Prices published
What Cyber Essentials and Cyber Essentials Plus actually cost
Both levels, priced in the open: the official IASME tiers for the basic self-assessment, and one monthly figure per size band for Cyber Essentials Plus that includes the ongoing management of your certification, not just the first audit. You should be able to budget before you ever speak to us.
Level one
Basic Cyber Essentials: the official price
The basic self-assessment is priced by IASME, the scheme's delivery partner, in four size tiers. Nobody should charge you more for the assessment itself; what varies is the help you get answering it accurately. Ours is included in every Plus band, or available on its own with our basic Cyber Essentials support.
| Company size | Employees | Official assessment price |
|---|---|---|
| Micro | 1 to 9 employees | £320 + VAT |
| Small | 10 to 49 employees | £440 + VAT |
| Medium | 50 to 249 employees | £500 + VAT |
| Large | 250+ employees | £600 + VAT |
Source: IASME's published Cyber Essentials assessment pricing, correct as at July 2026. The certificate lasts twelve months at either level.
Level two
Cyber Essentials Plus, priced by company size
One monthly figure per band, and the certificate is managed for you from then on: the readiness gap analysis, hands-on remediation support, the basic self-assessment if you need it, the independent Plus audit carried out by an IASME-licensed certification body, and the ongoing management of your certification, renewal after renewal.
Micro
1 to 9 employees
£375
per month, ex VAT
Smallest audit sample; often a single day of assessment.
Start hereMedium
50 to 249 employees
£820
per month, ex VAT
Larger device sample and more evidence gathering.
Start hereLarge
250+ employees
£1,125
per month, ex VAT
Scoped on the discovery call; multi-site estates welcome.
Start hereEvery band is a fixed monthly price for a standard estate in that size range; unusually complex environments are scoped on the discovery call before anything is agreed. Prices exclude VAT and there is no separate bill when recertification comes round.
The question nobody prices
What happens to your money if you fail
A failed Plus assessment is not a refund event anywhere in this market: assessor time is spent whether you pass or not, and a fresh assessment means paying again. That is the real financial risk in Cyber Essentials Plus, and it is why cheap, audit-only quotes can end up the expensive option.
Our answer is structural: the gap analysis runs the audit's own checks first, and we do not put you in front of the assessor until they pass. The fix list gets closed before the audit is booked, not after it is failed.
Included in every band
- Ongoing management of your certification: renewal dates tracked, controls kept pass-ready between audits, and the annual recertification run for you
- Readiness gap analysis against the full assessment scope
- Remediation support until the checks pass
- The basic Cyber Essentials self-assessment, completed with you
- The independent Plus audit by an IASME-licensed certification body
- Audit-day support while your devices are tested
- A post-certification roadmap for what the scheme does not cover
Scoping
What determines your price
Company size and device sample
The audit tests a sample of your devices, and the sample grows with your headcount. Size bands exist because assessor time scales with them.
How much needs fixing first
If patching, MFA and configuration are already tight, readiness is quick. If not, remediation time is the real variable, and we quote it after the gap analysis.
Whether you hold basic Cyber Essentials
Plus requires the basic self-assessment first, and the audit must happen within three months of it. If yours is current, that cost drops out.
Estate complexity
Servers, BYOD phones and tablets, multiple offices and remote workers are all in scope for the scheme and shape the assessment effort.
Client results
What our clients say
"The University was able to secure a multi-million pound cyber security investment as a result of the cyber roadmap work we did."
Danielle Cairns Cyber Risk & Assurance Manager, University of Glasgow "Within 7 months Pactio achieved both ISO and SOC2 compliance, as well as reduced overall cyber risk."
Sophie Fallen Operations Lead, Pactio "Their new ISO 27001 and Cyber Essentials Plus certifications won them more public sector work."
Tom Bennett CTO, FreshWave "A reduced attack surface through consolidation of IT and compliance with GDPR and Cyber Essentials."
Chris Bayley CTO, Audley Travel "PureMalt were able to weigh up different strategic options and make an appropriate investment in cyber security."
Ross Turner Managing Director, PureMalt "Ozone utilised their new capabilities to market to larger clients, whilst expanding into new markets."
Scott Switzer CTO, The Ozone Project Sense-check us
How this compares with the market
UK providers who publish Cyber Essentials Plus pricing typically charge between roughly £1,200 and £4,250 excluding VAT as a one-off project, with support and readiness work sometimes included and sometimes charged on top, and the whole exercise quoted again at renewal. Ours is deliberately a different shape: a monthly price that includes the ongoing management of your certification, so compare the full year and what happens at recertification, not just the sticker. And watch for the quiet extras either way: separate gap analysis fees, per-day remediation rates, fast-track surcharges and retest fees.
If you are still deciding between levels, our Cyber Essentials vs Plus comparison covers which contracts, tenders and insurers require the audited level, and the process page shows where the time goes.
Get your number
Get your monthly figure, certification managed
A 45 minute discovery call is enough to confirm your size band, check whether your basic certificate is current and give you one firm monthly figure that keeps you certified year after year.