Cyber Essentials is the UK Government-backed scheme that shows your business has the basic protections in place against the most common cyber attacks. In 2026 the assessment fee starts at £320 plus VAT for organisations with fewer than ten staff and £440 plus VAT for 10–49 staff, based on IASME’s published pricing. Most of the real effort, and most of the delays, come from fixing gaps before you apply. This guide covers the cost, the timeline and exactly what you’ll be checked on.
Who needs Cyber Essentials?
Certification is voluntary, but it’s increasingly expected:
- Government contracts. It’s required for many central government contracts that involve handling personal information or providing certain ICT services.
- Larger customers. Many businesses now ask suppliers for Cyber Essentials as part of onboarding or tender questionnaires.
- Insurers. Cyber insurance applications ask about the same controls, and certification makes those questions easier to answer.
- Trust. It’s a recognised badge that tells clients you take their data seriously.
What it costs
There are two parts to the cost.
The assessment fee
This is paid to a certification body licensed by IASME, the scheme’s delivery partner. IASME publishes benchmark prices by organisation size, starting at £320 plus VAT for micro organisations (0–9 employees) and £440 plus VAT for small organisations (10–49). Medium and large organisations pay more. Some certification bodies charge slightly less, others add a premium for extra support.
Getting ready
This depends entirely on your starting point. A well-managed business may need an afternoon of checks. A business with unsupported laptops, no multi-factor authentication and an old router may need new hardware and a few days of configuration. Our Cyber Essentials service starts with a gap review so you know the real cost before you commit.
The five controls you’re assessed on
- Firewalls. Every device and internet connection is protected by a properly configured firewall, with default passwords changed and unnecessary services closed.
- Secure configuration. Computers, phones and cloud services are set up securely, with unused software removed and strong sign-in in place.
- Security update management. Operating systems and applications must be supported by their manufacturer, and high-risk or critical updates must be applied within 14 days of release.
- User access control. People only have the access they need, admin accounts are separate from everyday accounts, and multi-factor authentication is used on cloud services.
- Malware protection. Every in-scope device is protected against malware, for example with managed endpoint protection.
The gaps that most often hold businesses back
- Unsupported devices. An old Windows laptop, a phone that no longer gets updates or an end-of-life router puts you out of scope until it’s replaced or removed.
- No MFA on Microsoft 365. It must be on for cloud services where it’s available, which includes Microsoft 365.
- Everyone is an administrator. Day-to-day accounts must not have admin rights.
- Updates left to users. Without managed patching, it’s hard to show critical updates are applied within 14 days.
- Personal devices. If staff use their own phones for work email, those devices may be in scope too. Mobile device management or app protection policies solve this.
How long it takes
| Stage | Typical time |
|---|---|
| Gap review | A few days |
| Fixing gaps | From a day to a few weeks, depending on what’s found |
| Completing the questionnaire | A few hours with the right evidence to hand |
| Assessment and certificate | Usually within a few working days of submission |
Certification lasts 12 months, so it needs renewing every year. If your IT is managed day to day, the controls stay in place and renewal is quick.
Cyber Essentials or Cyber Essentials Plus?
Cyber Essentials is a verified self-assessment: you answer a questionnaire about your controls, and an assessor reviews it. Cyber Essentials Plus checks the same five controls but adds a hands-on audit, where an assessor tests a sample of your devices and accounts. Plus gives customers more assurance and is required for some contracts. You need the basic certificate first.
Get certified with help
SquareOne IT holds Cyber Essentials, so we’ve been through the same process. We’ll review your set-up against the five controls, fix the gaps and help you complete the questionnaire accurately. Ask for a free readiness check or download our Cyber Essentials readiness checklist.