The certificate itself costs £320 to £600 plus VAT, depending on how many people work for you. Most small businesses pay £320 or £440. The bigger cost is usually fixing gaps first, such as switching on two-step verification or replacing old devices.
The official fee
Cyber Essentials is run by IASME on behalf of the National Cyber Security Centre (NCSC). The fee for the self-assessment depends on the size of your organisation:
| Organisation size | People | Fee |
|---|---|---|
| Micro | 0 to 9 | £320 + VAT |
| Small | 10 to 49 | £440 + VAT |
| Medium | 50 to 249 | £500 + VAT |
| Large | 250 or more | £600 + VAT |
The certificate lasts 12 months, so you pay this every year when you renew.
What the fee includes
- The assessment. You answer the official question set online, and an assessor from a certification body marks it.
- A chance to fix and resubmit. If something fails, you usually get a short window to fix it and update your answers without paying again.
- Cyber insurance, if you're eligible. UK organisations with turnover under £20 million that certify their whole organisation can opt in to £25,000 of cyber liability cover at no extra cost.
- Your certificate and a listing in the public register of certified organisations, which buyers can check.
The hidden costs
The fee is rarely the biggest expense. Under the rules in force since April 2026, these are the things most likely to cost small businesses time or money:
- Two-step verification everywhere. It must be switched on for every user of every cloud service that offers it, even where it's a paid extra. Missing it is now an automatic fail.
- Unsupported devices. Computers and phones that no longer get security updates, such as Windows 10 machines without extended updates, have to be upgraded, replaced or taken out of work use.
- Updates within 14 days. Critical and high-risk updates, including router firmware and apps, must be installed within 14 days of release. Turning on automatic updates usually costs nothing.
- Your time. Expect a few hours to a couple of days to gather device details and work through the questions, more if you've never checked your settings before.
- Optional help. IT providers and consultants charge anything from a fixed fee to a day rate to prepare you or do the fixes.
Cyber Essentials Plus
Cyber Essentials Plus adds a hands-on technical audit of a sample of your devices. It costs more than the basic certificate because an assessor tests your systems. Prices are set by each certification body and depend on how many devices and sites they need to test, so ask two or three for quotes. You need the basic certificate first, and the audit must take place within three months of it.
How to avoid paying twice
A failed application doesn't always mean paying again, but it wastes time and can delay a contract. Check your answers against the automatic-fail rules before you apply. Our free two-minute health check is a quick start, and the full readiness report shows every gap and how to fix it for the devices and apps you use.
Common questions
How much does Cyber Essentials cost for a small business?
The self-assessment costs £320 plus VAT for organisations with up to 9 people, and £440 plus VAT for 10 to 49 people.
Do I have to pay every year?
Yes. The certificate lasts 12 months, so you renew and pay the fee each year.
Is cyber insurance included?
UK organisations with turnover under £20 million that certify the whole organisation can opt in to £25,000 of cyber liability cover at no extra cost.
Sources
- IASME: Get ready for Cyber Essentials (fees)
- IASME: Cyber liability insurance
- IASME: Find a certification body
This guide is general information, not legal advice. Fees and rules can change, so check the sources before you rely on them.