Is the IASME fee really the only mandatory cost?

Yes – the fee is the only cost paid to IASME. Everything else (licences, tools, remediation time) is what you spend to actually meet the controls. Most businesses already pay for some of it.

Can I do Cyber Essentials with no extra tooling at all?

If you're already on Microsoft 365 Business Premium or Google Workspace Business and you have under 15 devices, often yes. Above that scale, an MDM and a SaaS audit usually become essential.

How much should I budget for a guided submission?

Fixed-fee guided submissions in the UK typically run £600–£1,200 for a small business. They tend to pay for themselves on first attempt by avoiding a fail and a tooling overspend.

Does the fee cover a resubmission if I fail?

Yes – within the assessor's working window (usually two working days from the first feedback). After that window, a fresh submission and fee apply.

What's the cheapest path to a real CE certificate?

Tighten MFA, leavers process and patching using tools you already pay for, then apply at the correct IASME band. Don't over-buy software in advance.

Hidden Costs of Cyber Essentials: What to Budget For

The fee you see, and the spend you don't

The IASME fee is public and tiered by organisation size. What catches first-time applicants out is everything that sits around it. Most of those costs are sensible to absorb anyway, but they belong in the budget from day one rather than bolted on after a fail.

Where the budget actually goes

1. The assessment fee

£320 + VAT (micro) up to £600 + VAT (250+ staff). See our 2026 cost breakdown for the exact bands.

2. MFA licences for every cloud app

M365 Business Basic and above include MFA at no extra cost. Standalone SaaS tools often don't – the marketing team's email platform, the HR system, the design tool. Either upgrade those plans (typically £3–£8 per user per month each) or move to a single-sign-on tier that covers them all.

3. Patching and inventory tooling

For a fleet under 15 devices you can usually do this with built-in OS update management plus a spreadsheet. Above that, an MDM (Intune, Jamf, Mosyle) is realistic – budget £4–£10 per device per month. See the 14-day patching rule.

4. Remediation time

The most-missed line. Tightening MFA, separating admin accounts, writing a one-page leavers process, finding the missing patches – this is usually 8–20 hours of internal time. Cost it at whatever your hourly rate is.

5. A resubmission, sometimes

Roughly a third of self-led first-time submissions need a fix-and-resubmit. The fee covers a re-test within the assessor's window, but the extra prep is unbudgeted time. What happens if you fail covers the mechanics.

6. Optional: a guided submission

A fixed-fee guided submission (around £600–£1,200 depending on size) usually pays for itself by avoiding 1–2 resubmissions and the licence overspend that comes from over-buying tools "just in case".

A realistic all-in for a 25-person SME

IASME fee (small band): £440 + VAT
MFA licence top-ups: £200–£400 one-off plan adjustment, then ongoing
MDM (year one, partial): £600–£1,200
Internal remediation time (12 hours @ £50): £600
Optional guided submission: £600–£900

That's £2,400–£3,500 in year one if you're starting from a standing start, dropping sharply in year two when most of the tooling is already in place.

Where to save without cutting corners

Audit your SaaS estate first. Cancel the dormant tools before you pay to add MFA to them.
Use Conditional Access (M365 Business Premium) instead of buying a separate MFA layer.
Schedule the assessment after you've tightened the basics, not before.

For the full picture, read our Cyber Essentials overview.