Cyber Essentials cost: what should a small business budget?
The Cyber Essentials cost for a basic assessment starts at £320 excluding VAT for an organisation with 0–9 employees. That is not necessarily the cost of getting your business ready or maintaining its protection afterwards.
To compare proposals properly, separate the assessment from any preparation work, check what your existing IT agreement already covers, and keep your team's time visible. This guide gives you a practical record to use before approving a quote.
What is the Cyber Essentials cost for the assessment?
On 22 October 2026, IASME's published assessment prices were:
0–9 employees: £320 excluding VAT.
10–49 employees: £440 excluding VAT.
50–249 employees: £500 excluding VAT.
250 or more employees: £600 excluding VAT.
These are the basic Cyber Essentials assessment fees, not Cache4 prices or an all-in preparation package. Check the current fee, your organisation's band and exactly what a supplier's quotation includes before buying.
Cyber Essentials uses an externally verified self-assessment. Cyber Essentials Plus adds independent technical testing and needs an individual quote based on your network's size and complexity. If you are unsure which level a customer requires, resolve that first; our Cyber Essentials versus Cyber Essentials Plus guide explains the difference.
Build the budget around the work, not just the certificate
Start with the organisation and systems being assessed, including relevant devices, remote working and cloud services. Agree the assessment scope with your chosen Certification Body before assessment begins. A quote based only on the computers in the office may miss work elsewhere.
Use the NCSC's current requirements and free preparation resources to establish what needs checking. Our Cyber Essentials checklist covers the controls; here, the task is to put a cost basis and an owner beside the resulting work.
1. Assessment and any purchased guidance
Record the assessment fee separately from help completing the questions or preparing evidence. Ask what guidance, follow-up and any reassessment arrangements the quote includes. Do not assume a low assessment fee includes hands-on technical work.
2. One-off changes
A review might identify software that needs replacing, a device that cannot run a supported setup, or account settings that need correcting. Obtain a scoped quote for the work actually required, with a way to verify it is complete.
Some changes may already be covered by your support agreement. Confirm that in writing before adding another charge. Equally, owning a licence does not establish that someone is responsible for configuring its features.
3. Recurring costs
Identify any ongoing subscriptions or management needed for the agreed setup. Check existing licences and services first, so you do not budget twice for the same work. Add only genuinely additional charges, and record their commitment, payment frequency and renewal terms.
Not every business needs a new product or support package. These are budgeting categories, not a list of services everyone must buy from Cache4.
4. Your team's time
Someone needs to gather information, arrange access, answer business questions and review the completed assessment. Name those people and agree the time they need, including senior sign-off.
Keep staff hours alongside supplier charges rather than adding existing salaries to the supplier total. Record any additional cash cost, such as paid overtime or temporary cover, separately and only once.
A worked example: the £320 fee is not the finished budget
Hypothetical example: a six-person consultancy is preparing for its first Cyber Essentials assessment. Its owner has confirmed the required certification level and is gathering the information needed to agree scope with the Certification Body.
The office manager collects the device and cloud-service lists. A readiness review identifies an account-configuration task and an older laptop whose current setup is unsupported. The business records the following:
Assessment: £320 excluding VAT is the published fee for its employee band. The owner will confirm the chosen body's quote and inclusions before purchase.
Account configuration: in this fictional scenario, the existing IT provider confirms that the agreed check and configuration work are included in the current support agreement. The record says “included in existing contract”, not “free”. No duplicate project charge is added.
Older laptop: the provider must establish a suitable supported option and quote for any additional work or replacement. The amount remains “quote required”. The owner has not approved a purchase.
Ongoing changes: the provider must confirm whether the chosen option changes any recurring licence or management cost. The amount remains unconfirmed, not £0.
Staff capacity: the office manager and owner agree who will gather evidence, arrange device access and review the answers. They record the required hours separately.
The useful output is a short budget record with one known assessment component, one included item and clearly owned unknowns. It is not a made-up all-in total.
Before committing, the owner checks the laptop proposal, existing contract evidence, recurring commitments and assessment scope. They approve the extra work only once the missing costs and responsibilities are clear. This avoids buying overlapping help or treating a £320 assessment fee as the whole project budget; it does not guarantee a saving or a successful assessment.
Copy this quote-comparison record
Use one record for each cost item in each proposal. Short entries are enough:
Work or fee: what is being bought, and for which agreed scope?
Included already? identify the existing agreement or licence, with written confirmation of the relevant work.
Amount and basis: confirmed price excluding VAT, VAT treatment, one-off or recurring, and when payable. Use “quote required” when unknown.
Inclusions and exclusions: specify preparation, assessment, technical fixes and follow-up separately where relevant.
Owner and next action: who supplies the missing answer or does the work, and by when?
Evidence and status: link the quote or confirmation; mark proposed, confirmed or awaiting clarification. A planned fix is not completed work.
Compare totals only when the proposals cover the same assessment level, scope and work on the same VAT basis. For cash-flow planning, use the full invoices including any VAT charged, and the actual payment dates.
If an item is already included in an existing agreement, identify that cost rather than adding it again. If it is genuinely not required, record the reason. Unknown, included and not required mean different things.
Keep renewal separate from the first assessment
Cyber Essentials certificates expire after 12 months. Allow for reassessment and continuing upkeep, but do not assume next year's fee or preparation needs will be unchanged.
Do not count completed one-off fixes again in the renewal forecast. Add new gaps or changes when they arise, and check the current requirements before renewal. Certification does not remove the need to maintain your protection between assessments.
Turn the unknowns into an agreed next step
Cache4's managed cyber security service can help you review Microsoft 365, devices and existing protection, then agree the practical support and changes your business needs. Formal assessment and certification are separate and are handled by a licensed Certification Body.
Bring the requirement you have received, your current IT support scope and any unresolved device or account gaps to a discovery call. We can discuss the preparation work and whether our services fit.
Assessment fees checked on 22 October 2026. Recheck current prices, scope and terms before purchase. This guide is not a quotation or a guarantee of certification.
Comments