Check your readiness
CE Plus · Cost

Cyber Essentials Plus cost in 2026

What Cyber Essentials Plus costs in 2026: Precursor's prices by device count with the self-assessment, the IASME fee and a free re-test included, and what changes the price.

By Precursor Security, an IASME Certification BodyUpdated 22 September 2026
Short answer

Cyber Essentials Plus costs from £3,000 for up to 50 devices, from £4,500 for 50 to 250 devices, and from £5,000 for more than 250 devices, + VAT. The price covers the Cyber Essentials self-assessment Plus builds on, the audit, a remediation report, a free re-test and the IASME fee.

Key facts
Up to 50 devices
From £3,000
50 to 250 devices
From £4,500
250+ devices
From £5,000
Included
Everything in Cyber Essentials, scoping call, technical audit, remediation report, free re-test within 90 days, IASME fee, certificate
Gap analysis
Included in the 50 to 250 device tier; otherwise from £500 + VAT
Turnaround
2 to 3 weeks (up to 50 devices), 2 to 4 weeks (50 to 250 devices), 3 to 5 weeks (250+ devices)

How much does Cyber Essentials Plus cost?

Precursor prices Cyber Essentials Plus by device count, because the test specification samples by device: the sample grows with the number and variety of devices, and so does assessor time. These are the tiers Precursor publishes, + VAT, and the scoping call fixes the price in writing before work starts. The Cyber Essentials self-assessment is included, so up to 50 devices costs from £3,000 in total.

Up to 50 devices, single site

From £3,000

External vulnerability scan, Configuration review, Remediation report, Free re-test. 2 to 3 weeks

50 to 250 devices, 2 to 3 sites

From £4,500

External and internal scanning, Multi-site audit, Gap analysis included, Free re-test. 2 to 4 weeks

250+ devices, multi-site and cloud

From £5,000

Cloud services scoping, Full estate audit, Dedicated assessor, Free re-test. 3 to 5 weeks

Devices in scopeCyber Essentials PlusWhat is included
Self-assessmentIncludedEverything in Cyber Essentials is part of the Plus price
Gap analysisIncluded in the 50 to 250 device tier; from £500 standaloneGap identification and remediation guidance before the audit

What changes the price?

  • Device count and variety. Ten identical managed laptops sample smaller than ten hand-built ones. Extra builds, operating systems and server roles each add to the sample.
  • Sites. Test 3 and Test 5 are observed at the device, so additional sites mean additional visits or supervised remote sessions.
  • Cloud services and authentication services. Every authentication service is tested once with a normal user and an administrator; a dozen SaaS apps with separate logins take longer than a dozen behind single sign-on.
  • Public addresses. Test 1 scans every IP address and IaaS instance, and more addresses take more scanning and review time.
  • Whether the self-assessment is in place. Plus needs a Cyber Essentials certificate on the same scope issued within the last three months; if yours is older, it has to be renewed first.
  • Readiness. Precursor's re-test is free, but under the 2026 rule a retest after an update management fail adds a new random sample, so an estate that has not done the preparation work risks failing it. A gap analysis (included in the 50 to 250 device tier) finds those issues before the audit.

Is there a separate IASME fee for Plus?

The IASME scheme fee bands published for self-assessment are £320 (0 to 9 staff), £440 (10 to 49 staff), £500 (50 to 249 staff), £600 (250+ staff), ex VAT, verified 4 November 2026. Certification Bodies pay IASME for each Plus certificate they issue and build that into their price. Precursor's Plus prices include the IASME fee and the Cyber Essentials self-assessment, so there is nothing to pay IASME separately.

How does Plus compare with the self-assessment?

The self-assessment is a marked questionnaire; Plus is a technical audit of the same scope by an assessor. The self-assessment is a prerequisite; with Precursor it is inside the Plus price. Both certificates are renewed every year, and because the Plus audit must follow within three months of a Cyber Essentials certification, the two are renewed together.

Cyber EssentialsCyber Essentials Plus
What it isSelf-assessment questionnaire marked by an assessorTechnical audit on a sample of devices and cloud accounts
Precursor priceFrom £1,500 + VAT, IASME fee includedFrom £3,000 + VAT by device count, Cyber Essentials included
Scheme fee if you go direct£320 to £600 ex VAT by staff bandSet by the Certification Body
Turnaround1 to 2 weeks2 to 5 weeks
If you failOne free resubmission within 48 hours of the fail notice (IASME terms). Precursor: re-test at no additional cost30 days to remediate (IASME). Precursor re-tests at no additional cost within 90 days; a second update management fail revokes the self-assessment certificate (2026 rule)
Validity12 months from the date of issue (IASME terms)12 months; renewed with a new self-assessment and audit

How do assessors check this?

How assessors check this
A fixed price only holds if the scope on the scoping call matches the scope on the day. The assessor must verify the scope against the self-assessment certificate before testing, so undeclared devices, sites or cloud services either delay the audit or change the sample. Bring the inventory to the scoping call.
Common failure: Booking Plus after the window closed
An organisation certifies the self-assessment in January, budgets Plus for the next financial year, and books the audit in May. The three-month window has passed, so the self-assessment has to be certified again before the audit, at additional cost and time. Fix: book the Plus audit before submitting the self-assessment, so the audit lands inside the window.

Related pages

Frequently asked questions

Yes. Precursor's Cyber Essentials and Cyber Essentials Plus prices both include the IASME certification fee. There is nothing to pay IASME separately.

Yes. Precursor's Cyber Essentials Plus price includes everything in Cyber Essentials, so a first-time buyer budgets one price, not two.

Yes. If the audit finds failures, Precursor re-tests after remediation at no additional cost within 90 days. Where the fail is on update management, IASME's 2026 rule means the retest covers the original sample plus a new random sample, so remediation should cover the whole estate.

Yes. Cyber Essentials Plus requires a valid Cyber Essentials self-assessment certificate on the same scope, and the Plus audit must be completed within three months of it.

If you hold a Cyber Essentials certificate issued less than three months ago on the scope you want to test, IASME says you do not repeat the self-assessment questions stage, and the audit can start straight away.

Every end user device, server, virtual host and IaaS instance in scope, as declared in A2.6 to A2.8 of the self-assessment. Phones and tablets that reach organisational data count.

The tiers are the starting prices Precursor publishes. The scoping call confirms your device count, sites and cloud services, and you get a fixed-price quote in writing within 48 hours, with no day-rate surprises. Annual recertification is typically 20 to 30% less than initial certification.

Cyber Essentials Plus

Ready for the technical audit?

A 20-minute scoping call with an IASME-accredited assessor fixes your scope and device sample, then you get a written price from £3,000 + VAT within 48 hours and testing booked inside your three-month window.

Book a scoping callSee what the audit tests
  • IASME Certification Body
  • CREST accredited
  • UK offices in Leeds, Newcastle, London and Edinburgh
Sources