Cyber Essentials is a UK government-backed certification that confirms your business has the basic technical controls in place to defend against common internet-based attacks. It's increasingly required for public sector work, cyber insurance, and enterprise supply chains.
Fees are set by IASME and vary by organisation size, and Cyber Essentials Plus costs depend on the scope of your estate. Because both fluctuate and the real cost sits in remediation, get in touch for a current, scoped quote rather than budgeting off a blog post.
Here's what actually goes into it.
What is Cyber Essentials?
Cyber Essentials is delivered by IASME on behalf of the National Cyber Security Centre (NCSC). It comes in two levels:
- Cyber Essentials - a self-assessment questionnaire (SAQ) signed off by a director and verified by an assessor.
- Cyber Essentials Plus - everything in the basic scheme, plus a hands-on technical audit of a sample of your devices and cloud services.
It is required for most central government contracts involving personal data or ICT services, and it's increasingly listed as a supplier requirement by NHS trusts, local authorities, professional-services firms and insurers.
What Cyber Essentials costs in the UK
Cyber Essentials basic uses tiered fees published by IASME, priced by organisation size (micro, small, medium, large). Fees are updated periodically - always check the current IASME pricing before budgeting.
Cyber Essentials Plus is priced separately by the certifying body based on the size of your estate and how many devices/cloud services fall in scope. There's no fixed public price.
The certification fee is usually the smaller part of the cost. The real spend sits in remediation - the work needed to bring your environment up to standard before you submit. For most SMEs that's MFA rollout, device enrolment, retiring unsupported kit and tightening admin accounts.
For a scoped price covering certification + remediation + ongoing renewal, contact us.
The 5 technical controls you must pass
The whole scheme is built around five control areas. If any of these are weak, you'll fail - either on the questionnaire or, more painfully, on the Plus audit.
1. Firewalls
Every device that connects to the internet must sit behind a properly configured firewall - the router at the office, and the software firewall on every laptop that works from home. Default admin passwords must be changed and inbound services justified.
2. Secure configuration
Devices and cloud services must be set up to reduce attack surface: no unused accounts, no default passwords, no unnecessary software, and auto-run disabled on removable media.
3. User access control
Standard users must not have admin rights. Admin accounts must only be used for admin tasks. Multi-factor authentication is mandatory for all cloud services and all admin accounts - no exceptions. This single control catches out more SMEs than any other.
4. Malware protection
Every in-scope device must have anti-malware that's active, up to date, and configured to scan on access. Business-grade EDR on managed fleets; approved-app-store restrictions on BYOD phones.
5. Security update management
All operating systems, browsers and applications must be supported by the vendor and patched within 14 days of a critical or high-severity update being released. Anything still running Windows 10 without ESU, or unsupported iOS/Android versions, will fail scope.
The process, step by step
Realistic timeline for a UK SME with 10-50 staff who hasn't been through this before.
Week 0 - Scoping. Decide what's in scope: which staff, which devices, which cloud services. Home workers count. BYOD counts if it accesses corporate email. Getting this wrong is the #1 reason for failed assessments.
Weeks 1-2 - Gap analysis. Walk through the SAQ against your current setup. Most SMEs find 5-15 gaps - usually MFA coverage, unmanaged personal devices, unsupported software, or admin rights on standard user accounts.
Weeks 2-4 - Remediation. Fix the gaps. Roll out MFA, enrol devices, retire out-of-support kit, tighten admin accounts, document a patching policy.
Week 4 - Submit SAQ. A director signs off. Your assessor reviews within a few working days. Clarifications must be responded to within 2 working days.
Certificate issued. Valid for 12 months.
Optional: Cyber Essentials Plus (add 1-3 weeks). The assessor connects remotely to a sample of your devices and cloud accounts, runs authenticated vulnerability scans, tests email/web filtering, and confirms MFA is enforced. Critical or high findings must be remediated before the certificate is issued. Plus must be completed within 3 months of the basic certificate.
Where SMEs actually fail
From what we see across our own client base and the wider West Midlands SME market, the same handful of issues cause almost every failure:
- MFA gaps - enforced for admins but optional for standard users, or exceptions left in place for "the boss's iPad".
- Unsupported operating systems - a couple of Windows 10 machines still on the network, or an old iPad on iOS 15.
- BYOD chaos - staff reading company email on personal phones that aren't managed.
- Local admin rights - historic setups where every user is a local administrator on their laptop.
- Missed patches - no defined patching policy, or third-party apps left months behind.
Fixing these up-front is dramatically cheaper than failing the assessment and paying for a re-submission.
Cyber Essentials or Cyber Essentials Plus?
Cyber Essentials (basic) is usually enough for private-sector supplier requirements, cyber insurance discounts, marketing/trust-mark purposes, and public sector contracts that don't handle personal data.
Cyber Essentials Plus is usually required for central government contracts involving personal or sensitive information, MoD / NHS Digital / Cabinet Office suppliers, or when large corporate customers demand independently verified controls.
If you're not sure which you need, ask the party who told you to get certified - they'll usually specify.
How we help clients pass first time
LeapIT is a Cyber Essentials Plus certified provider and we run readiness projects for SMEs across the West Midlands. Cyber Essentials readiness is a defined cyber security consultancy engagement and follows our published four-step process:
- Scoping call - a free, no-obligation conversation to understand your business, the concern driving the certification and any deadlines from customers, insurers or regulators.
- Assessment - a structured review of your systems, configuration, policies and exposure against the current Cyber Essentials controls, combining technical inspection (Microsoft 365, network, endpoint, identity) with policy and process review.
- Findings report - a written report with prioritised, plain-English recommendations. Each gap includes the risk, the fix, an effort estimate and where it sits on the path to certification.
- Optional ongoing support - if you want us to implement the fixes, handle submission and run annual renewal, we can - but you're under no obligation. The report is yours either way.
Frequently asked questions
How much does Cyber Essentials cost in the UK?
IASME sets the basic certification fee on a tiered scale by organisation size and reviews it periodically. Cyber Essentials Plus is priced by the certifying body based on estate scope. Remediation work is usually the largest cost. Contact us for a scoped quote.
How long does Cyber Essentials take to complete?
Most SMEs complete the basic self-assessment in 2 to 4 weeks from scoping to certificate. Cyber Essentials Plus adds another 1 to 3 weeks for the audit and must be completed within 3 months of the basic certificate.
Is Cyber Essentials mandatory for UK businesses?
Not legally required, but mandatory for many central government contracts and increasingly demanded by cyber insurers, large corporate customers and regulated-sector supply chains.
What's the difference between Cyber Essentials and Cyber Essentials Plus?
Cyber Essentials is a self-assessment signed off by a director. Cyber Essentials Plus adds an independent hands-on audit including authenticated vulnerability scans on a sample of your devices and cloud services.
How often do I need to renew Cyber Essentials?
Annually. Both certificates are valid for 12 months, after which you need a fresh assessment.
Do home workers and personal devices count for Cyber Essentials?
Yes. Any device used to access organisational data is in scope - including home routers, personal laptops used for work, and BYOD phones that receive corporate email. This is the single biggest scoping mistake SMEs make.
Ready to get certified?
If a customer is asking for Cyber Essentials, or you want the security uplift and insurance benefit, the cheapest path is to get scoping right first time.
Book a Cyber Essentials readiness call →
We'll walk your setup with you, tell you exactly what needs to change, and give you a fixed price to certification.
