The number on the certification body's website is not the number that leaves your bank account. Sometimes the real figure is smaller than you fear; usually it is bigger than the headline. This article breaks down what Cyber Essentials actually costs a UK business in 2026: the official fee, the hidden costs, the three paths through the work, and the one mistake that makes you pay the fee twice.
The official assessment fee
The Cyber Essentials assessment fee is tiered by organisation size. IASME currently lists £320 + VAT for a micro-organisation, rising through bands based on employee count. Always check IASME's current Cyber Essentials pricing before budgeting, because its live fee table is the authority and can change.
That fee buys assessment of your self-assessment questionnaire and, if your answers hold up, certification valid for 12 months. Unless a funded programme covers an application, budget for the assessment separately: no preparation route, tool, or consultant removes the certification body's charge.
Cyber Essentials Plus is a different budget conversation
Cyber Essentials Plus adds a technical audit to the verified self-assessment. It is quoted individually, and IASME says the price depends on the size and complexity of the network. Cyber Essentials certification is a prerequisite. The contract or customer requirement decides whether Cyber Essentials or Cyber Essentials Plus is needed.
The three hidden costs
Your time. The current Danzell question set contains more than 100 numbered question references across scope and the five controls. A UK government process evaluation published in 2023 found that 66% of current and lapsed clients surveyed had needed to ask questions or seek help during certification. Preparation time varies with scope and how much remediation is needed, so preview the questions before buying the assessment.
Remediation. Preparing honestly can expose work that must be completed before your answers are true: MFA for every administrator and user of a cloud service where it is available, unsupported software, or outdated router and firewall firmware. That may mean configuration work, upgrades or replacement; the cost depends on the current environment.
An unsuccessful assessment. IASME allows two working days to address the assessor's feedback and resubmit without an extra charge. If the assessment still fails after that period, a new application and fee are required. Treat the two-day window as a correction period, not a remediation plan.
Three ways through it
Self-directed preparation: no added preparation fee. The official guidance and question set are free, but the assessment fee still applies. This route trades paid preparation support for your time and responsibility for interpreting the scope and requirements.
Hire help. Consultants and certification bodies offer guided packages at separately quoted prices. If you have no IT person, limited time, or a fixed contract deadline, professional support may be the right buy. Compare scope and deliverables rather than relying on a generic price range.
In-house preparation with a workspace. RightCyber Certification Workspace — In-house is for people organising their own organisation's Cyber Essentials preparation. It keeps the questions, evidence context, gaps and outputs together. The official assessment fee and certification process remain separate. The workspace helps you prepare for Cyber Essentials Plus; the test itself is carried out by a certification body's assessor, who chooses the sample and decides the outcome.
A realistic all-in budget
For any organisation, the realistic budget is the assessment fee plus preparation time and any remediation. A preparation tool adds its own cost but can reduce repeated administration; consultant-led preparation adds a separately quoted professional fee. Cyber Essentials Plus is a separate audited engagement and needs its own budget.
The expensive versions of Cyber Essentials are the unplanned ones: the failed retry, and the consultant hired in a panic five days before a tender deadline.
Do not forget: it is annual
The certificate expires after 12 months. IASME says every answer must be entered again and the questions may change, so recheck every answer. Keeping the previous submission avoids reconstructing its context from memory.