Cyber Essentials Plus Cost UK: What Affects the Price

Why CE Plus costs more than CE

Basic Cyber Essentials is a self-assessment that an assessor reviews. Cyber Essentials Plus adds an independent technical audit – the assessor actually tests your environment. That extra work is why CE Plus typically costs 4–5x what CE alone costs.

The technical audit covers:

• External vulnerability scan of your internet-facing IPs
• Authenticated internal scan from a sample of user devices
• Email and web-browser malware checks (downloading EICAR-style test files)
• MFA verification on cloud admin and standard accounts
• Patch status checks against the 14-day rule

What drives the price

1. Device sample size

Assessors test a representative sample of devices – not every laptop. The sample size is set by IASME's sampling table and grows with your total device count. A 5-person team with 6 devices is much faster to test than a 50-person team with 80 devices, mixed OS and BYOD.

2. Cloud service sprawl

Each cloud service in scope (Microsoft 365, Google Workspace, AWS, Azure, Salesforce, etc.) adds checking time. The assessor must verify MFA, account inventory and admin controls on each one. Five cloud services takes longer than one.

3. BYOD

Personal devices used for work email or business apps are in scope and must be sampled. BYOD adds coordination overhead and complexity – many assessors quote a higher day rate when BYOD is in scope.

4. Onsite vs remote

Most CE Plus testing is done remotely in 2026 using a screen-share session and a small assessor toolkit installed temporarily. Onsite visits add travel time and cost – usually £400–£800 extra depending on location.

5. Operating system mix

Pure Windows or pure macOS estates test faster. Mixed estates with Linux, ChromeOS or kiosk devices add testing time.

Our 2026 CE Plus prices

• Micro (1–9 staff): £1,400 + VAT
• Small (10–49 staff): £1,500 + VAT
• Medium (50–249 staff): £1,650 + VAT
• Large (250+ staff): £2,000 + VAT

Unusually complex scopes – heavy BYOD, several locations or an onsite visit – are confirmed in writing before any work starts.

What's included in a typical CE Plus quote

• Pre-engagement scoping call
• External vulnerability scan
• Remote authenticated scan + EICAR tests on the device sample
• Cloud configuration review
• Findings report and remediation guidance
• One free retest of failed items within 30 days
• The CE Plus certificate and IASME register listing

Common CE Plus pricing mistakes

1. Quoting before scoping. A genuine CE Plus quote needs device count, cloud services, BYOD position and OS mix. Anyone quoting a flat number sight-unseen is guessing.
2. Hidden retest fees. One free retest is standard. Subsequent retests typically cost £200–£400.
3. "Sample of one" claims. Some providers under-sample to keep prices low. The IASME sampling table is mandatory – under-sampling will be challenged at audit.

Should you do CE first, then CE Plus?

Yes. CE Plus inherits the basic CE controls and adds technical verification. Doing basic CE first lets you fix gaps cheaply, then book CE Plus once you know the environment is clean. Most clients run them within 30–90 days of each other. See CE vs CE Plus.