How much does Cyber Essentials cost in the UK in 2026?
Short answer: the official Cyber Essentials fee is £320 + VAT a year for a business with fewer than 10 employees, rising to £600 for 250 or more. Cyber Essentials Plus has no fixed price. If you pay an IT provider to manage it, published prices in our data run from £85 to £103 a month for the smallest businesses.
Published 31 Oct 2026. Official fees checked 31 Oct 2026; provider prices fetched 21 Oct 2026.
IASME is the body that runs Cyber Essentials for the National Cyber Security Centre (NCSC). n = number of priced services in our data. Prices are in GBP.
How much does Cyber Essentials cost in 2026?
£320 to £600 + VAT a year, depending on how many people you employ. This is the fee IASME publishes for the self-assessment.
| Organisation size | Employees | Fee |
|---|---|---|
| Micro | 0 to 9 | £320 + VAT |
| Small | 10 to 49 | £440 + VAT |
| Medium | 50 to 249 | £500 + VAT |
| Large | 250 or more | £600 + VAT |
Source: IASME Cyber Essentials FAQ, checked 31 Oct 2026. The NCSC also gives £320 + VAT as the starting price.
The fee pays for the assessment, not for getting your systems ready. If your firewall, updates, admin accounts or anti-malware need work, that work is extra. You can do it yourself or pay an IT provider.
What is Cyber Essentials?
It is a UK government-backed certificate showing that your organisation has five basic security controls in place. The NCSC calls it the minimum standard of cyber security the government recommends.
The five controls are firewalls, secure configuration, security update management, user access control and malware protection. For the basic certificate you answer an online questionnaire, and an assessor checks your answers. IASME says it is now required in a large number of central government contracts and a growing number of local government ones.
What is Cyber Essentials Plus, and what does it cost?
Cyber Essentials Plus has no fixed fee. A certification body quotes it, based on the size and complexity of your network.
It covers the same five controls, but an assessor tests them. This includes internal and external vulnerability scans and checks on a sample of your user devices, internet gateways and internet-facing servers. The Cyber Essentials questionnaire is part of the process.
IASME's quote request form sends your details to three certification bodies, so you can compare quotes. Our data has two published prices that include Cyber Essentials Plus:
- Connection Technologies: managed Cyber Essentials Plus from £272 a month ex VAT for 1 to 9 users, including the IASME audit.
- IFA IT Support: a full managed IT tier at £80 per user a month that includes a Cyber Essentials Plus certificate, with a minimum of 20 users (at least £1,600 a month). That price also covers IT support.
Two prices are not enough for a typical figure.
How much does managed Cyber Essentials cost per month?
Between £85 and £103 a month for a business with fewer than 10 staff, on the published prices in our data. One provider charges £14 per device a month instead.
A managed service usually puts the controls in place, keeps them working all year and handles the submission. These are all the managed Cyber Essentials prices in our dataset. There are 6 of them, from 5 UK providers:
| Provider | Service | Published price | Size | IASME fee included? | VAT |
|---|---|---|---|---|---|
| Guard IQ London | Cyber Essentials | £85 a month | 0–9 staff | Not stated in our data | not stated |
| Wolds Cyber Yorkshire | Cyber Essentials | from £1,025 a year (about £85 a month) | 1–9 users | Not stated in our data | ex VAT (stated) |
| Connection Technologies South East | Cyber Essentials | from £103 a month | 1–9 users | Yes | ex VAT (stated) |
| Apexward South East | Cyber Essentials | £14 per device a month | not stated | No, paid on top | not stated |
| Connection Technologies South East | Cyber Essentials Plus | from £272 a month | 1–9 users | Yes | ex VAT (stated) |
| AMVIA Yorkshire | Cyber Essentials | £275 a month | not stated | Not stated in our data | not stated |
Lowest monthly cost first, counting the per-device price at 10 devices. Order is by price only: sponsors never get a higher ranking. “From” means the provider publishes a starting price. Guard IQ also publishes larger bands: 0–9 staff £85 · 10–49 staff £110 · 50–249 staff £130 a month. AMVIA's page lists the price without a size band or a list of what is included. Region is where the provider is based. Prices fetched 21–26 Oct 2026; see the methodology.
