UK certification guide
Cyber Essentials vs Cyber Essentials Plus
Written and reviewed by the Cost of Compliance editorial teamLast reviewed: October 2026
Cyber Essentials is a reviewed questionnaire about five technical controls. Plus adds independent testing to check that those controls work in practice. Both are UK certifications, but Plus usually costs more because an assessor must test a sample of your systems.
What each level involves
| Question | Cyber Essentials | Cyber Essentials Plus |
|---|---|---|
| Assessment | Questionnaire reviewed by a licensed certification body | Technical checks by an assessor after passing the questionnaire |
| Controls | Firewalls, secure configuration, updates, access control and malware protection | The same controls, tested on a sample of devices |
| Renewal | Every year | Every year |
Plus does not replace the basic assessment. You must first obtain Cyber Essentials and complete the Plus assessment within the permitted three month window. Plan the technical work before applying so that remediation does not consume the whole window.
How much do they cost?
IASME sets the basic Cyber Essentials assessment fee by organisation size. It is £320 for 0 to 9 employees, £440 for 10 to 49, £500 for 50 to 249 and £600 for 250 or more, before VAT. Support to prepare the answers or fix gaps is extra.
There is no national fixed fee for the Plus assessment. A small, prepared organisation might see a technical assessment quote from about £1,150 to £3,000 before VAT. A larger or more complex estate can cost £4,500 to £8,000 or more. Budget for the basic fee as well if it is not included in the quote. These are wide indicative market ranges, not an official Plus tariff.
Ask whether a Plus quote covers the questionnaire, travel, sample size, repeat testing and support with fixes. For a tailored estimate in pounds including preparation and VAT, use the Cyber Essentials Plus cost calculator.
Renewal and VAT
Both certificates expire after twelve months. Renewing Plus means renewing the basic certification and arranging the technical assessment again. Published business fees are generally before VAT. At 20 percent, a £440 basic fee becomes £528 including VAT, while a £2,000 Plus assessment becomes £2,400 including VAT. A VAT registered business may be able to reclaim it.
When does a government contract require Plus?
Not every UK government contract requires Plus. Central government procurement rules can require a Cyber Essentials certificate for contracts that handle certain personal information or provide certain technology services. The buyer decides the appropriate level for the contract based on its risk and states it in the tender. Some higher risk contracts specify Plus, and prime contractors may ask their suppliers for it too. Do not assume a basic certificate meets a tender that explicitly asks for Plus, or that every government tender needs Plus.
Read the specific tender and ask the contracting authority what evidence it accepts, when the certificate must be held and which parts of your business must be in scope. If the buyer asks for a separate application security test, see the UK penetration testing cost guide; Plus testing is not a general penetration test.
Sources: IASME frequently asked questions, IASME Plus timelines and government procurement guidance.