HOW MUCH DOES CYBER ESSENTIALS PLUS COST IN 2026?

THE SHORT ANSWER

Already hold Cyber Essentials? Cyber Essentials Plus costs £1,195 + VAT for micro organisations (0-9 employees), £1,495 + VAT for small (10-49), £2,195 + VAT for medium (50-249), and £3,495 + VAT for large (250+). That covers the full independent technical audit, your CE Plus certificate, and the IASME certification fee. No hidden charges.

Starting from scratch? Our CE + CE Plus bundle starts from £1,439 + VAT for micro organisations, saving £151 compared to buying CE and CE Plus separately. The bundle covers both certifications end-to-end in a single engagement.

All pricing is fixed by organisation size alone - no device-count uplift, no add-ons. Vincent Cyber Defence is an IASME Approved Certification Body.

WHY DOES CE PLUS COST MORE THAN STANDARD CE?

Standard Cyber Essentials is a self-assessment - you complete a questionnaire, your Certification Body reviews it, and your certificate is issued. Cyber Essentials Plus requires an independent technical audit on top of that. An IASME-approved assessor remotely connects to your environment, runs external and internal vulnerability scans, tests email and browser configurations, and actively verifies that your five security controls are working - not just documented.

That hands-on work takes more time and expertise, which is why CE Plus costs more. The difference is real: Plus provides a significantly higher level of assurance, which is why some contracts specifically require it.

CE VS CE PLUS: KEY DIFFERENCES AT A GLANCE

This page covers CE Plus pricing specifically. For standard Cyber Essentials pricing, see our CE cost guide →

WHAT AFFECTS CE PLUS PRICING?

• Organisation size: Pricing is based on your total number of employees using UK Government size criteria
• Network complexity: More devices, sites, cloud services, and in-scope systems mean a more complex audit
• Readiness: If controls need significant work before the audit can take place, that affects timelines but not the certification fee itself
• Certification body: Different IASME Approved Bodies set their own service fees on top of the fixed IASME body fee

DOES DEVICE COUNT AFFECT THE PRICE?

Most CE Plus certification bodies price by the number of devices in scope - the more devices you have, the higher the quote. At Vincent Cyber Defence, CE Plus pricing is based on organisation size alone. A micro organisation with 50 devices pays the same as one with 5. Your quote does not change because of the size of your estate.

The IASME certification fee is also fixed by organisation size, so both components of what you pay are set by headcount, not device count. If you receive a CE Plus quote from any provider that varies by device number, ask for the basis of their pricing - it is not a requirement of the IASME scheme, and it makes costs unpredictable as your estate grows.

CE PLUS PRICING - FOR ORGANISATIONS THAT ALREADY HOLD CE

If you already hold a valid Cyber Essentials certificate - whether recently certified or renewing year-on-year - the prices below cover the full CE Plus process: independent technical audit, certificate, and IASME fee. No CE fee applies. All prices exclude VAT.

BUNDLE CE AND CE PLUS - AND SAVE

Since Cyber Essentials is a mandatory prerequisite for CE Plus, most organisations complete both as a single engagement. When you take CE and CE Plus together as a bundle, the combined price is lower than buying them separately - and we manage the whole process end-to-end, so the 90-day window between CE basic and CE Plus is built into the project timeline.

All prices exclude VAT. IASME certification fees included.

All bundle prices include the IASME certification fees for both CE and CE Plus, a single Pre-Assessment Check, and the same no-surprises guarantee - no device-count uplift, no recheck charge within the assessment window. View bundle pricing →

Enterprise organisation pricing depends on the scope and complexity of the audit. Contact us for a fixed-price quote specific to your environment.

WHAT IS INCLUDED IN THE PRICE?

