Cyber Essentials Plus Cost (2026 UK Prices)

Cyber Essentials Plus costs between £999 and £3,999 + VAT at the UK providers we reviewed in September 2026, and organisation size accounts for most of the difference. A micro business (0 to 9 staff) pays £999 to £1,499 for the audit; an organisation with 250 or more staff pays £2,999 or more. Beyond size, your actual Cyber Essentials Plus cost depends on how many operating system versions need testing, whether the basic Cyber Essentials assessment is included, whether the audit is remote or on-site, and whether anything fails and needs a retest.

Sovereign Secure is an IASME-licensed Cyber Essentials certification body. We don’t publish a CE+ price list, because two 40-person companies can need very different audits. We give you a fixed quote after a five-minute scoping questionnaire, and every quote includes the basic Cyber Essentials assessment.

How much does Cyber Essentials Plus cost in 2026?

The table shows the prices UK providers publish on their own websites, collected in September 2026. All figures exclude VAT and are per certification.

Sources: published prices from UK providers we reviewed in September 2026; basic Cyber Essentials fee bands as published by IASME. One provider also lists an “Enterprise” band above Large at £3,999, and a third provider advertises CE+ from £1,475.

Three things are worth knowing before you compare numbers:

• The headline price is not always the total. One provider sells the basic self-assessment as a £320 add-on to its CE+ product, so a micro business pays £1,819 there, not £1,499.
• Size bands follow the basic scheme. Providers that price by size use the same micro, small, medium and large bands IASME uses for basic Cyber Essentials, so the staff count you declare sets your band.
• Quote-based pricing is normal. IASME sets fixed fee bands only for basic Cyber Essentials; certification bodies price the Plus audit themselves, based on how much there is to test. The NCSC Cyber Essentials overview explains how the two levels differ. Size bands are a starting point, not the final figure.

For the basic scheme on its own, see our Cyber Essentials cost page, with packages from £320 + VAT.

Does the Cyber Essentials Plus price include Cyber Essentials?

Not always, so check before you compare quotes. You must achieve Cyber Essentials basic certification before the Plus audit, and the audit must be completed within three months of that certificate. Some certification bodies price the two separately; others bundle them.

Sovereign Secure includes the basic Cyber Essentials assessment in every Cyber Essentials Plus quote, so you deal with one certification body and one timeline. Whoever you use, ask these questions before you sign:

What drives the cost of Cyber Essentials Plus?

Assessor time. The CE+ audit is a hands-on test of a sample of your devices, your internet-facing IP addresses and your cloud accounts, following the NCSC Cyber Essentials Plus Test Specification. Anything that adds devices, locations or checks adds time, which is why we price on the number of devices, sites and cloud services in scope.

How the device sample is calculated

The sample is set per operating system version, not per organisation:

Here is an illustrative 40-person firm, before and after moving every Windows laptop to the same feature release:

Three fewer devices means a shorter audit and three fewer chances to fail a patching test. Our scoping questionnaire estimates your sample automatically as you enter device numbers.

Is an on-site Cyber Essentials Plus audit more expensive?

Usually, yes. An on-site audit adds the assessor’s travel time and expenses, and a multi-site organisation may need more than one visit. Most of our audits are remote: we provide a scanning tool, and your administrator shares their screen (Microsoft Teams, Quick Assist or similar) while we test the sample devices.

A remote audit works when you have:

• an administrator available throughout, able to view or control every sample device at every site;
• our scanning software installed on one designated machine before the day;
• the asset declaration form returned at least two weeks before the audit.

On-site audits are available when remote access isn’t practical, including on-site audits in London. Say so in the scoping questionnaire and the quote will reflect it.

What does a Cyber Essentials Plus retest cost?

At Sovereign Secure, a remote retest of up to one hour within one month of the audit is free. Other retests start at £400 + VAT. You provide evidence of the fix and we retest the failed items. If the retest isn’t completed within the month, a full new assessment and a new quote are needed.

Retest terms vary between providers, so read them before you buy. Among the providers we reviewed, one includes “several free rescans” only in a £1,200 extra-help package and allows 30 days for remediation.

Failures come from the things the audit tests directly:

• a sample device missing a high or critical security update (Cyber Essentials requires these within 14 days of release);
• anti-malware that doesn’t block the test files we send by email and download in the browser;
• a browser that runs downloaded files without a warning;
• a cloud service without multi-factor authentication enforced.

Work through our Cyber Essentials Plus requirements checklist before audit day to catch these early.

How does the three-month rule affect the cost?

The CE+ audit must be completed within three months of your Cyber Essentials certificate being issued. If the window closes, the basic assessment has to be repeated before the audit can go ahead, so you pay for it twice.

To stay inside the window:

1. Book the CE+ audit date before you submit the basic assessment.
2. Return the asset declaration form at least two weeks before the audit.
3. Submit the basic Cyber Essentials assessment at least one week before the audit.
4. Leave time to fix and retest within a month if anything fails.

Audit availability is the main timing risk. One provider we reviewed quotes a 2 to 3 week waiting list and charges £800 to audit within a week.

Are mock audits, fast track and multi-year plans worth paying for?

These are the add-on prices published by the providers we reviewed (ex VAT):

A mock audit makes most sense for a first CE+ when you have no in-house IT team or many operating system versions. If your IT provider already applies updates within 14 days and you have passed before, it is often an avoidable cost, because a free remote retest covers small slips. Before you pay for one, try our free readiness check to see where the gaps are. If you want help getting ready, see our Cyber Essentials consultancy support.

How does the total cost compare with basic Cyber Essentials?

The extra spend buys independent evidence that your controls work in practice, which is what some public sector, defence and enterprise contracts ask for. Our Cyber Essentials Plus certification page explains what the audit covers, and our Cyber Essentials Plus comparison guide helps you decide which level you need.

Why get your Cyber Essentials Plus quote from Sovereign Secure?

Sovereign Secure Ltd is an IASME-licensed Cyber Essentials certification body, established in 2012 and based in Accrington, Lancashire.

• One supplier for CE and CE+. We issue both certificates, and the basic assessment is included in every CE+ quote.
• Remote by default. Less disruption for multi-site and home-working teams, with on-site audits when you need them.
• Clear retest terms. A free remote retest of up to one hour within a month; otherwise from £400 + VAT.
• More than Cyber Essentials. We are also a PCI SSC Qualified Security Assessor (QSA) company and ISO 27001 certified, and our penetration testing team can take you further than CE+ when a customer asks for it.

Get a fixed Cyber Essentials Plus quote

Complete our Cyber Essentials scoping questionnaire. It takes about five minutes, rough numbers are fine, and it estimates your device sample as you go. We confirm your scope and send a fixed quote with the basic Cyber Essentials assessment included. Prefer to talk it through? Call +44 161 523 5276 or use the CE+ quote request form.