Cyber Essentials and Cyber Essentials Plus
The fee is fixed by IASME and easy to look up. The real cost is getting your business to the standard before you apply. Every one of our managed service clients is baselined to Cyber Essentials as a matter of course, so that part is already done and the certificate fee is all you pay.
What it costs
Fees are set by IASME, so they are the same wherever you certify. What differs between providers is how much help you get to pass.
Certification fee
£440
+ VAT, for a small organisation of 10 to 49 people
Certify your whole organisation with a turnover under £20m and basic certification includes £25,000 of cyber liability insurance at no extra cost, with a 24 hour incident response helpline.
Talk to us about managed ITBasic fees are set by IASME and are the same wherever you certify. Plus is priced on the size and complexity of your estate, so it is shown as a typical range.
Would you pass today?
Answer honestly. Nothing is sent anywhere, the result is worked out in your browser, and you will know within a minute whether you are close.
Is multi factor authentication switched on for every cloud service you use?
From 27 April 2026 this is an automatic fail, not a warning. If a service offers MFA and it is off, you do not pass.
Is every operating system and application still supported by its vendor?
Anything past end of life fails the standard. Windows 10 reached end of support in October 2025.
Are high risk security updates applied within 14 days?
The standard sets a hard 14 day window for critical and high severity patches on internet facing systems.
Do administrators use separate accounts for admin work and everyday email?
Day to day browsing on an admin account is one of the most common reasons an assessment is failed.
Do you have a current list of every device and cloud service in use?
You cannot scope an assessment without one, and unknown devices are what auditors find first.
Have default passwords been changed on firewalls, routers and other kit?
Default credentials on internet facing equipment are an immediate fail and a genuine breach risk.
You look close to ready
Based on the six checks that decide most assessments.
Nothing here is standing in your way. The next step is scoping the assessment properly and making sure the evidence matches what you have told us.
Closing gaps like these is what our managed service does day to day. We take clients through certification as part of that, so the only thing you pay is IASME’s fee.
See what managed IT coversThe standard itself
The requirements are published and short. The useful knowledge is which parts catch businesses out, so each one below says what actually gets assessments rejected.
Every device that connects to the internet sits behind a correctly configured firewall, whether that is the boundary firewall on your office connection or the software firewall on a laptop working from a kitchen table.
What usually fails it
Default administrative passwords left on the router, and remote administration exposed to the internet without a documented business need.
Changing 27 April 2026
IASME moves to version 3.3 of the requirements, the Danzell question set, for any assessment account created on or after that date. The five controls do not change. How strictly they are read does.
Today, if a cloud service offers multi factor authentication and you have not switched it on, you get a major non compliance and can still pass. From April that is an automatic failure, whether the MFA is free, bundled, or a paid add on.
Going for Plus? See what the audit testsHow we help
We take businesses across London and Essex through both Cyber Essentials and Cyber Essentials Plus. Most of the work is the remediation, not the questionnaire, which is exactly why it belongs inside a managed service rather than being sold as a one off.
We take on your IT. Part of onboarding is measuring what you have against the five controls, so you find out where you stand as a matter of course rather than as a separate exercise.
MFA switched on everywhere, end of life software dealt with, admin accounts separated, patching brought inside the 14 day window. This is the part that takes real time, and it is ordinary managed service work.
We work through the question set so the answers match the evidence, then submit through a certification body. You pay IASME's fee. There is no separate charge from us.
Certification lapses in 12 months and controls drift long before that. Because we are managing the estate anyway, renewal is a formality rather than a scramble.
Going for Cyber Essentials Plus? The steps are the same, but an assessor tests the controls rather than taking your word for it, and there is a three month clock.
Who we do this for
We do not sell Cyber Essentials on its own. Answering the question set honestly means knowing how every device, account and cloud service in a business is configured, and nobody can know that from the outside. Sold as a standalone certificate it turns into a paper exercise, which helps nobody and is the reason so many businesses pass on paper and would fail a real test.
So we do it the other way round. Take on the IT, get the estate to the standard, then certify what is genuinely there. Every managed client is baselined to Cyber Essentials as a minimum, the remediation is part of the service, and IASME’s fee is the only thing that appears on top.
Questions we get asked
Certification fees are set by IASME and priced on the size of your organisation: £320 + VAT for micro organisations of 0 to 9 people, £440 for small (10 to 49), £500 for medium (50 to 249) and £600 for large (250+). Cyber Essentials Plus costs more because it adds a hands on technical audit, typically from around £1,400 for a small business up to £3,000 or more for larger or more complex estates.
Basic Cyber Essentials is a self assessment questionnaire verified by a certification body. Cyber Essentials Plus covers the same five controls but adds an independent technical audit of your actual devices and cloud services. You must hold a valid basic certificate before applying for Plus, and you have three months from receiving it to complete the Plus assessment. Our Cyber Essentials Plus page walks through exactly what the assessor tests.
From 27 April 2026 IASME moves to version 3.3 of the requirements, known as the Danzell question set. The five controls stay the same but the interpretation tightens. The biggest change is multi factor authentication: today a missing MFA configuration is a warning you can still pass with, and from April it becomes an automatic failure.
Organisations that certify their whole business and have a turnover under £20 million receive £25,000 of cyber liability insurance included with basic certification, along with access to a 24 hour incident response helpline covering technical, legal and crisis management support.
The assessment itself can be completed in a few hours if you are well prepared. Most businesses go from registration to certificate within two to four weeks, and you have a maximum of six months from registration to submit. Where it takes longer, it is almost always remediation work rather than the paperwork.
No. The self assessment is written to be answerable by a business owner rather than a specialist. In practice most businesses work with their IT support provider because the questions expose gaps that need fixing, and fixing them is the part that takes the time.
No, and we would rather say so plainly than waste your time. Cyber Essentials asks how every device, account and cloud service in your business is set up, and we cannot answer that honestly for an estate we do not manage. Filling the form in on someone else's behalf produces a certificate that describes a business nobody has actually checked, which is worth nothing the first time it matters. We take certification on for managed service clients, where we know the answers because we look after the systems.
Yes. Both Cyber Essentials and Cyber Essentials Plus last 12 months and must be renewed annually. The renewal is a good moment to check that the controls have not drifted since last year, which is usually where problems appear.
Practical guidance on certification, compliance and keeping UK businesses secure.
In 2026, knowing your data is secure is no longer enough. Regulators, clients and insurers want to know whose laws govern it and who can compel access. Here is what data sovereignty means for UK financial services firms, and how to regain control.
AIS Technology9 min read
A straight answer for UK SMEs weighing up Microsoft 365 Copilot: what it really costs in 2026, how the licensing works, the data governance check most buyers skip, and how to decide whether it is worth it for your team.
AIS Technology10 min read
ISO 27001 and Cyber Essentials are routinely treated as alternatives. They are not. They answer different questions, suit different organisations, and cost very different amounts. This post sets out exactly what each certification is, who it is for, what it costs, and which one your business actually needs in 2026.
AIS Technology16 min readTell us where your IT stands today. If we take it on, getting you to the Cyber Essentials standard and keeping you there is part of what we do, and the certificate fee is the only cost on top.
AIS Technology, Woodland Place, Hurricane Way, Wickford, SS11 8YB