SimplISO › Cyber Essentials Plus cost
Straight answers, no quote formCheaper than ISO 27001, faster than ISO 27001, and for a lot of businesses it is the thing their customer actually wanted. It is also annual rather than every three years, which changes the comparison more than people expect.
Written for UK businesses. Last updated 22 September 2026.
For a UK business under ten people, Cyber Essentials and Cyber Essentials Plus together come to about £1,500 to £2,300 plus VAT.
That is a fixed £320 for the self assessment, which is set by IASME and published, plus a quoted audit fee of roughly £1,200 to £2,000 for the Plus part.
Both certificates last 12 months, not three years, so treat that as an annual cost rather than a one off.
Almost every confusing quote you will read comes from blurring these together. They are sold together, they are usually bought together, but they are not the same thing.
A self assessment questionnaire. You answer it, a certification body reviews the answers, you get a certificate. The fee is fixed by IASME and published, so nobody can mark it up. For a business under ten people it is £320 plus VAT.
The same five controls, but an assessor checks them rather than taking your word for it. They sample your devices, run vulnerability scans and test the controls hands on. IASME publishes no fixed price for this, so the certification body quotes it.
You cannot buy Plus on its own. You pass the self assessment first, then you have a three month window to complete the Plus audit. Do the audit inside three months of certifying and you do not have to answer the questionnaire again.
The self assessment fee is public and fixed by organisation size. The Plus audit is quoted, and that is where the spread comes from.
| Organisation size | Cyber Essentials | Plus audit | Both |
|---|---|---|---|
| Under 10 people | £320 | £1,200 to £2,000 | £1,500 to £2,300 |
| 10 to 49 people | £440 | £1,500 to £2,500 | £1,900 to £2,900 |
| 50 to 249 people | £500 | £2,200 to £3,500 | £2,700 to £4,000 |
| 250 people and over | £600 | £3,500 upwards | £4,100 upwards |
Getting the controls into a state that will actually pass. Across the industry, preparation and remediation runs somewhere between £500 and £3,000 depending on what the first look turns up, and it is comfortably the largest unbudgeted line in most Cyber Essentials projects.
Common culprits are an old laptop nobody has patched, a router still on its factory password, staff sharing a login, and multi factor authentication switched on for some people but not all. None of them is expensive to fix. All of them will fail you if you walk into the audit cold.
This is the biggest structural difference between Cyber Essentials and the ISO standards, and the one that catches people out when they compare prices.
That is not an argument against it. It is an argument for comparing three years against three years when you are deciding where the money goes.
The question set is revised roughly every year. The current one is called Danzell, Requirements for IT Infrastructure version 3.3, and it took effect on 27 April 2026. Two changes matter more than the rest.
If you certified before April 2026 and have not looked at it since, these two are worth checking before you book anything. They are the most common reason a renewal that should have been routine turns into remediation work.
The five controls themselves have not changed: firewalls, secure configuration, security update management, user access control and malware protection.
The question we are asked most often, usually by somebody holding a customer security questionnaire and wondering which box they are being asked to tick.
| Cyber Essentials Plus | ISO 27001 | |
|---|---|---|
| What it is | Five technical controls, checked hands on | A management system, plus 93 Annex A controls |
| What gets audited | A sample of your devices | How you run the business, then the controls |
| How long it takes | Days to a few weeks | Months |
| How long it lasts | 12 months, then do it again | 3 years, with a surveillance audit each year |
| Cost | £1,500 to £2,300 a year | £4,100 year one, £3,500 a year after |
They are not competitors and they are not versions of each other. Cyber Essentials Plus proves your technology is configured sensibly. ISO 27001 proves your business is run in a way that keeps it that way, which is a much bigger claim and a much bigger job.
We would rather spend twenty minutes reading your customer's wording with you than sell you the bigger certificate. If Cyber Essentials Plus covers it, that is thousands of pounds you keep.
Certifying the whole organisation to Cyber Essentials includes £25,000 of cyber liability insurance, at no extra cost, for UK businesses with turnover under £20 million.
It is not a substitute for a proper policy if you handle serious volumes of data, and there are conditions, so read them. But for a business under ten people it takes a real chunk out of the effective cost, and a lot of certification bodies never bring it up.
To qualify you have to certify the whole organisation rather than carving out one part of it. That is worth knowing before you define your scope, because a narrow scope that saves you a little on the audit can cost you the insurance.
For a UK business under ten people, budget about £1,500 to £2,300 plus VAT. That is the fixed IASME self assessment fee of £320, which you have to pass first, plus the Plus audit at somewhere between £1,200 and £2,000 depending on the certification body. The audit fee is quoted rather than fixed, so it is worth getting two or three.
No, and this is the thing that catches people out when they compare it to ISO. Both Cyber Essentials and Cyber Essentials Plus expire after 12 months, and there is no cheaper surveillance year. You repeat the whole exercise annually at close to full price, so £1,800 a year is £5,400 over three years.
Yes. You pass the self assessment first, then you have a three month window to complete the Plus audit. If you do the audit within three months of certifying you will not have to answer the questionnaire again, so it makes sense to book them close together.
Sometimes, and it is always worth asking. A good number of security questionnaires and tenders name ISO 27001 because somebody wrote the form years ago, and the buyer will accept Cyber Essentials Plus once you ask. If the wording is specific and they confirm they mean it, nothing smaller will do, but the question costs you nothing and can save you several thousand pounds.
The question set in force from 27 April 2026 is called Danzell, Requirements for IT Infrastructure version 3.3. The two changes that matter most are that multi factor authentication is now mandatory for all users rather than just administrators, and that failing to patch high risk or critical updates within 14 days is an automatic fail. If you certified before April 2026, check both before you book a renewal.
Certifying the whole organisation includes £25,000 of cyber liability insurance at no extra cost for UK businesses with turnover under £20 million. There are conditions attached so read them, and note that you have to certify the whole organisation rather than one part of it, which is worth knowing before you decide your scope.
Twenty minutes on a call and we will tell you what your certification body will charge, what the extra work looks like and whether you need UKAS at all.
Same treatment, real numbers, no quote form.