A good CE Plus certification fee should cover the entire end-to-end process. At Vincent Cyber Defence, our price includes all of the following - with no optional extras bolted on:

• Cyber Essentials self-assessment - we explain each requirement and review your draft responses; you complete and sign the declaration yourself
• Audit readiness checklist - we confirm what the audit will test so you know exactly what needs to be in place before the assessment date
• Pre-Assessment Check - an in-depth review of your controls against CE Plus requirements before the formal audit begins, so any gaps are identified early and you enter the audit in the strongest position
• Independent technical audit - conducted remotely by our IASME-approved assessors
• External vulnerability scanning - of your internet-facing systems and boundary controls
• Internal vulnerability scanning - of a sample of in-scope devices
• Email and web browser configuration checks - verifying controls are correctly applied
• CE Plus certificate and digital badge - valid for 12 months from date of certification
• IASME public register listing - confirming your certified status publicly
• Full technical assessment report - documenting findings and confirming compliance
• One free 30-day rescan - if issues are identified during the technical audit, a single rescan to verify remediation is included at no extra charge (IASME timelines apply)
• UK-based support throughout - plain-English guidance at every stage

REMOTE VS ON-SITE: DOES IT AFFECT THE PRICE?

No. All Vincent Cyber Defence CE Plus assessments are conducted fully remotely. The price is the same regardless of where your organisation is based or whether your systems are on-premises, cloud-hosted, or a combination of both.

Remote assessment is now standard for CE Plus across the industry. The technical audit - vulnerability scanning, device configuration checks, email and browser testing - is conducted securely over a remote connection agreed in advance with your technical contact. It is faster to schedule, involves no travel costs, and covers the vast majority of CE Plus environments without any compromise to the rigour of the audit.

If your specific environment requires on-site testing - for example, air-gapped systems or networks that cannot be accessed remotely - discuss this at scoping. Remote is the default and the price remains the same either way.

ARE THERE ANY EXTRA COSTS?

This is where some providers catch organisations out. Here is what to watch for - and how our approach differs.

Remediation costs

If issues are found during the audit, you will need to fix them. The IT support required to remediate your systems (patching, reconfiguring devices, updating software) costs what it costs - that is outside the scope of your certification fee and depends on your internal resource or IT provider. However, the re-check of the audit itself - verifying that your fixes are in place - should not come with an additional certification charge within the same assessment window.

Two time limits apply simultaneously if issues are found: you have 30 days from the date the CE Plus assessment started to remediate and have checks revisited, and this must also fall within your 90-day window from CE basic certification. Whichever expires first is the binding deadline. Going into the audit with all controls already in place is the most effective way to protect both windows.

Resubmission fees

Check any certification body's policy on resubmission carefully. At Vincent Cyber Defence, if issues are identified and you remediate them, we work with you to reach certification without surprise additional invoices.

ANNUAL RENEWAL: WHAT DOES CE PLUS COST EACH YEAR?

CE Plus certification is valid for 12 months. There is no grace period - once your certificate expires, you are no longer certified. Renewal requires repeating the full process: CE self-assessment followed by the independent technical audit.

The renewal fee is the same as the initial certification fee. There is no reduced renewal rate built into the IASME scheme. Budget for CE Plus as an annual cost, not a one-off.

What does typically reduce from year two onwards is preparation time. Once your controls are embedded and your environment is correctly configured, the audit usually runs more smoothly than the first time. But the certification fee remains the same.

HOW DOES CE PLUS COST COMPARE TO ISO 27001?

CE Plus sits at the more affordable end of the independent security certification spectrum. Here is how it compares to the standards UK organisations are most commonly asked about:

For most UK businesses bidding on government or enterprise contracts, CE Plus provides independent technical assurance at a fraction of the cost of ISO 27001. ISO 27001 covers a broader scope - policies, risk management, full ISMS documentation - but is significantly more expensive and time-consuming to achieve. If your contracts specify CE Plus, there is rarely a commercial reason to spend more on ISO 27001 unless you are also pursuing international enterprise recognition.

IS CE PLUS WORTH THE COST?

