KeptCost guide, updated 2026
What Cyber Essentials actually costs a UK business
The certification fee is the part everyone quotes. The part that decides your real cost is how long the preparation takes and how much of it you repeat next year. Here is the full picture, without sales spin.
The cost, explained in under a minute
A quick walkthrough of where the money goes — the fee, the audit, and the preparation time most people underestimate.
Every line in the budget
Certification fees are set by IASME and its certification bodies, so they change over time and vary by organisation size — always confirm the current band with your chosen certification body before budgeting. The costs below are the ones businesses forget.
Certification fee (basic)
Paid to an IASME-appointed certification bodyBanded by number of people in your organisation and paid once every twelve months.
Cyber Essentials Plus audit
Paid to the assessor carrying out the auditOnly if a customer, insurer or tender requires Plus. Priced on the size of the device and cloud sample.
Preparation time
Your own staff hoursUsually the largest real cost: listing devices and cloud services, fixing accounts, writing policies, collecting screenshots.
Consultant or IT partner
OptionalA day rate or fixed fee to prepare answers on your behalf. Avoidable if your estate is simple.
Fixes uncovered along the way
VariesReplacing unsupported kit, adding licences for individual accounts, turning on multi-factor authentication where it costs extra.
Renewal, every twelve months
RecurringThe same fee and the same evidence work again — unless the evidence has been kept current through the year.
Where the money usually leaks
Doing it twice
Most firms rebuild their evidence pack from nothing each year because nobody kept a record of what was checked and when. That is the single biggest avoidable cost.
A failed submission
Answers that do not match reality come back for correction, which costs time and can cost a resubmission. A gap check before you apply is cheaper than a retry.
Unknown cloud services
Tools bought on a card by one team still count as in scope. Finding them late means rushed licence changes at full price.
A lapsed certificate
Letting the twelve months run out mid-tender can cost you the bid — far more than the fee itself.
How Kept lowers the cost
Kept does not sell or issue certification. It reduces the part you pay for in hours: a free scan and readiness score to find gaps across the five controls, policies drafted for you, a dated evidence register that builds itself month by month, and renewal reminders before deadlines become emergencies. Starter is £29 a month, with a 14-day free trial and no card required.
Cyber Essentials cost questions
- How much does Cyber Essentials cost in the UK?
- The certification fee itself is banded by organisation size, starting at the smallest micro-business band and rising for larger headcounts. Most UK small businesses find the certification fee is the smaller part of the cost — the bigger cost is the internal time spent gathering evidence, writing policies and tidying up accounts and devices before submitting.
- Is Cyber Essentials Plus more expensive?
- Yes. Plus adds a hands-on technical audit of a sample of your devices and cloud accounts, so you pay an assessor's time on top of the certification fee. You must hold a valid basic certificate first, so budget for both.
- Do I need a consultant?
- Not necessarily. Consultants typically charge a day rate or fixed fee to prepare your answers and evidence. If your setup is straightforward — cloud services, managed laptops, multi-factor authentication already on — most businesses can prepare themselves with a checklist and template policies.
- What are the hidden costs?
- The usual surprises are replacing unsupported devices or software, adding licences so every person has an individual account, enabling multi-factor authentication on paid plans, and the staff hours spent repeating the same evidence-gathering again at renewal twelve months later.
- How often do I pay?
- Cyber Essentials lasts twelve months, so the fee and the preparation work recur annually. The renewal is cheaper in time if your evidence is kept up to date through the year rather than rebuilt from scratch.
Also worth reading: Cyber Essentials vs Cyber Essentials Plus and the free templates.