How Much Does Cyber Essentials Cost?

How Much Does Cyber Essentials Cost? Fees, Hidden Costs and Timelines

Ask what Cyber Essentials costs and you'll usually get a single number: the certification fee. That's only part of the story. The real cost depends on how ready your IT is today, whether you need Cyber Essentials Plus, and whether you do the work yourself or bring in help.

This guide breaks down every part of the cost, how long certification takes, and how to keep both down. For an overview of the scheme itself, see our complete guide to Cyber Essentials.

The Cyber Essentials certification fee

The fee for the Cyber Essentials self-assessment is set by IASME and charged on a sliding scale by the size of your organisation, from micro businesses with fewer than ten staff up to large organisations with 250 or more. IASME publishes the current fee for each size band, and it changes from year to year.

The fee covers the assessment by a certification body and, for eligible UK organisations with a turnover under £20m certifying their whole organisation, free cyber liability insurance.

The Cyber Essentials Plus cost

Cyber Essentials Plus isn't priced centrally. Certification bodies set their own fees, because the cost is mostly the assessor's time. The main factors are:

• The number of devices and users, which decides the size of the sample tested
• The number of sites, and whether testing is remote or on site
• How many different device types and operating systems you run
• Whether any retests are needed

The more devices, sites and systems you have, the more testing is needed and the higher the cost. The difference between the two levels is explained in Cyber Essentials vs Cyber Essentials Plus.

The cost most people forget: getting ready

The fees are predictable. Remediation isn't, and it's often the biggest part of the bill. Common costs include:

• Replacing unsupported devices. Laptops that can't run a supported operating system, or phones that no longer get security updates, have to be upgraded or taken out of scope.
• Replacing unsupported software. Old versions of line-of-business apps or office software may need new licences.
• Firewall and router work. Replacing consumer-grade kit, updating firmware or cleaning up rules.
• Security tooling. Malware protection on every device, and device management so updates and settings are enforced centrally.
• Engineer time. Splitting admin accounts, rolling out MFA, removing old accounts and documenting it all.

A business that already has managed, up-to-date devices may need very little. One that has grown organically, with a mix of old kit and shared logins, can spend more on remediation than on certification. Our Cyber Essentials requirements checklist will give you a feel for how much work you have ahead.

How long does Cyber Essentials take?

Once your systems meet the requirements, the Cyber Essentials assessment itself is quick, often marked within a few working days of submission. Realistic end-to-end timelines look like this:

1. Readiness check: a day or two.
2. Remediation: anything from a few days to six weeks, depending on what needs fixing and whether hardware has to be ordered.
3. Cyber Essentials submission and marking: a few days.
4. Cyber Essentials Plus audit: scheduled within three months of passing Cyber Essentials, usually completed over a day or two of testing, plus time for any retests.

If you have a tender deadline, start at least six to eight weeks before it, especially if Plus is required.

How Flotek prices Cyber Essentials

IASME certification fees and external audit costs change from year to year, so rather than passing on a string of separate bills, we include them in one monthly fee:

• Cyber Essentials from £130 a month + VAT, including our time to get you ready and take you through assessment
• Cyber Essentials and Cyber Essentials Plus for £279 a month + VAT, including all external audit fees

Spreading the cost monthly makes certification easier to budget for and far more affordable than paying for everything up front. And if you're on our Flo360+ managed support, Cyber Essentials is included as standard, because we want every one of our partners to have it as a baseline for security.

Doing it yourself vs getting help

You can certify without outside help. IASME provides the question set and a free readiness tool, and a well-run IT setup may sail through. The risk is in the detail: vague answers, a missed device or a misunderstood requirement means resubmitting, and a failed Plus test can push you past a contract deadline.

Getting support usually saves time, avoids repeat fees and means the fixes are done properly rather than patched for audit day. It also means someone is watching the controls after certification, so renewal isn't a scramble.

Active Protect is Flotek's own product, designed to keep you in constant protection and compliance, not just on audit day. It checks your devices every day to make sure nothing has slipped: security updates, admin rights, malware protection and the other settings Cyber Essentials depends on. If something does slip, our team will reach out to you straight away, or, if you have a managed support agreement with us, fix it behind the scenes before it becomes a problem.

Read more in Why Cyber Essentials Needs Active Protect.

How to keep the cost down

• Certify the whole organisation rather than carving out complex scopes, and qualify for the free insurance if you're eligible
• Replace unsupported devices as part of your normal refresh cycle, not at the last minute
• Use centrally managed devices so updates and settings are enforced automatically
• Fix everything before you submit, so you only pay once
• Spread certification and audit fees monthly rather than paying them up front
• Keep controls in place all year so renewal needs no remediation

Get started

Our Cyber Essentials and Cyber Essentials Plus service starts with a free readiness check, so you'll know exactly where you stand before you commit. From there it's one predictable monthly fee, from £130 a month + VAT, with certification and audit fees included. Book your readiness check.

Further reading

• Cyber Essentials: the complete guide for UK businesses
• Cyber Essentials vs Cyber Essentials Plus: which does your business need?
• Cyber Essentials requirements: the five controls checklist