Cyber Essentials cost in 2026

Cyber Essentials costs at a glance

Want a figure for your organisation rather than a range? The cost calculator takes your staff band, device count, sites and cloud services and shows the scheme fee band next to Precursor's price.

What are the IASME scheme fees?

IASME is the NCSC's Delivery Partner for Cyber Essentials. Every Certification Body charges the same scheme fee for a self-assessment, set by the number of employees you declare in A1.3. The bands were verified against the IASME FAQ on 4 November 2026 and match the prices IASME publishes for the 2026 scheme.

The fee covers marking of the Danzell question set by an assessor, the certificate, a listing on the IASME certificate register and, if you are eligible and opt in, the included cyber liability insurance. If your first submission fails, IASME's terms give one free further assessment if you resubmit within 48 hours of the fail notice; if it still fails after that, you reapply and pay the fee again.

Can you get Cyber Essentials funded?

Yes, if you qualify. IASME runs a UK government-funded offer that takes 75% off the Cyber Essentials self-assessment fee. You must register and buy the assessment by 31 March 2027, and you then have the usual six months to complete and submit it.

IASME lists four conditions:

• The organisation is a micro or SME organisation (fewer than 250 employees), so the large band is not covered.
• It is registered in the UK.
• It has not held Cyber Essentials in the last four years, so renewals do not qualify.
• The discount keeps it within the Minimal Financial Assistance limit of £315,000 under the Subsidy Control Act 2022.

You apply by creating an account on IASME's Supplier Assurance Tool, which checks eligibility against your organisation details and certification history before you buy. The discount applies to the scheme fee only. It does not pay for assessor support, a gap analysis or Cyber Essentials Plus. Details are on IASME's funded Cyber Essentials page, checked on 3 November 2026.

What does assessor-supported certification cost?

Precursor is an IASME Cyber Essentials Certification Body. Cyber Essentials with Precursor is from £1,500 + VAT, for every organisation size, with the scheme fee included. The price is fixed after a free 20-minute scoping call, with no open-ended day rates. The difference from going direct is what happens before submission: an assessor reviews every answer against the marking guidance, checks the auto-fail questions (A6.4AUTO-FAIL, A6.5AUTO-FAIL, A7.15AUTO-FAIL, A7.16AUTO-FAIL and A7.17AUTO-FAIL) and the supported-software requirement (A6.3, A6.6), and tells you what to fix before you submit rather than after you fail. If gaps are found, remediation guidance and a re-test are included at no additional cost within a defined window. Typical turnaround is 1 to 2 weeks.

A gap analysis is from £500 + VAT standalone and takes 1 to 3 days. It covers gap identification, remediation guidance and support with the questionnaire, and is recommended for first-time applicants. It is included in the 50 to 250 device Cyber Essentials Plus tier.

These are the prices Precursor publishes on precursorsecurity.com, checked on 4 November 2026. Payment and other terms are fixed in writing with your quote after the scoping call.

What does Cyber Essentials Plus cost?

Cyber Essentials Plus is priced by device count, because the test specification samples by device. Every tier includes everything in Cyber Essentials, the technical audit, a remediation report, a free re-test, the IASME fee and the certificate, and the 50 to 250 device tier adds a pre-assessment gap analysis. Precursor fixes the price after the scoping call.

Plus builds on a Cyber Essentials self-assessment on the same scope, and the audit must be completed within three months of it. With Precursor the self-assessment is inside the Plus price, so a first-time buyer with up to 50 devices budgets from £3,000 + VAT, not two prices. If you already hold Cyber Essentials, the audit can start straight away inside the three-month window. Full detail on the Cyber Essentials Plus cost page and the Cyber Essentials Plus overview.

What changes the price?

• Organisation size. The scheme fee band follows employee count. Nothing else about the self-assessment price changes with size, because the questionnaire is the same 106 questions for everyone.
• Device count and variety. For Plus, the sample grows with the number of devices and the number of different builds, operating systems and server roles.
• Sites. Plus tests are observed at the device. Additional sites mean additional visits or supervised remote sessions.
• Cloud services. Every authentication service is tested for MFA with a normal user and an administrator. Single sign-on reduces this; a dozen separate logins increase it.
• Readiness. Unsupported operating systems, no MFA enforcement and shared administrator accounts are the three findings that turn a one-visit audit into two. A gap analysis is cheaper than a second visit.
• Scope. A whole-organisation scope is simplest to price and is the only scope eligible for the included insurance. A sub-set needs technical verification of the boundary before Plus testing can start.

Going direct or using an assessor?

Going direct is the right answer for an organisation with a competent IT function that already meets the controls and can evidence them. The NCSC Annual Review 2025 cites a 1.1% fail rate from IASME's review of Cyber Essentials in 2024/25, falling for the fourth year running. The NCSC does not break down how many passes followed a re-mark, so read it as a scheme-wide figure, not a guide to your own chances. Paying an assessor is worth it when you are not sure what the questions mean, when a contract deadline leaves no time for a second attempt, or when you need Plus and want the self-assessment answers to survive the audit.

The self-assessment versus using an assessor comparison goes through the decision in more detail.

What does renewal cost?

Certificates last twelve months and renewal is a new assessment at the same scheme fee. There is no renewal discount from IASME. For Cyber Essentials Plus, Precursor states that annual recertification is typically 20 to 30% less than initial certification. What changes is the work: an organisation that kept its device inventory, update compliance and administrator register current spends far less assessor time the second year. A1.9 asks whether the application is a renewal. See the renewal guide for what to check each year.