Is the IASME fee included in managed prices?
Sometimes. 2 of the 6 services say the fee or audit is included, 1 says it is extra and 3 do not say.
Connection Technologies says its price includes the IASME fee, patching, training and the £25,000 insurance. Apexward charges the certification fee on top of £14 per device. If the fee is extra, add £320 to £600 + VAT a year to the price. Only 3 of the 6 services say their price is ex VAT, so check that too.
Is it cheaper to do Cyber Essentials yourself?
On the fee alone, yes. A micro business pays £320 + VAT a year, against about £1,020 a year for the cheapest managed services in our data.
The comparison is not like for like. Doing it yourself means someone in your team sets up the controls, answers the questionnaire and keeps everything up to date between renewals. A managed service does that work, and some include the fee and insurance.
Does my IT support contract include Cyber Essentials?
Probably not by name. Only 5 of the 170 published UK managed IT tiers in our data mention Cyber Essentials.
- Indigo Unified Communications: from £45 per user a month. The tier text says: “Platinum: + M365 Business Premium, 24/7 SOC, Cyber Essentials support”.
- Fox ITC: £75 per user a month. The tier text says: “Defend: + 24/7, MDR/SOC, phishing sims, vCIO, Cyber Essentials support”.
- Cyber Fits: from £75 per user a month. The tier text says: “Complete Secure: + EDR, advanced email security, awareness training, MFA/CA, Cyber Essentials prep”.
- IFA IT Support: £80 per user a month. The tier text says: “Gold: + M365 Business Premium, Cyber Essentials Plus cert; min 20 users”.
- Dinta Group: £95 per user a month. The tier text says: “Premium: + named senior engineer, vCIO hours, Cyber Essentials support, onsite visits, same-day priority”.
“Support” or “prep” does not say whether the certificate fee is paid. Ask whether the tier pays the IASME fee, does the remediation work and handles renewal. To check whether the rest of an IT support quote is fair, try the free quote checker, or read our guide to what IT support costs a UK small business.
Do you pay again every year?
Yes. A certificate lasts 12 months, so the fee is a yearly cost.
IASME gives you six months to complete the assessment once you start. If you fail, you have two working days to fix the problems and resubmit without paying again. After that, you pay a new fee. If you passed Cyber Essentials less than three months before a Cyber Essentials Plus audit, you do not need to repeat the self-assessment.
Does Cyber Essentials come with insurance?
It can. IASME offers free cyber liability insurance with £25,000 of cover to eligible organisations that certify.
To qualify, an organisation must be based in the UK or the Crown Dependencies, have a turnover under £20 million and certify the whole organisation. IASME asks you to opt in when you apply. According to IASME, the cover includes a 24-hour helpline and has a £1,000 excess. We have not read the policy wording, so check the current terms on the IASME insurance page.
How reliable are these figures?
The official fees are firm. The managed prices are a small sample, so treat them as a guide, not a market average.
- Official fees are firm. They come straight from IASME and were checked on 31 Oct 2026.
- The managed sample is small. There are 6 priced services from 5 providers, too few for a median. Most UK providers do not publish a Cyber Essentials price at all.
- No typical Cyber Essentials Plus price. It is quoted per job, and only two published prices in our data include it.
- Mostly the smallest size band. Only Guard IQ publishes managed prices for larger teams. The other prices are for fewer than 10 users, priced per device, or do not state a size. Bigger businesses should expect to pay more.
- VAT and what is included vary. 3 of 6 services do not say whether VAT is included, and 3 do not say whether the IASME fee is.
- A snapshot. Provider prices were fetched on 21 Oct 2026 and may have changed. This guide is not a quote or advice. Read the full methodology and limitations.
Frequently asked questions
How much does Cyber Essentials cost in 2026?
The official IASME fee for a Cyber Essentials self-assessment is £320 + VAT for a micro organisation (0 to 9 employees), £440 for 10 to 49, £500 for 50 to 249 and £600 for 250 or more. The fee covers one year. Fees checked with IASME on 31 Oct 2026.
How much does Cyber Essentials Plus cost?
