Cyber Essentials fees

The IASME fee for a Cyber Essentials assessment is set by the number of people you employ. It is £320 plus VAT for 0 to 9 employees, £440 for 10 to 49, £500 for 50 to 249 and £600 for 250 or more. The fee covers the assessment, marking by a Certification Body and, if you pass, the certificate. Cyber Essentials Plus is not a fixed fee: the Certification Body quotes it based on the size and complexity of your network.

The IASME fee bands

These are the scheme fees published by IASME. Prices from Certification Bodies may differ where they bundle extra services with the assessment.

What the fee includes

• Access to the question set for six months to complete and pass the assessment
• Marking by an assessor, including review of any resubmission made within the Certification Body's window (2 working days directly with IASME, the six months the assessment is open with Apexward Group)
• The certificate and an entry on IASME's register, plus a digital badge
• For eligible organisations, the included cyber liability insurance. This applies to UK-domiciled organisations that certify their whole organisation and have an annual turnover under £20 million.

If you do not pass within six months, the account closes and a new assessment means a new fee.

Choosing your size band

The band is based on your number of employees. Pick the band that matches your organisation honestly, as the size you declare is part of your submitted answers. If you are not sure how to count part-time staff, directors, volunteers or contractors, ask your Certification Body before you apply rather than guessing.

Services around the fee

Certification Bodies may offer services on top of the scheme fee, such as help scoping, guided completion of the questions, a pre-assessment review or remediation support. These are optional and priced by each Certification Body. You can also apply and complete the assessment yourself. The NCSC describes this as the self-led route, with the supported route through a Certification Body as the alternative.

When comparing offers, check what is the IASME fee and what is an added service, and what happens if you fail and need help to resubmit.

Cyber Essentials Plus

Plus is an audit carried out by a Certification Body, so there is no single scheme price. The quote will usually depend on:

• how many devices, operating system versions and cloud services you have, which drives the size of the sample
• how many sites are involved and whether testing is on site or remote
• whether you need help to remediate findings

You must hold a Cyber Essentials certificate first, so budget for both. See Cyber Essentials and Cyber Essentials Plus compared.

Other fees you may see

IASME charges small administration fees for some changes after certification, for example amending the name or address on a certificate, or issuing certificates for additional legal entities that share one assessment. Check IASME's current guidance for the amounts.

Hidden costs to plan for

The fee is often the smallest part of the cost. Budget for what it takes to meet the controls:

• replacing devices that run unsupported operating systems
• licences for supported versions of software
• turning on MFA, which is free in most services but may need set-up time
• IT provider time to apply settings and evidence them

For Apexward's own prices for assessment and support, request a quote or see the pricing page.