT, for an organisation that claims the discount in year one and pays the list fee in years two and three. It is an illustration, not a quote, and it assumes IASME's fees stay where they are today.
| Organisation size | Year 1 with discount | Years 2 and 3, each | Three years with discount | Three years at list |
|---|---|---|---|---|
| Micro, 0 to 9 employees | £80 | £320 | £720 | £960 |
| Small, 10 to 49 employees | £110 | £440 | £990 | £1,320 |
| Medium, 50 to 249 employees | £125 | £500 | £1,125 | £1,500 |
Our arithmetic on IASME's list fees and First Step fees, read on 8 November 2026. Add VAT and any support or fixes you pay for.
How Do You Keep the Bill Down?
Order matters more than haggling. Do the free work first, claim any discount you qualify for, then decide how much help to buy.
Which free help is worth using first?
IASME and the NCSC offer four free things. You can preview the question set before you pay, use the Readiness Tool to get a tailored action plan, and book a free 30-minute session with an NCSC-assured Cyber Advisor if you are an SME preparing for Cyber Essentials. IASME's free advice page says the session is for organisations with fewer than 250 employees that have not held Cyber Essentials before. The fourth is the cyber liability insurance IASME describes as included for eligible UK organisations, with a £25,000 limit, conditions and exclusions. Read IASME's insurance terms before you decide. Read the questions before you pay anything, because they show which fixes you need before the six-month clock starts.
Where Does a Web Agency Fit In?
Cambria Digital is a Cardiff agency that builds and hosts business websites, so we know the website, hosting and cloud-account side well. It is a small part of Cyber Essentials, but it is where many small UK businesses lose time.
What can a website and hosting setup change?
Many of the accounts around a website are cloud services: the hosting control panel, the domain registrar, the email provider, and any analytics or marketing logins. Multi-factor authentication has to be on wherever the service offers it. A written list of those accounts, who holds each one and whether MFA is on, saves the most time before you start. If you would rather have it handled, our Cyber Essentials page explains how we get businesses certified, with the assessment carried out by an IASME-licensed Certification Body that we work with. Cambria Digital is an independent company. It is not part of the NCSC or IASME and is not endorsed by either.
Common Cost Mistakes to Avoid
- Comparing a package with the scheme fee: a package that includes support is a different product from IASME's fee on its own, so compare what each one includes.
- Trusting an undated price guide: some pages still print the old £300 to £500 tiers, and none that predate 3 November 2026 mention the 75% discount.
- Buying before you can finish: you have six months from payment, and an unfinished account is deleted with no refund.
- Missing the resubmission window: plan for 48 hours, because after that a retry is a new application with a new fee.
- Forgetting year two: the 75% discount does not repeat, so the list fee for your size returns at renewal.
- Buying Plus by default: Plus is a separate audit priced by your network, so buy it when a customer, contract or insurer asks.
- Ignoring your cloud accounts: one cloud service with MFA left off fails the assessment automatically, whatever else you get right.
7 Frequently Asked Questions
IASME charges £320 plus VAT for micro organisations with 0 to 9 employees, £440 for 10 to 49, £500 for 50 to 249 and £600 for 250 or more. With VAT that is £384, £528, £600 and £720. Eligible businesses applying for a new certificate can currently claim 75% off, which makes the fee £80, £110 or £125 plus VAT for micro, small and medium organisations. Support from a provider, fixes to your systems and Cyber Essentials Plus cost extra. Packages read on 8 November 2026 with the IASME fee included start at £420 plus VAT. Fees can change, so check IASME's page on the day you buy.
Not for most businesses, but a lot of the preparation is free. You can preview the questions, use the NCSC Readiness Tool and book a 30-minute session with an NCSC-assured Cyber Advisor if you are an SME that has not held Cyber Essentials before. The certification itself costs money, although eligible businesses can claim 75% off until 31 March 2027 or until the funding runs out. A separate government scheme offers fully funded certification, but only to small suppliers that a Cyber Resilience Pledge signatory nominates. You cannot apply for that one yourself.
A micro, small or medium organisation registered in the UK that has not held Cyber Essentials in the last four years. You create an account on IASME's First Step page, which checks your size and certification history, then register and pay by 31 March 2027. Your total government support must also stay within the £315,000 subsidy control limit, including this discount. Places are first come, first served and the £2.4 million fund can run out before March. The discount is for a new certificate, so it does not cover renewals.
Nobody publishes one price, because certification bodies quote by the size and complexity of your network. Prices read on 8 November 2026 ran from £920 plus VAT for a Plus audit on its own, through £1,250, £1,495 and £1,995 for small organisations, to £3,999 at the top of one supplier's range. A managed IT provider quotes up to £8,000 plus VAT for larger device counts. You need the basic certificate first, and IASME says you skip the questions if you passed less than three months earlier. Ask more than one body for a quote.
It is worth it when someone is asking for it, or when the controls would improve your setup anyway. IASME says certification opens up contracts that require it, and eligible UK organisations with turnover under £20 million that certify their whole organisation can take the included cyber liability insurance, limited to £25,000 with conditions and exclusions. It is a snapshot of your systems on the day the certificate is issued, not protection against every attack. If no customer, tender or insurer is asking, start with the free tools and decide after you have read the questions.
Every 12 months. IASME says the new certificate runs for 12 months from the day you submit the renewal, not from the old expiry date, so renewing early wastes the unused time. IASME's fee table shows one price per size and no separate renewal price, so plan on the list fee for your size, £320 to £600 plus VAT, plus any support you buy again. The First Step discount does not apply because it needs a gap of four years since your last certificate.
IASME says the questions take an hour or two when your answers are ready, and an assessor aims to mark within 3 working days. Since April 2026 two things fail an application outright: a cloud service with multi-factor authentication switched off, and high-risk or critical updates not installed within 14 days. If you fail, IASME's terms give one free further assessment when you resubmit within 48 hours, while its FAQ says two working days, so plan for 48 hours. After that, a further attempt is charged as a new application.
Want a second pair of eyes on your own numbers? Send us your headcount and the cloud accounts you use through the form on our Cyber Essentials service page, and we reply within 2 hours during business hours.