A tender lands on your desk, and one line in it reads: suppliers must hold Cyber Essentials Plus. Not Cyber Essentials. Plus. The two certificates share a name, a logo and the same five technical controls, yet one is an online questionnaire finished in days, the other an assessor testing your laptops, email and cloud accounts. The price gap is just as wide: a few hundred pounds against a few thousand. This guide gives the 2026 costs for both, explains what the Plus audit tests, and shows how to read a tender so you buy the right one.
Both levels certify the same five controls of the government-backed scheme, run by the National Cyber Security Centre with IASME as delivery partner. The difference is not what is certified but how it is proved: basic takes your word for it, Plus has an assessor check on real devices.
The short answer
If a contract asks for “Cyber Essentials” without naming a level, basic is enough. It costs £320 to £600 plus VAT by headcount, and it is the mandatory first step anyway. If it names Plus, only Plus will do: budget roughly £1,200 to £4,000 plus VAT on top of the basic fee. For a 10-person firm: about £440 plus VAT for basic, or roughly £2,000 to £3,000 plus VAT all-in for both. Most small firms start with basic and step up only when a contract demands it — but plan both together, as the audit must follow within three months of the basic certificate.
Cyber Essentials vs Cyber Essentials Plus at a glance
| Cyber Essentials | Cyber Essentials Plus | |
|---|---|---|
| What it proves | Five controls in place, self-assessed | Same controls, verified on real devices |
| How verified | Online questionnaire, reviewed by a certification body | Questionnaire plus technical audit |
| Typical cost 2026 | £320–£600 + VAT, by headcount | Basic fee plus ~£1,200–£4,000 + VAT |
| Time needed | Days, once ready | A few extra weeks |
| Valid for | 12 months | 12 months |
| Who asks for it | Most public sector tenders | MOD, NHS trusts, councils |
What Cyber Essentials actually is
Cyber Essentials is the government’s baseline cyber security certification, built around five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. You complete an online questionnaire, a board-level contact signs it off, and a licensed certification body reviews your answers. Our Cyber Essentials explainer walks through each control in detail. Pass, and the certificate lasts twelve months; renewal is a full reassessment.
One feature many firms miss: IASME bundles cyber liability cover worth up to £25,000 with the basic certificate for UK organisations with turnover under £20 million — confirm current terms directly. Before you start, work through our cyber security checklist: it covers the same ground as the questionnaire.
What Cyber Essentials Plus adds
Plus adds no new requirements — it changes how you prove the ones that exist. After passing basic, an assessor tests a sample of your devices and accounts instead of taking your answers on trust. The sample is representative, and its size drives the price.
What the Plus audit actually tests
The assessor checks that critical and high-risk updates are installed promptly, malware protection is running and current, browsers and email block malicious downloads and simulated phishing, accounts are separated with multi-factor authentication, and an external vulnerability scan finds no serious holes. It tests whether the controls you described actually work on the machines staff use daily — which is why buyers handling sensitive data ask for it. Our guides on a strong password policy and how to spot and prevent phishing attacks cover two areas the audit probes hardest.
What changed in April 2026
Version 3.3 and the Danzell question set, in force from 27 April 2026, tightened the rules. Cloud services are always in scope and always need multi-factor authentication — they cannot be excluded. Critical or high-risk updates (CVSS v3 score of 7 or above, or with no severity details) must be applied within 14 days. A single cloud service without multi-factor authentication, or one critical update left for three weeks, is enough to fail.
What it costs in 2026
The basic fee is the only fixed number in the process. IASME publishes it by headcount, and certification bodies may charge above it, so treat it as a floor:
| Organisation size | Employees | IASME fee (ex VAT) |
|---|---|---|
| Micro | 0–9 | £320 |
| Small | 10–49 | £440 |
| Medium | 50–249 | £500 |
| Large | 250 or more | £600 |
Older guides still show the previous bands (£300, £400, £450, £500); the figures above are current, confirmed against IASME in late October 2026. The fee covers twelve months, but not getting your systems ready.
