Cyber Essentials cost in 2026: the price by staff size, and the new 75% discount

The short version

• The price is set by staff size. £320 + VAT for 0 to 9 employees, £440 for 10 to 49, £500 for 50 to 249 and £600 for 250 or more. These are IASME’s prices; IASME runs the scheme for the government.
• 75% off a new certificate, from 3 November 2026. For UK micro, small and medium-sized businesses not certified in the last four years, that makes it £80, £110 or £125 + VAT. Organisations with 250 or more staff aren’t covered.
• It’s first come, first served. The fund is £2.4m, which the government expects to cover about 6,000 businesses, until March 2027 or until the money runs out. IASME says you must register and buy by 31 March 2027.
• The discount pays for one go. If you fail, you get two working days to fix things for free; after that, you pay again. If you don’t finish within six months, there’s no refund.
• It’s a yearly cost. Certificates expire after 12 months, and the discount is for new certificates, so on that wording next year’s renewal is full price.
• Cyber Essentials Plus is extra, and quoted. The audited version is priced individually by a Certification Body. Nothing we read says the discount covers it.
• Free insurance under £20m turnover, if you opt in. Up to £25,000 of cyber cover, but not for money stolen by cyber fraud.

How much does Cyber Essentials cost?

The price comes from IASME, which the government’s funding paper calls “the government’s delivery partner for the Cyber Essentials scheme”. It charges by number of employees. These are the prices on IASME’s Cyber Essentials page, with the new discount worked out:

The discounted prices are our arithmetic, a quarter of each price, and they match the government’s press release, which says small businesses “could pay as little as £80 and no more than £125 (plus VAT)”. Every figure here is before VAT.

For that, you answer an online question set about your systems, a senior person signs the answers off, and an assessor from a Certification Body marks them. IASME says the assessor will review your answers “within 3 working days”. Pass, and the certificate lasts a year.

The 75% discount: the Cyber Essentials First Step Fund

The government announced the fund on 3 November 2026. The press release says it will give “eligible micro, small and medium-sized UK businesses a 75% discount on the cost of a new Cyber Essentials certification”.

Who qualifies:

• A UK micro, small or medium-sized business. IASME’s wording: “If you’re a UK-based micro or SME organisation that has not held Cyber Essentials in the last four years, you may be eligible for a 75% discount, subject to eligibility and available funding.”
• Not certified in the last four years. The press release says the same: businesses “who have not been certified in the last four years”. So on that wording, if your certificate lapsed two years ago you’re out, and if it lapsed five years ago you’re in.
• One page words it differently. The funding package’s summary page says the fund “is available for all SMEs applying for their first Cyber Essentials certificate”. If you’ve held Cyber Essentials at any point, check with IASME before you rely on the four-year rule.

How long it lasts: the press release says “It will be available until March 2027, or until the allocated funding runs out.” IASME adds a deadline: “You must register and purchase your assessment by 31 March 2027 to claim the discount.”

How much there is: £2.4m, and the government estimates “approximately 6,000 new businesses could benefit from this funding”. That works out at £400 per business, more than the biggest discount on any one certificate before VAT (£375 off a medium firm’s £500). The documents don’t say why; the estimate may allow for VAT or for running the scheme. What it does tell you is the scale: a few thousand places, first come, first served.

How to apply: the press release links to IASME’s First Step site, which it says is “active from 3 November”. Without JavaScript it shows little more than a cookie notice, so we couldn’t read its steps and won’t describe them. You don’t have to go direct, either. The funding paper says: “The discount is still applicable if organisations choose to certify through a Certification Body.”

Is Cyber Essentials free for some businesses?

Yes, but you can’t apply for that version. A second scheme, the Cyber Essentials for Suppliers grant, pays the whole cost and adds “tailored Cyber Advisor support”. It’s for suppliers of organisations that have signed the government’s Cyber Resilience Pledge, and the press release says: “SME businesses nominated for this offer will be contacted by their Cyber Resilience Pledge signatory organisation”. So it’s the big customer who picks you.

The Pledge is growing quickly. Signatories agree to “take a risk-based approach to requiring Cyber Essentials across their supply chains”, and the press release says “More than 230 organisations have signed the Pledge so far”. The government’s list of signatories, which we read on 3 November, names 242, although the list’s own total line says 235. By the dates on the list, 92 of them joined in October 2026 alone.

So if a customer has asked you for Cyber Essentials, look them up on that list. If they’re on it, ask whether they’re nominating suppliers for the free route before you pay for the discounted one.

What the money covers, and what it doesn’t

• It pays for an attempt, not a pass. The funding paper: “Funding covers the cost of assessment and, where the assessment is passed, certification. It does not guarantee certification.”
• You get one free resubmission window. IASME’s FAQ: “If you fail, we allow you two working days to examine the feedback from the Assessor and change any simple issues with your network and policies.” After that, “if you still fail after these two days you will have to reapply and pay the assessment fee again”. Whether a second, paid attempt would get the discount again, none of the documents says.
• Six months, then it’s gone. “You will have 6 months to complete your assessment before your account is deleted and unfortunately, we cannot issue a refund if this happens.” So don’t buy until you’re nearly ready, but do buy before 31 March 2027, or before the money runs out.
• Next year is full price. “Cyber Essentials and Cyber Essentials Plus certificates expire after 12 months”, and “You do need to enter all the information each time you certify.” The discount is for a new certificate for businesses not certified in the last four years, so on that wording your renewal won’t qualify. Budget £320 + VAT a year for a micro business after the first.
• Cyber Essentials Plus is separate. IASME: “If you require Cyber Essentials Plus, you will need to contact a Certification Body directly.” Its FAQ adds: “The Cyber Essentials Plus assessment has to be quoted for individually.” Nothing in the press release, the funding paper or IASME’s page says the discount applies to Plus.
• Help costs extra. Cyber Advisors and Certification Bodies charge for hands-on help, though IASME says some advisors offer “a free 30-minute consultation for eligible SMEs”. We haven’t priced their help and won’t guess.

