The official IASME fee bands, what Cyber Essentials Plus adds on top, and what really drives the total higher, sourced from the scheme's own published pricing rather than a single provider's quote.
"Cyber Essentials cost" usually means one of two different things, and they're priced completely differently.
A fixed certification fee set by IASME, the scheme owner, banded by organisation size. This covers the self-assessment questionnaire being reviewed and, if you pass, your certificate being issued. It's the same fee whether your environment is simple or complex.
The base certification fee, plus a separate, variable audit fee for a Certification Body to independently test a sample of your devices and accounts on site or remotely. This is where most of the cost variation actually comes from.
IASME, the scheme's National Cyber Security Centre-appointed partner, sets four indicative fee bands by employee count. Certification Bodies are permitted to charge above these rates, so treat them as a floor, not a fixed price.
| Organisation Size | Indicative Fee (+ VAT) |
|---|---|
| Micro: 0-9 employees | £300 |
| Small: 10-49 employees | £400 |
| Medium: 50-249 employees | £450 |
| Large: 250+ employees | £500 |
These fees cover 12 months of unlimited self-assessment attempts. For UK organisations with turnover under £20 million, they also currently bundle a period of cyber liability insurance, worth checking directly with IASME since terms can change.
CE+ audits are typically quoted anywhere from around £1,400 to £4,000+ VAT. The spread almost entirely comes down to these four factors.
The assessor tests a representative sample of your in-scope devices and user accounts. More devices and accounts means a bigger sample, which means more assessor time.
A single-OS estate is quicker to test than a mixed Windows, macOS and Linux environment, since each platform needs its own configuration checks.
Personal or unmanaged devices used for work add complexity to scoping and testing, and often surface gaps that need fixing before the audit can pass first time.
Cloud platforms holding company data or providing remote access fall inside Cyber Essentials' scope and need their own configuration checks, on top of your physical device estate.
The IASME fee and the CE+ audit fee only cover the assessment itself. Most organisations also spend time and, often, money closing gaps before they can pass: patching unsupported software, tightening admin rights, fixing firewall configuration, or replacing devices that can't meet the current control requirements.
None of that remediation cost is fixed or predictable from a price list, because it depends entirely on how far your current setup is from the five Cyber Essentials controls before you start. It's the main reason quotes for "the same" certification can look so different between two businesses of a similar size.
We don't charge the IASME certification fee or the CE+ audit fee, those go directly to IASME and your chosen Certification Body. What we provide is the policy documentation, asset register and evidence pack a Cyber Essentials assessment expects to see, built from your real answers rather than a generic template.
A complete, ready-to-show policy pack, asset register and evidence set, so the certification fee and audit are the only surprises left.