The certification fee is the cheapest part of Cyber Essentials. The real cost — and the part most SMEs underestimate — is the remediation work needed to actually pass.
The official certification fees (2026)
- Micro business (0–9 staff): £320 + VAT
- Small business (10–49 staff): £440 + VAT
- Medium business (50–249 staff): £520 + VAT
- Large business (250+ staff): £600 + VAT
Cyber Essentials Plus is priced by your assessor based on device count, locations and complexity — most UK SMEs land between £1,500 and £4,000 + VAT.
The hidden remediation costs
If your environment is in great shape, you pay the fee and move on. If it's not — and most aren't on first attempt — there's real work to do. Typical line items:
- MFA rollout across cloud services: usually included in existing licences, but takes IT time to configure and roll out.
- Endpoint management / MDM for laptops and mobiles: £3–£8 per device per month.
- EDR or modern anti-malware: £4–£10 per device per month.
- Patching automation tooling: often bundled with MDM/RMM.
- Removing standing admin rights and rebuilding a handful of devices.
- Decommissioning unsupported OS or software (often the most painful line item).
What UK SMEs actually pay, end-to-end
A realistic budget for a 25-person business going from 'no formal controls' to certified Cyber Essentials Plus:
- Assessment fees: £1,800–£2,500
- Tooling (MDM + EDR, year one): £3,000–£6,000
- Consultancy or internal time for remediation: £2,000–£5,000
- Total: roughly £7,000–£13,500 in year one, dropping significantly in year two as tooling becomes BAU.
Where managed services change the maths
If you're already on a managed cyber security subscription, most of this tooling and remediation is included — certification becomes a process exercise rather than a capex event. That's typically the cheapest path for an SME under 100 staff.
Next step
Want a costed plan for your business? Book a free 30-minute review and we'll give you a one-page breakdown of fees, tooling and remediation — no obligation.