When a small business owner Googles "how much does Cyber Essentials cost?", they will almost certainly find a headline figure. For a 10–25 person business, IASME's current pricing sets that number at £440 + VAT — or £500 + VAT if you have between 20 and 49 employees.

That headline number is accurate. It is also incomplete.

The true cost of Cyber Essentials for an SME includes preparation work, potential software upgrades, staff time, and ongoing annual renewal. This article breaks down each component so you can plan your budget with confidence, whether you are responding to a supplier questionnaire or protecting a government contract.

What the Certification Fee Actually Covers

Cyber Essentials is a government-backed scheme operated by IASME on behalf of the National Cyber Security Centre. The certification fee is set by IASME and scales with organisation size according to the UK government's standard employee-count brackets:

This is the fee you pay to IASME to run your assessment. For the self-assessment route (the standard level most SMEs choose), the process is straightforward: you download the questionnaire, answer the questions honestly, and submit them to an IASME Assessor who checks your answers against the five technical controls.

The five controls are the same at both Cyber Essentials and Cyber Essentials Plus:

1. Firewalls

2. Secure configuration

3. Access control and user privileges

4. Malware protection

5. Secure set-up and use of security updates

The fee pays for IASME's administration, the Assessor's review, and your certificate if you pass. That is it.

Note that Cyber Essentials Plus, which adds an independent technical audit of your systems, is not priced by IASME. Certification Bodies quote for CE+ individually based on the size and complexity of your network. Multiple CB quotes are typically obtained for you. This is the one component of the pricing structure that cannot be guessed from a published table.

What Most Businesses Underestimate

The certification fee is the easiest part of the cost equation. Where SMEs struggle is with the preparation work that needs to happen before you even open the IASME questionnaire.

Preparation and remediation

Many businesses attempting Cyber Essentials for the first time discover that their current IT setup does not meet the five technical controls. Common gaps we see include:

• Unsupported operating systems still in use on company devices

• Security updates not enforced across all endpoints

• Multiple user accounts with unnecessary administrative privileges

• No malware protection on all internet-connected devices

• Firewalls not configured on internet-facing equipment

Closing these gaps may involve software upgrades, MFA licence, or reviewing device configurations. For a 10–25 person business using Microsoft 365, many of these gaps can be closed using tools already included in your M365 licences — but someone needs to do the work.

That someone is usually the owner or a senior member of staff, unless you have an IT provider who can manage it.

Staff time

IASME itself notes that a prepared organisation can complete the self-assessment questionnaire in about an hour. That figure assumes you know what the answers should be. For a business that has never audited its security posture against the five controls, the preparation — understanding each question, locating evidence, and testing configurations — typically takes considerably longer.

A rough estimate for a 10–25 person business: one person spending between half a day and two full days on preparation, depending on how far behind the starting point is. That is not a fixed cost, but it is real.

Annual renewal

Cyber Essentials certification lasts 12 months. The re-certification process requires you to go through the questionnaire again — not because the scheme expects your security to have deteriorated, but because it requires an annual review. The re-certification fee is the same as the initial fee (£440 + VAT for a small business).

Many businesses underestimate this recurring annual cost and treat their first certification as a one-off expense. It is not.

Cyber Essentials Plus costs

If your clients or a government contract requires Cyber Essentials Plus, the pricing landscape changes. There is no published table. IASME does not set a fixed CE+ fee because the assessment cost depends on the number and complexity of devices that the auditor needs to test.

Expect the total cost of a CE+ certification to be in the region of £1,500–£3,500 + VAT for a business your size, depending on how many devices need to be scanned and tested. Always obtain multiple CB quotes.

Is Cyber Essentials Worth the Investment?

A few pounds above £400 is not a trivial sum for a small business. So the question is not just "can we afford it?" but "is it worth it?"

There are several practical reasons SMEs pursue Cyber Essentials:

• Supplier requirements. Many larger organisations now require Cyber Essentials certification from their suppliers as a condition of contracting. The scale-up of this expectation has been notable.

• Insurance. Some business cyber insurance policies now require or reward Cyber Essentials certification with reduced premiums. Check with your provider.

• Government contracts. Cyber Essentials is required for many central government contracts and an increasing number of local authority procurement processes. The Ministry of Defence requires it throughout the supply chain for any organisation handling defence information.

• Competitive differentiation. When you are bidding against another SME, having certification on file signals that you take security seriously — even if your competitor does not have it.

The investment is rarely about the certificate itself. It is about what that certificate enables: continued access to procurement opportunities, maintained insurance terms, and a defensible position when a customer or insurer asks "tell us how you protect your data."

Understanding Your Cyber Essentials Budget

Let us look at the numbers for a typical small business — say, 15 people, using Microsoft 365, with no existing managed IT provider:

The headline figure of £440 + VAT is the lowest part of this total. For businesses that have never been through the process before, preparation costs are the most unpredictable element — but they are also the ones that create the biggest surprises.

If you already have an IT provider who standardises your estate to a minimum security standard, many of the preparation items may already be addressed. That is one reason to have clarity on your IT security baseline before you start the certification process.

Frequently Asked Questions

How long does it take to get Cyber Essentials certification?

If you have prepared your answers in advance, the self-assessment itself takes roughly an hour. Once submitted, most IASME Assessors aim to return results within three days. If you need to amend answers after an initial failure, you have two working days to make corrections and resubmit at no extra charge. The total process, from start to certificate, typically takes between one and two weeks for a well-prepared business.

Can we do Cyber Essentials ourselves without an IT provider?

Yes. The Cyber Essentials self-assessment route is designed to be completed by the organisation itself. IASME provides a free downloadable questionnaire and a free online Readiness Tool to help you understand where you stand before you pay for an assessment. However, many SMEs choose to work with an IT provider during preparation because identifying and closing gaps across every technical control requires specialist knowledge.

Does Cyber Essentials cover backup and disaster recovery?

No. Cyber Essentials does not assess or require backup arrangements as one of its five technical controls. This is a common point of confusion. Backup strategy, restore testing, and business continuity planning are important elements of an IT security baseline, but they are not part of the Cyber Essentials assessment scope. If you are using Cyber Essentials as your sole security benchmark, you may have gaps that matter.

Can we switch from self-assessment to Cyber Essentials Plus later?

Yes. If you have achieved Cyber Essentials (self-assessment) less than three months before pursuing Cyber Essentials Plus, you will not need to repeat the self-assessment questionnaire stage. The CE+ process starts from the Cyber Essentials questionnaire and adds the independent technical audit.

Does passing Cyber Essentials mean we are protected from cyber attacks?

Cyber Essentials addresses five baseline technical controls. It is a minimum standard recommended by the UK Government — not a comprehensive security framework. A passing certification means you have demonstrable controls in place at a foundational level. It does not mean your organisation is immune to attack, nor does it replace the need for ongoing security monitoring, patch management, and good operational practice.

What Comes Next

Understanding your full Cyber Essentials budget — certification fee, preparation, staff time, and annual renewal — is the first step. The second is knowing where you stand today against the five technical controls.

If you are planning Cyber Essentials certification for your business, or if a supplier requirement has caught you by surprise, a Security Triage Call with Infinite Cloud IT will give you a high-level view of where you stand against the five controls and what steps you need to take before you invest in the certification process itself.

Book a Security Triage Call