Cyber Essentials Cost UK 2026: What You Should Really Pay

The IASME pricing bands (2026)

IASME publishes a single national price list that every licensed Certification Body works from. The 2026 bands are based on the total number of full-time staff in your organisation – not your revenue, not the number of devices, not the size of your IT estate.

• Micro (1–9 staff): £320 + VAT
• Small (10–49 staff): £440 + VAT
• Medium (50–249 staff): £500 + VAT
• Large (250+ staff): £600 + VAT

See our full Cyber Essentials cost page for current published bands.

What "£320 + VAT" actually covers

You get:

• Access to the IASME assessment portal
• Marker review of your submission by a qualified assessor
• The certificate itself (digital + PDF)
• Listing on the public IASME register of certified organisations
• £25,000 of cyber liability insurance (UK-registered SMEs under £20m turnover)
• One free resubmission within 48 hours if you fail the first review

You do not automatically get pre-submission help, evidence review, or someone walking you through the question set. Some Certification Bodies bundle that in, others charge separately.

Where the real cost sits: preparation

The certificate fee is the small number. The honest cost of Cyber Essentials is the internal effort to get your environment ready and answer the question set accurately. For a typical 10–49 person organisation in 2026, expect:

• 4–8 hours of IT/operations time gathering evidence (asset list, MFA settings, patching cadence, account inventory)
• 2–4 hours completing the IASME questionnaire if you have not done it before
• 1–2 hours of director sign-off and final review

That's roughly 1–2 days of effort. If your environment has drift – out-of-support OS, missing MFA, no asset inventory, BYOD with no policy – add another 1–3 days of remediation. This is the bit nobody warns you about, and it's the reason "£320 + VAT" can feel misleading.

Hidden extras to watch for

1. "Pre-assessment" upsells. Some providers quote £320 + VAT then add £400+ for a "readiness review". Ask up front whether pre-check is included.
2. Resubmission fees. One free resubmission is standard. A second resubmission usually costs £100–£200.
3. Time-pressure premiums. Same-day or 24-hour turnaround often costs £150–£300 on top. See our fast Cyber Essentials guide.
4. Cyber Essentials Plus. A separate certification with technical testing. Pricing is £1,400 + VAT. See CE Plus pricing.

Cyber Essentials vs Cyber Essentials Plus pricing

Cyber Essentials is a self-assessment that the Certification Body reviews. Cyber Essentials Plus adds an independent technical audit – external vulnerability scan, internal authenticated scan, and a sample of devices tested. That technical work is why CE Plus is roughly 4–5x the cost of CE alone.

Compare both: Cyber Essentials vs Cyber Essentials Plus.

Is the bundled cyber insurance worth anything?

The £25,000 IASME-bundled cyber liability cover is a real benefit, with three eligibility conditions: you must be UK-registered, under £20m annual turnover, and the certificate must be in your organisation's name (not your IT provider's). For most SMEs this alone offsets a meaningful chunk of the certification fee.

How to budget realistically

If you are scoping for a tender, board paper or project budget, use these line items:

• Certification fee – £320–£600 + VAT depending on size
• Internal preparation effort – 1–3 days of IT/ops time at your blended rate
• Optional pre-check / managed support – £200–£600 + VAT depending on provider
• Optional Cyber Essentials Plus add-on – £1,400 + VAT

For a 10–49 person UK SME, £600–£1,200 all-in for CE alone is a realistic 2026 budget.