How much does Cyber Essentials actually cost in 2026?

Current-version note: Applications started from 27 April 2026 use Cyber Essentials requirements v3.3 and the Danzell question set. Budget for any work needed to enable multi-factor authentication on cloud services where MFA is available.

That range surprises people, because most pricing pages only quote the first number.

The three costs everyone conflates

Ask five IT providers “how much does Cyber Essentials cost?” and you’ll get five different answers, because the question actually has three separate answers hiding inside it:

1. The certification fee. What you pay IASME (or one of its licensed Certification Bodies) to actually review and issue your certificate. This is fixed, published, and non-negotiable.
2. The preparation cost. What it costs to find out where your gaps are and get ready before you submit. This part is unregulated: you can pay a consultant, do it yourself with a checklist, or use a tool. Nobody has to charge you for this step, but almost everyone does.
3. The remediation cost. What it actually costs to fix whatever the gap analysis finds (a proper firewall, MFA licensing, endpoint protection, and so on). This varies by business and isn’t something any assessment, free or paid, can eliminate, only reveal accurately.

Most “Cyber Essentials cost” articles quote only #1. The real spend is usually #1 and #2 together, and #2 is the part almost nobody prices transparently.

What the certification fee actually is

Cyber Essentials is a UK Government-backed scheme created by the National Cyber Security Centre (NCSC) and delivered through IASME, the NCSC’s official Cyber Essentials Delivery Partner. IASME licenses a network of Certification Bodies across the UK to carry out assessments.

IASME publishes its certification fee in four size bands:

This fee covers the self-assessment questionnaire review and one year of certification. UK organisations with turnover under £20 million also get Cyber Liability Insurance included. It also includes one free resubmission if you don’t pass first time; after that, a failed attempt means paying the fee again.

Individual Certification Bodies can add their own margin on top of IASME’s base fee, so it’s worth asking directly what’s included before you book.

Cyber Essentials Plus costs more, for a real reason

Cyber Essentials Plus adds an external technical audit: an assessor actually tests your systems (vulnerability scanning, sampled device checks) rather than relying on your self-reported answers. You need standard Cyber Essentials first before you can sit Plus.

Because it requires assessor time on-site or remote, pricing is set per engagement rather than in official fixed bands. Ask an IASME-licensed Certification Body for a quote that states the scope, sampled devices, retest terms and whether standard certification is included.

The hidden cost: getting ready before you apply

Here’s the part that catches most business owners out. IASME’s fee only covers the review. It assumes you already know where you stand. Most businesses don’t, so they pay someone to find out first.

A typical pre-assessment gap analysis from an IT consultancy costs £750–£1,500 for a small business, and can run £500–£2,500+VAT depending on scope. What you’re paying for is usually:

• A consultant’s time (half a day to a full day, at typical UK IT-consultant day rates) reviewing your firewalls, access controls, patching, and malware protection against the five Cyber Essentials control areas
• A written report of what’s missing
• Help drafting the policies and evidence the assessment expects

That’s a legitimate service, and a good consultant catches things a checklist might not. But it’s also the exact step a well-built tool can do for a fraction of the cost, because the five control areas Cyber Essentials assesses are a fixed, published standard, not a moving target that needs bespoke consultancy every time.

This is the specific cost BrightCert exists to replace. Not the £320–£600 certification fee (BrightCert isn’t a Certification Body and doesn’t issue the certificate), but the £750–£1,500 people spend just finding out where they stand before they even apply. BrightCert’s readiness assessment is free to complete, and the full scored gap report, the same kind of findings a consultant’s gap analysis produces, is £99 including VAT with code FOUNDING10 for the first 10 customers, a £100 founding discount from the standard £199 price.

What a realistic first-year budget looks like

For a typical UK small business going for standard Cyber Essentials (not Plus):

Remediation cost is the same either way. Fixing a missing firewall costs what it costs regardless of who found the gap. The difference is in what you pay to find out what needs fixing. Consultant estimates above are illustrative and should be confirmed with a written quote.