Cyber Essentials cost and timeline are driven by organisation size, the scope you declare, which of the two levels you choose, and how much remediation you need before you apply. The NCSC lists a starting price for the basic level and says the Plus level is quoted individually.
What is Cyber Essentials?
Cyber Essentials is a UK government backed scheme developed by the National Cyber Security Centre. It covers five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. The NCSC calls it the minimum standard of cyber security the Government recommends for organisations of all sizes.
Cyber Essentials Plus covers the same five controls and adds independent technical testing to confirm they work in practice.
It is recommended, not a legal requirement. But the NCSC notes a growing number of organisations ask suppliers to be certified before they can bid for work, which is usually the real reason a company applies.
How is the price set?
We will not quote a number that we cannot source. Here is what the NCSC overview says as of our review:
- Cyber Essentials is priced by organisation size, starting at 320 pounds plus VAT.
- Cyber Essentials Plus is priced by the size and complexity of your network and is quoted individually.
The page gives no other price points. If you use a Certification Body to help you, their fees are separate and set by them, so ask for a written quote.
What drives the timeline?
Scope. You declare which devices, networks and cloud services are in scope. A tight, well defined scope is quicker to assess. A sprawling one with unmanaged laptops and forgotten accounts takes longer.
Readiness. The controls are basic, but many companies fail on the details: devices running unsupported software, shared admin accounts, no multi-factor authentication on cloud services, or no list of devices. Fixing these takes the time, not the form filling.
Route. The NCSC describes two routes. In the self led route you register with IASME, pay, and complete a verified self assessment that a board member or equivalent signs off and an assessor marks. In the supported route you hire a licensed Certification Body to help you interpret the questions and judge whether you meet the requirements. Support adds cost but can reduce rework.
Level. Plus adds technical testing, so it needs scheduling and a working environment ready to be tested.
What does the software side look like?
Security update management is one of the five controls, and for teams that build software it has a second dimension. An up to date inventory of your devices and software is the baseline. For code you ship, an inventory of dependencies and a record of vulnerabilities you have fixed are useful evidence of the same habit. Safeguard can generate those records, but it does not grant or replace the certification, which comes from an accredited assessment.
What free help exists?
The NCSC lists free preparation resources: a question set, a readiness tool, a 30 minute consultation with a Cyber Advisor for small and medium sized businesses, and an online knowledge hub. Use the question set before you pay anyone. It shows where you will fail.
What to do
- Decide which customer or contract needs the certificate and by when.
- Download the question set and answer it honestly.
- Build a list of every device and cloud service in scope.
- Fix the gaps: unsupported software, shared admin accounts, missing multi-factor authentication.
- Choose the self led or supported route and get a written quote if supported.
- Decide on Basic or Plus based on what the buyer actually asks for.
- Check the certificate details with IASME's certificate search once issued.
Quick check
How much does Cyber Essentials cost?
The NCSC says the basic level is priced by organisation size starting at 320 pounds plus VAT, and Plus is quoted individually. Check the NCSC page for the current figures.
Is Cyber Essentials required by law?
No. It is recommended, though some organisations require it from suppliers.
Sources
Last reviewed: 18 October 2026.
