The certification fee is the cheapest part of Cyber Essentials. The real cost — and the part most SMEs underestimate — is the remediation work needed to actually pass.
The official certification fees (2026)
- Micro business (0–9 staff): $431 + VAT
- Small business (10–49 staff): $593 + VAT
- Medium business (50–249 staff): $700 + VAT
- Large business (250+ staff): $808 + VAT
Cyber Essentials Plus is priced by your assessor based on device count, locations and complexity — most UK SMEs land between $2,020 and $5,385 + VAT.
The hidden remediation costs
If your environment is in great shape, you pay the fee and move on. If it's not — and most aren't on first attempt — there's real work to do. Typical line items:
- MFA rollout across cloud services: usually included in existing licences, but takes IT time to configure and roll out.
- Endpoint management / MDM for laptops and mobiles: $5–$11 per device per month.
- EDR or modern anti-malware: $6–$14 per device per month.
- Patching automation tooling: often bundled with MDM/RMM.
- Removing standing admin rights and rebuilding a handful of devices.
- Decommissioning unsupported OS or software (often the most painful line item).
What UK SMEs actually pay, end-to-end
A realistic budget for a 25-person business going from 'no formal controls' to certified Cyber Essentials Plus:
- Assessment fees: $2,423–$3,366
- Tooling (MDM + EDR, year one): $4,039–$8,077
- Consultancy or internal time for remediation: $2,693–$6,731
- Total: roughly $9,423–$18,172 in year one, dropping significantly in year two as tooling becomes BAU.
Where managed services change the maths
If you're already on a managed cyber security subscription, most of this tooling and remediation is included — certification becomes a process exercise rather than a capex event. That's typically the cheapest path for an SME under 100 staff.
Next step
Want a costed plan for your business? Book a free 30-minute review and we'll give you a one-page breakdown of fees, tooling and remediation — no obligation.