The costs that aren’t on the price list

The fee is the easy part. What varies from one business to the next is the work of getting your systems to pass.

• Old software is an automatic fail. IASME’s FAQ: “Any company using unsupported software in the scope of the assessment will fail to achieve Cyber Essentials certification.” Anything in scope that no longer gets security updates from its maker, such as an old computer or an old version of a program, has to be dealt with before you apply. For some businesses that will cost more than the certificate.
• Your time. “If you have prepared your answers in advance, filling out the self-assessment might only take about an hour.” The preparing is where the time goes.
• Someone senior signs it. The FAQ says “one of your board members will have to sign a declaration to verify that all the answers you have entered are true”. Only tick what you can stand behind.

So before you pay anything, download the free question set and read it. The current one is called Danzell: IASME says it “should be used if you are preparing to purchase from the 27th of April 2026”. Older guides may still link the previous set, called Willow. IASME also has a free Readiness Tool that walks you through the questions.

The scheme is built on five technical controls, which the funding paper lists: firewalls, secure configuration, security update management, user access control and malware protection. If you hold customers’ personal data, there’s a separate yearly cost to know about too: the data protection fee, which we cover in who has to pay the data protection fee, and how much.

The free insurance, and what it leaves out

The press release says organisations “with Cyber Essentials which have a turnover of less than £20m, also receive up to £25,000 of cyber liability insurance”. IASME’s insurance page sets four conditions:

• “The entire organisation is Certified”
• “The organisation is domiciled in the UK or Crown Dependencies”
• “The organisation’s annual turnover is under £20m”
• “The organisation opts-in to the insurance.”

So it isn’t automatic: you have to opt in. And two lines on the same page are worth reading before you count on it. Under what isn’t covered: “Money stolen by electronic means or cyber fraud.” On that wording, a fake invoice your team pays by mistake is the kind of loss it won’t pay for. And IASME’s own warning: “The £25,000 limit of indemnity might be sufficient for a small breach or incident but inadequate for a serious problem or more than one incident.”

Do you need Cyber Essentials?

The press release calls it “the minimum standard of cyber security recommended by the Government for organisations of all sizes”. Recommended, in other words: what makes you need the certificate is usually someone you sell to asking for it. IASME’s FAQ says “Cyber Essentials is now required in a large number of central government contracts and an increasing number of local government contracts”, and “In particular, Cyber Essentials is required for Ministry of Defence suppliers for all of their supply chain that handles defence information.” Add the Pledge’s signatories asking their own suppliers, and more small businesses will be asked for it.

Our view: if a customer or a tender has asked for it, the discount makes this a good time to do it. Read the free questions first, fix what you’d fail on, then buy, before the money runs out. If nobody has asked, the five controls are still worth putting in place; the certificate is how you prove it to someone else. We don’t sell Cyber Essentials or help with it, and we’re not a Certification Body, so we’ve nothing riding on whether you get it.

What argues the other way

• The headline cost of an attack is mostly American. The press release says a significant attack on a UK business “could cost on average £195,000”. Its footnote says: “Due to lack of available UK-based cost data, the estimate is based on data from primarily US disclosures.” And “for medium and large firms this estimate is based on a limited sample size of 18”. Don’t decide on that number.
• A certificate is a snapshot. It shows the five controls were in place when you answered, and it lasts 12 months. IASME describes the controls as protection against “the most common internet-based cyber security threats”: common is the word to notice.
• The discount changes the fee, not the work. £240 off a micro business’s certificate is real money, but if passing means replacing old computers, that will cost more.
• The insurance is a small extra, not a reason. £25,000 of cover, with cyber fraud left out, is worth having if you qualify. It isn’t a reason to get certified on its own.

Sources, and what we checked

• Department for Digital, Culture, Media and Sport, New Government-backed cyber security protections could save UK businesses thousands, press release, published 3 November 2026.
• The same department’s Cyber Essentials funding package page and its full document, published 3 November 2026.
• The government’s Cyber Resilience Pledge signatories list, read on 3 November 2026. We counted its rows ourselves.
• IASME’s Cyber Essentials page (prices and discount terms), frequently asked questions, cyber liability insurance page and question set page.
• We couldn’t read the First Step application site, which needs JavaScript, or the National Cyber Security Centre’s requirements document, which wasn’t reachable from our system. So this post doesn’t cover the application screens or the detailed rules on what’s in scope.
• All of the pages above were read in full on 3 November 2026, and again on 5 November 2026, the morning we published. Every quotation was checked word for word against each page’s own text, and the discounted prices are our own arithmetic.