How much does Cyber Essentials cost for a small business?

Updated

Cyber Essentials is the UK government-backed scheme that shows your business has the basic security controls in place. More customers, insurers and public-sector contracts now ask for it, so it’s one of the most common questions we get from small businesses across London and Hertfordshire: what will it actually cost?

The honest answer is that there are two costs. There’s the certification fee, which is fixed and fairly modest. Then there’s the cost of getting your IT into a state where it passes, which depends entirely on where you’re starting from.

The certification fee

Cyber Essentials is run by IASME on behalf of the National Cyber Security Centre. The self-assessment fee is set by organisation size. At the time of writing, IASME lists these prices (excluding VAT):

  • Micro (0–9 employees): £320
  • Small (10–49 employees): £440
  • Medium (50–249 employees): £500
  • Large (250+ employees): £600

That fee covers the online assessment, the review by a certification body and your certificate. Certification lasts 12 months, so it’s an annual cost. Eligible small organisations that certify their whole business also get cyber liability insurance included, which is worth checking against any policy you already hold.

What about Cyber Essentials Plus?

Cyber Essentials Plus covers the same five controls, but instead of relying on your answers alone, an assessor tests your systems. That includes vulnerability scans and checks on a sample of your laptops, desktops and phones. It has to be completed within three months of passing the basic self-assessment.

Plus is priced by quote, and prices vary between certification bodies and with the number of devices in scope. For a small business it typically runs into four figures. If a customer or contract asks for Plus, it’s worth getting the basic certificate in place first and booking the audit soon after, while everything is fresh.

The bigger cost: getting ready to pass

The questionnaire isn’t difficult, but it is precise. Most businesses we speak to are closer than they think, with a handful of gaps to close. The usual ones are:

  • Unsupported software. Every device and application in scope must still receive security updates. Older Windows 10 machines, an ageing server or an out-of-date copy of a line-of-business app can all hold you back.
  • Updates applied quickly. Critical and high-risk security updates must be installed within 14 days of release. That’s easy with managed patching and hard to evidence without it.
  • Multi-factor authentication. Cloud services such as Microsoft 365 need MFA switched on for every user wherever the service offers it.
  • Admin accounts. People should use a standard account day to day, with separate admin accounts used only when needed.
  • Firewalls and malware protection. Every device needs both, configured properly, including laptops used at home.
  • Secure configuration. Default passwords changed, unused accounts and software removed, auto-run turned off.

If your IT is already well managed, preparation might be a few hours of checking and tidying. If you have older kit or no central management, it might mean replacing a couple of machines or rolling out MFA properly first. Either way, the work pays for itself: these are the same controls that stop the most common attacks.

How to keep the cost down

A few practical steps make the whole process cheaper and quicker:

  1. Do a gap check before you apply. Answering the questions honestly against your setup first means you pay once and pass first time.
  2. Fix the scope early. Decide which devices, users and cloud services are in scope. Certifying the whole organisation is simplest, and it’s needed for the included insurance.
  3. Keep evidence as you go. A device list, update reports and an MFA report make the assessment straightforward, and next year’s renewal faster still.
  4. Make it part of normal IT. If patching, MFA and device management are already handled month to month, renewal becomes a formality rather than a project.

Where we can help

We help businesses and charities across London and Hertfordshire get ready for Cyber Essentials and stay ready. That usually starts with a free IT audit: we look at your devices, accounts and Microsoft 365 setup, tell you what would and wouldn’t pass, and give you a clear list of what to fix. You can read more about our approach on our IT security and Cyber Essentials page.

If you’d like a straight answer on how ready you are, get in touch or call us on 0203 8833 444.

Find out how we help professional services firms and small businesses with security and certification.