Plus has no published fee: each body quotes individually, generally £1,200 to £4,000 plus VAT. For a 10-person firm: £440 plus VAT for basic, plus a Plus audit of £1,500 to £2,500, giving roughly £2,000 to £3,000 plus VAT before preparation. A realistic first-year total is £2,000 to £5,000. Monthly managed bundles exist too — compare total twelve-month cost, not the monthly headline.
Which one do you need?
Start with the document in front of you. Tender documents usually state the level, and the wording matters:
| Tender says | What it means | You need |
|---|---|---|
| “Cyber Essentials certification” | Either level is acceptable | Basic (minimum) |
| “Cyber Essentials or equivalent” | Basic is acceptable; an equivalent may also pass | Basic, or check the equivalent |
| “Cyber Essentials Plus” | Specifically requires Plus | Plus only |
| “Independently verified cyber security” | Often means Plus, but check the detail | Ask the buyer in writing |
Choose basic if a contract specifies it, you are certifying for the first time, or you want a quick, affordable way to unblock a bid. Choose Plus if a contract names it — common in higher-risk MOD work under DEFCON 658, many NHS trusts and local authorities, and financial services suppliers handling customer data — or if customers ask how controls are verified, not whether they exist. One judgement call: if a tender asks only for basic but rivals hold Plus, the stronger assurance can sway the decision — price that honestly first.
The hidden costs most quotes leave out
The certificate fee is rarely the whole bill. The costs no quote lists: replacing unsupported software or an ageing laptop, rolling out multi-factor authentication across every cloud service, and staff time gathering evidence. Optional preparation consultancy runs £500 to £3,000. Ask whether the price includes resubmission if you fail, and whether the Plus fee covers travel. And remember renewal: both certificates last twelve months, so treat this as an annual cost, not a one-off project.
How to get certified: the steps and the timeline
First, confirm the scope: which devices, services and locations are included. Second, work through the five controls and fix the gaps, using the cyber security checklist as your worksheet. Third, choose an IASME-licensed certification body from the official directory and confirm the fee and what it includes. Fourth, complete the questionnaire. Fifth, if you need Plus, book the audit straight away — it must be completed within three months of the basic certificate. Basic takes days once ready, or two to four weeks from scratch; Plus adds two to four weeks.
Common mistakes that waste money
The most expensive error is paying for Plus when the tender only asked for basic. The mirror image: buying basic, reaching the shortlist, then finding the buyer wanted Plus after the three-month window expired — which means paying for basic again. Other wastes: assuming an old laptop will pass, leaving one cloud service without multi-factor authentication, and treating the 14-day patch rule as guidance, not a pass-or-fail test. Do not choose a body on price alone: the cheapest quote is not cheap if resubmission, support and audit are charged separately. Get the full scope in writing first.
Frequently asked questions
Is Cyber Essentials mandatory for UK small businesses?
No, it is not legally mandatory for most businesses. But it is often a precondition for specific contracts, especially with public sector organisations or larger companies. Procurement Policy Note 014, in force since 24 February 2025, makes it the minimum standard for government contracts involving sensitive or personal information.
Can I go straight to Cyber Essentials Plus?
No. Plus always builds on a current basic certificate, and the audit must be completed within three months of it. Treat the two as one project when Plus is the goal: pass basic, then book the audit immediately.
How long does certification last, and what does renewal involve?
Both last twelve months. Renewal is a full reassessment against the rules in force at the time, so a firm that passed last year can fail this year if patching has slipped or a new cloud service lacks multi-factor authentication. Keep the controls running all year, not just before renewal.
Related reading
Cyber Essentials Certification Explained (UK)
Cyber Security Checklist for UK Small Businesses
How to Create a Strong Password Policy for a Small Business
How to Spot and Prevent Phishing Attacks at Work