How much does Cyber Essentials cost?

The certificate itself is cheaper than most people expect. The assessment fee for basic Cyber Essentials is set by IASME, the scheme's sole delivery partner, and scales with the size of your organisation — from a few hundred pounds for the smallest firms. Cyber Essentials Plus, which adds an independent technical audit, costs more because a certification body has to test your devices hands-on, and prices vary between bodies.

The fee is rarely the real cost. The expensive part is the gap between where you are and where the assessment needs you to be: switching on multi-factor authentication across every cloud service, retiring devices that no longer receive security updates, and replacing shared logins with individual accounts. None of that appears on an assessor's invoice, but all of it takes somebody's time.

There is also the cost of failing. A submission that comes back with gaps means rework and, with some certification bodies, a resubmission fee. Preparing properly — checking each of the five controls before you pay — is the single biggest saving available.

That is the gap Kept is built for. Run the free readiness scan to see where you stand before you spend anything, and use the generated policies and evidence register to close the gaps. Plans start at £29 a month — usually less than one hour of an IT consultant's time.

Finally, remember the certificate lasts twelve months. Budget for renewal as a recurring line, not a surprise, and keep your evidence current so next year's assessment is a formality rather than a project.