Transparent pricing
What Cyber Essentials and Cyber Essentials Plus actually cost
Both levels, priced in the open: the official IASME tiers for the basic self-assessment, and our published bands for Cyber Essentials Plus including readiness support and the independent audit. You should be able to budget before you ever speak to us.
Level one
Basic Cyber Essentials: the official price
The basic self-assessment is priced by IASME, the scheme's delivery partner, in four size tiers. Nobody should charge you more for the assessment itself; what varies is the help you get answering it accurately. Ours is included in every Plus engagement, or available on its own with our basic Cyber Essentials support.
| Company size | Employees | Official assessment price |
|---|---|---|
| Micro | 1 to 9 employees | £320 + VAT |
| Small | 10 to 49 employees | £440 + VAT |
| Medium | 50 to 249 employees | £500 + VAT |
| Large | 250+ employees | £600 + VAT |
Source: IASME's published Cyber Essentials assessment pricing, correct as at July 2026. The certificate lasts twelve months at either level.
Level two
Cyber Essentials Plus, priced by company size
One figure per band, covering the readiness gap analysis, hands-on remediation support, the basic self-assessment if you need it, and the independent Plus audit carried out by an IASME-licensed certification body.
Micro
1 to 9 employees
REPLACE_WITH_PRICE_MICRO
Smallest audit sample; often a single day of assessment.
Start hereMedium
50 to 249 employees
REPLACE_WITH_PRICE_MEDIUM
Larger device sample and more evidence gathering.
Start hereLarge
250+ employees
REPLACE_WITH_PRICE_LARGE
Scoped on the discovery call; multi-site estates welcome.
Start hereEvery band is a fixed price for a standard estate in that size range; unusually complex environments are scoped on the discovery call before anything is agreed. Prices exclude VAT.
The question nobody prices
What happens to your money if you fail
A failed Plus assessment is not a refund event anywhere in this market: assessor time is spent whether you pass or not, and a fresh assessment means paying again. That is the real financial risk in Cyber Essentials Plus, and it is why cheap, audit-only quotes can end up the expensive option.
Our answer is structural: the gap analysis runs the audit's own checks first, and we do not put you in front of the assessor until they pass. The fix list gets closed before the audit is booked, not after it is failed.
Included in every band
- Readiness gap analysis against the full assessment scope
- Remediation support until the checks pass
- The basic Cyber Essentials self-assessment, completed with you
- The independent Plus audit by an IASME-licensed certification body
- Audit-day support while your devices are tested
- A post-certification roadmap for what the scheme does not cover
Scoping
What determines your price
Company size and device sample
The audit tests a sample of your devices, and the sample grows with your headcount. Size bands exist because assessor time scales with them.
How much needs fixing first
If patching, MFA and configuration are already tight, readiness is quick. If not, remediation time is the real variable, and we quote it after the gap analysis.
Whether you hold basic Cyber Essentials
Plus requires the basic self-assessment first, and the audit must happen within three months of it. If yours is current, that cost drops out.
Estate complexity
Servers, BYOD phones and tablets, multiple offices and remote workers are all in scope for the scheme and shape the assessment effort.
Client results
What our clients say
"The University was able to secure a multi-million pound cyber security investment as a result of the cyber roadmap work we did."
Danielle Cairns Cyber Risk & Assurance Manager, University of Glasgow "Within 7 months Pactio achieved both ISO and SOC2 compliance, as well as reduced overall cyber risk."
Sophie Fallen Operations Lead, Pactio "Their new ISO 27001 and Cyber Essentials Plus certifications won them more public sector work."
Tom Bennett CTO, FreshWave "A reduced attack surface through consolidation of IT and compliance with GDPR and Cyber Essentials."
Chris Bayley CTO, Audley Travel "PureMalt were able to weigh up different strategic options and make an appropriate investment in cyber security."
Ross Turner Managing Director, PureMalt "Ozone utilised their new capabilities to market to larger clients, whilst expanding into new markets."
Scott Switzer CTO, The Ozone Project Sense-check us
How this compares with the market
UK providers who publish Cyber Essentials Plus pricing typically charge between roughly £1,200 and £4,250 excluding VAT depending on company size, with support and readiness work sometimes included and sometimes charged on top. Watch for the quiet extras: separate gap analysis fees, per-day remediation rates, fast-track surcharges and retest fees. When you compare quotes, compare what happens if the first assessment does not pass.
If you are still deciding between levels, our Cyber Essentials vs Plus comparison covers which contracts, tenders and insurers require the audited level, and the process page shows where the time goes.
Get your number
Get a fixed price for your certification
A 45 minute discovery call is enough to confirm your size band, check whether your basic certificate is current and give you one firm figure.