The UK Government's Cyber Security Breaches Survey 2025 reported that the median cost of a cyber attack was £1,600 for all businesses, rising to £10,830 for medium and large businesses. For organisations in regulated sectors -handling patient data, financial records, or MOD supply chain information -the true cost of a breach includes regulatory scrutiny, contract damage, and customer notification obligations that push the figure far higher.

CE Plus does two things standard CE cannot: it tests that your controls are actually working in practice, not just documented on paper, and it provides independent third-party evidence that reduces your attack surface and satisfies enterprise and public sector procurement filters. For organisations ready to move forward, our Cyber Essentials Plus certification service covers the full process from pre-assessment through to certificate. For organisations whose contract pipeline depends on CE Plus, the cost of not holding it is the cost of losing those contracts.

DOES CE PLUS INCLUDE FREE CYBER INSURANCE?

Yes - UK-registered organisations with an annual turnover under £20 million that achieve Cyber Essentials certification covering their whole organisation are automatically entitled to free cyber insurance up to £25,000, provided through IASME. This applies at the basic CE level and carries through to CE Plus. It is included at no additional cost with your certification and requires no separate application.

Many commercial cyber insurers also offer reduced premiums or improved policy terms to CE-certified organisations. It is worth informing your broker of your certification status once you are certified.

IS CE PLUS MANDATORY?

Cyber Essentials Plus is not universally mandatory - but it is required in specific situations. Standard Cyber Essentials is mandatory for all UK Government contracts involving personal data or the supply of certain ICT products and services. CE Plus is required by some MOD supply chain contracts involving sensitive or classified data, certain NHS and public sector frameworks, and enterprise clients who want independent technical verification rather than self-assessment.

If your contract tender or supplier requirements document specifies CE Plus, or references an "independent technical audit", standard CE will not be sufficient. If you are unsure what your contract requires, our team can review the wording and advise.

WHICH SECTORS REQUIRE CE PLUS?

CE Plus is required or strongly expected in these sectors and frameworks:

• NHS and health sector -NHS Digital Supply Chain Security requirements and DTAC vetting for digital health tools expect CE Plus for suppliers handling sensitive clinical data.
• MOD and defence supply chain -some DEFCON contracts involving sensitive or classified data specify CE Plus. Note: DCC Level 0 for all MOD suppliers requires CE basic as a prerequisite, not CE Plus.
• Financial services -enterprise financial clients and FCA-regulated firms increasingly require CE Plus as part of third-party supplier due diligence and operational resilience obligations.
• Central government and public sector -frameworks beyond the baseline mandate, including higher-tier G-Cloud procurement and NCSC-aligned assurance programmes, require CE Plus or equivalent independent verification.
• Enterprise supply chains -large private sector buyers are moving from accepting self-assessed CE to requiring CE Plus for suppliers with access to sensitive customer data or critical systems.

DO YOU NEED CE OR CE PLUS?

Use this to decide:

• Your contract says “Cyber Essentials” -standard CE is sufficient
• Your contract says “Cyber Essentials Plus” or “independent technical audit” -CE Plus is required
• You supply to the NHS and handle clinical data -CE Plus is expected
• You need MOD DCC Level 0 -CE basic is the prerequisite, CE Plus is not required
• You want independent assurance for enterprise procurement -CE Plus provides third-party verification
• You are applying for cyber liability insurance -CE Plus carries more weight with underwriters than self-assessed CE

If you are unsure what your contract requires, share the wording with us and we will confirm which level applies.

THE 90-DAY CE PLUS WINDOW - AND WHY IT MATTERS

Just certified CE and ready to move to Plus? You are in the 90-day window - the standalone CE Plus prices above apply. Once you pass Cyber Essentials basic, you have 90 days (3 months) from your CE certification date to complete and pass CE Plus. This window is set by IASME and is strictly enforced. If you do not pass CE Plus within 90 days, your Plus application closes and you will need to re-certify at Cyber Essentials basic level before restarting the Plus process - incurring an additional certification cost.

