Cyber Essentials Plus cost in 2026: what actually drives the quote
By Muhammad Sohaib Roomi, founder and reviewer at BrightCertPublished Reviewed
Part of our what actually happens in a Cyber Essentials Plus audit
Short answer
Unlike standard Cyber Essentials, Cyber Essentials Plus has no official fee band. Standard certification is fixed at £320–£600 by employee count. Plus adds an independent technical audit, and because the audit effort depends on how many devices, sites and cloud services are in scope, the Certification Body carrying it out quotes it per organisation — there is no published price list to look up.
That answer disappoints people searching for a number, so this guide gives the next best thing: what a quote actually reacts to, so you can predict roughly where you’ll land and tell a thin quote from a proper one.
The part that is fixed: standard Cyber Essentials
Cyber Essentials Plus is always sat on top of standard Cyber Essentials, which does have a published, official fee — set by IASME and banded by employee count:
| Organisation size | Employees | IASME assessment fee |
|---|---|---|
| Micro | 0–9 | £320 |
| Small | 10–49 | £440 |
| Medium | 50–249 | £500 |
| Large | 250+ | £600 |
Full detail on what this fee covers, and the wider budget picture, is in the Cyber Essentials cost guide. This is the one number in the whole process that is genuinely fixed and comparable between providers. Everything below is the part that isn’t.
Why Plus is quoted, not banded
Standard Cyber Essentials reviews your answers to a questionnaire — roughly the same amount of assessor effort whether you have 8 employees or 45, which is why it fits into four simple bands. Plus sends an assessor to test a sample of your actual devices and cloud accounts, and that sample’s size and variety is different for every organisation. A single-site business on one standardised laptop image is a smaller, faster audit than a multi-site business running three operating systems, a dozen cloud services and a remote workforce — so a single official band would either overcharge the first or undercharge the second.
That’s also why Cyber Essentials vs Cyber Essentials Plus is the right place to decide whether you need Plus at all before pricing it, and the audit walkthrough explains exactly what that sample is tested against.
What actually moves the quote
Six things a Certification Body’s quote reacts to, so you can talk to them about your own situation rather than a generic range.
| Cost driver | Tends to lower the quote | Tends to raise the quote |
|---|---|---|
| Number of devices in scope | A small, standardised estate — one build, one operating system. | More devices to sample, or a device count large enough to require a bigger statistical sample. |
| Variety of operating systems and device types | Everyone on the same OS and device type. | Every extra OS or device type in scope pulls its own representative into the sample. |
| Number of sites | A single site, or fully remote delivery agreed with the assessor. | Multiple sites can mean travel cost, extra scheduling, or a larger combined sample. |
| Cloud services in scope | Few services, each with a standard and administrative account easy to test. | Every additional in-scope service needs its own accounts tested — a forgotten subscription found late adds work, not savings. |
| Remote and hybrid workers | A mostly office-based estate on managed devices. | Remote and BYOD devices still have to be sampled and are often harder to schedule and access. |
| How ready the estate actually is | An internal dry run already closed the gaps a self-assessment can hide. | Unsupported software, missing patches, or MFA gaps found on the day cause remediation and a retest, not just a delay. |
The last row is the one preparation actually controls. The four-week preparation guide covers finding those gaps before the audit rather than during it, which is the difference between paying for the quote once and paying for a retest as well.
What a proper quote should state
Before accepting a Cyber Essentials Plus quote, check it actually says:
- The exact scope it’s priced against — sites, device count and types, cloud services, remote workers. A quote with no stated scope can move once yours is properly understood.
- How the device sample was sized.This should follow IASME’s own sampling method, not an arbitrary number.
- Remote versus on-site delivery. This affects travel cost and scheduling, not the difficulty of the test cases themselves.
- Retest terms. What happens, and what it costs, if a test case fails and has to be repeated.
- Whether standard Cyber Essentials certification is included, or billed as a separate line alongside the fixed IASME fee above.
A quote missing any of these isn’t necessarily wrong, but it isn’t yet comparable to another one — ask for the gap before assuming the cheaper number is the better deal.
Why this guide won’t give you a single number
Some pages quote a specific Cyber Essentials Plus price as though it were an official fee, the way the £320–£600 standard band is. There is no such official Plus fee to quote, so any figure presented that way is either a specific Certification Body’s own pricing, generalised further than it should be, or simply made up. If you see a firm number elsewhere, it’s worth asking whose price it actually is and against what scope, using the checklist above.
Want the gaps found before you request a quote? Three quick questions, no signup needed.
User Access Control
Question 1 of 3
Does everyone in your business have their own login account?
Takes 30 seconds. No signup needed.
Frequently asked questions
Does Cyber Essentials Plus have a fixed price like standard Cyber Essentials?
No. Standard Cyber Essentials uses four official IASME fee bands from £320 to £600, based on employee count. Cyber Essentials Plus has no equivalent official band — the audit is quoted per organisation by the Certification Body carrying it out, based on scope and complexity.
What determines how much a Cyber Essentials Plus audit costs?
Mainly the size and variety of the device sample the assessor has to test: how many devices and operating systems are in scope, how many sites, how many cloud services need a standard and administrative account tested, and how many remote or hybrid workers are included. A larger, more varied estate needs a larger sample, which takes more assessor time.
Do you pay for Cyber Essentials and Cyber Essentials Plus separately?
Yes. Standard Cyber Essentials certification (the fixed £320–£600 band) has to be achieved first. Cyber Essentials Plus is then a separate engagement with its own separate quote from a Certification Body.
What should a Cyber Essentials Plus quote actually include?
Ask for the exact scope it's priced against, how the device sample was sized, whether remote or on-site delivery is assumed, the retest terms if something fails, and whether standard Cyber Essentials certification is included or billed separately. A quote that doesn't state its scope can't be compared to another one.
Can preparation reduce what a Cyber Essentials Plus audit costs?
Preparation doesn't change the assessor's day rate, but it changes what happens on the day. Gaps found during an internal dry run get fixed before the audit for the cost of fixing them; gaps found during the audit itself can mean a failed test case and a retest, which is a second cost on top of the first quote.
Does BrightCert quote or carry out Cyber Essentials Plus audits?
No. BrightCert is a readiness assessment covering the same five control areas Cyber Essentials Plus tests, so gaps are found and fixed before you request a quote. The audit itself, and any price for it, comes from an IASME-licensed Certification Body.
Find the gaps across the same five control areas a Plus audit tests, before you request a quote.
Start your assessmentBrightCert helps UK businesses prepare for Cyber Essentials by assessing readiness, identifying gaps, and producing a practical report. BrightCert does not issue the official Cyber Essentials certificate. That comes from an IASME-licensed Certification Body.
Sources: BrightCert prepares organisations for Cyber Essentials and Cyber Essentials Plus; it does not carry out the Plus audit, quote for it, or issue any certificate. Both belong to an IASME-licensed Certification Body. NCSC: Cyber Essentials overview · IASME: Cyber Essentials pricing FAQ · NCSC: Cyber Essentials resources. IASME published fee bands verified 20 August 2026.