There is no fixed price. Cyber Essentials Plus is an audit by a certification body, and IASME says it is quoted individually depending on the size and complexity of your network. In our data, one managed Cyber Essentials Plus service is priced from £272 a month ex VAT for 1 to 9 users, including the audit.
How much does managed Cyber Essentials cost per month?
Published managed Cyber Essentials services in our data cost £85 to £103 a month for the smallest businesses, and one provider charges £14 per device a month plus the IASME fee. Only 6 priced services from 5 providers are in the data, so treat these as examples, not a market rate.
Is the IASME fee included in managed Cyber Essentials prices?
It varies. Of the 6 managed services in our data, 2 say the certification or audit fee is included, 1 says it is extra, and 3 do not say. Ask every provider.
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Both check the same five technical controls. Cyber Essentials is a self-assessment questionnaire, checked by an assessor. Cyber Essentials Plus adds a hands-on technical audit, including vulnerability scans and checks on a sample of your devices, so it gives more assurance and costs more.
Do you have to renew Cyber Essentials every year?
Yes. A certificate lasts 12 months, so you pay the fee again each year to stay certified. If you fail, IASME gives you two working days to fix the problems and resubmit without paying again.
Does Cyber Essentials include cyber insurance?
It can. UK-based organisations with a turnover under £20 million that certify their whole organisation can opt in to free cyber liability insurance with £25,000 of cover, according to IASME. Check the current terms with IASME before relying on it.
Is it cheaper to do Cyber Essentials yourself?
On the fee alone, yes: £320 + VAT a year for a micro business, against £1,020 or more a year for the cheapest managed services in our data. A managed service also does the technical work and keeps the controls in place between renewals, so the two are not like for like.
Does my IT support contract include Cyber Essentials?
Usually not by name. Only 5 of the 170 published UK managed IT tiers in our data mention Cyber Essentials, and most of those say “support” or “prep”, not that the certificate fee is paid. Ask exactly what is included.
Sources
Official scheme facts:
- IASME, Cyber Essentials frequently asked questions: official fees by organisation size, CE Plus quoting, renewal and resubmission rules. Checked 31 Oct 2026.
- IASME, cyber liability insurance: who qualifies for the included insurance, cover limit and excess. Checked 31 Oct 2026.
- NCSC, Cyber Essentials overview: what the scheme is, the five technical controls, IASME as delivery partner. Checked 31 Oct 2026.
Provider prices (PriceMarketplace dataset; each row links to the provider's own page):
- Fox ITC (row 6): Defend: + 24/7, MDR/SOC, phishing sims, vCIO, Cyber Essentials support. Fetched 21 Oct 2026.
- AMVIA (row 33): Cyber Essentials (managed). Fetched 21 Oct 2026.
- Indigo Unified Communications (row 61): Platinum: + M365 Business Premium, 24/7 SOC, Cyber Essentials support. Fetched 21 Oct 2026.
- IFA IT Support (row 65): Gold: + M365 Business Premium, Cyber Essentials Plus cert; min 20 users. Fetched 21 Oct 2026.
- Apexward (row 420): Cyber Essentials Managed: CE controls implemented & kept renewal-ready; IASME fee extra. Fetched 21 Oct 2026.
- Connection Technologies (row 424): Managed Cyber Essentials: controls, IASME fee, patching, training, £25k insurance. Fetched 21 Oct 2026.
- Connection Technologies (row 425): Managed Cyber Essentials Plus incl. IASME audit. Fetched 21 Oct 2026.
- Guard IQ (row 451): Managed Cyber Essentials (bands: £110 10–49, £130 50–249). Fetched 21 Oct 2026.
- Cyber Fits (row 495): Complete Secure: + EDR, advanced email security, awareness training, MFA/CA, Cyber Essentials prep. Fetched 21 Oct 2026.
- Dinta Group (row 498): Premium: + named senior engineer, vCIO hours, Cyber Essentials support, onsite visits, same-day priority. Fetched 21 Oct 2026.
- Wolds Cyber (row 545): Wolds Certify: basic Cyber Essentials (1–9 users), per year. Fetched 21 Oct 2026.
Compare the wider IT bill
Cyber Essentials is usually one line in a bigger IT budget. See what 547 published MSP prices say about the rest of it.