This makes preparation essential. Working through the audit readiness checklist before the assessment begins ensures that when you enter the 90-day window, your controls are already in the right position to pass first time. The earlier any gaps are addressed, the more runway you have for the audit and any follow-up checks within the window.

Your CE Plus certificate validity (12 months) runs from the date you pass the Plus audit - not from when the CE basic was certified.

HOW VINCENT CYBER DEFENCE SUPPORTS YOUR CE PLUS CERTIFICATION

The certification fee is only part of the picture. What matters is whether you pass first time - because a failed audit costs more in remediation time, missed deadlines, and the risk of your 90-day window expiring. Here is how we make sure that does not happen.

• Pre-Assessment Check included as standard - before the formal audit begins, we review your controls against every CE Plus requirement. Gaps are identified and resolved with you ahead of the assessment date. Most certification bodies skip this step entirely - or charge extra for it.
• Guided CE basic submission - we support you through the Cyber Essentials self-assessment questionnaire, explaining requirements and reviewing your draft responses. You complete and sign the declaration yourself, but you are not left to work through it alone.
• Direct lead assessor throughout - you deal with one named assessor from first contact through to your certificate. No helpdesk, no account managers, no rotating contacts. The person who audits your systems is the person who answers your questions and signs off your result.
• Free rescan included - if issues are identified during the technical audit, one rescan to verify remediation is included in your fee. No additional charge. Most providers bill this separately.
• Clear remediation guidance - if anything needs fixing, your assessor provides specific, actionable steps you can hand directly to your IT team or provider. No vague findings, no guesswork.

The goal is straightforward: by the time the formal audit begins, you should already know you are going to pass. That is what the Pre-Assessment Check is designed to achieve, and it is included in every CE Plus engagement at no extra cost.

WHY DO ORGANISATIONS FAIL CE PLUS?

The first-time pass rate for CE Plus is lower than for standard Cyber Essentials - because the audit actively tests your controls against live systems rather than reviewing questionnaire answers. The most common failure reasons are:

• Secure configuration - default passwords not changed on devices or services, unnecessary services still running, administrative interfaces left exposed. This is the single most commonly failed control.
• Malware protection - endpoint protection not active on all in-scope devices, out-of-date signature databases, or protection software that fails simulated bypass tests.
• Patching - critical and high-severity patches not applied within the 14-day window. End-of-life operating systems or unpatched third-party applications (browsers, plugins, productivity software) are the most common cause.
• MFA - multi-factor authentication not enabled on cloud services or remote access points, or only enforced for administrators rather than all users.
• BYOD devices - personal mobile devices accessing corporate email or data without device management, running unsupported OS versions, or without device-level security controls configured.

The readiness checklist below covers all seven areas the audit tests. Working through it before your assessment date is the most effective way to avoid these failure points - and to protect the 30-day remediation window if the audit does find an issue.

CE PLUS AUDIT READINESS CHECKLIST

The CE Plus technical audit tests seven key control areas live against your systems. Before your assessment date, confirm all seven are in place - once the assessment starts, the 30-day remediation clock is running. We have built a free interactive checklist covering all 30 sub-items across the seven areas, with a live progress score and print option.

• Antivirus / endpoint protection - active and up to date on all in-scope devices
• Account separation - admin and standard user accounts properly separated; no shared credentials between roles
• Patching - all security updates applied within 14 days of release across operating systems, firmware, and applications
• Mobile devices - not jailbroken or rooted; apps installed only from authorised application stores; managed and controlled appropriately
• Malicious content blocking - executable downloads and malicious test emails blocked at the network boundary
• External vulnerabilities - no known exploitable vulnerabilities present on internet-facing systems
• MFA - multi-factor authentication enabled on all cloud services for all users, not just administrators

→ Open the full interactive CE Plus readiness checklist (30 items, progress tracker, print-friendly)