Cyber Essentials
Cyber Essentials basic certification costs from £450 + VAT per year. Cyber Essentials Plus costs from £1,350 + VAT per year for organisations with up to nine users. Pricing is tiered by the number of users in your organisation, and every Cyber Essentials Plus package from Forensic Control includes 12 months of continuous vulnerability scanning at no extra cost. Most certification bodies either do not offer this or charge for it separately.
This page sets out current pricing for Cyber Essentials Plus, Cyber Essentials Basic and our combined Cyber Essentials Duo package. It explains what each includes and helps you decide which is right for your organisation.
| Cyber Essentials Basic Self-assessed certification, independently verified | |
|---|---|
| Organisation size | Annual price |
| 1–9 users | £450 + VAT |
| 10–49 users | £650 + VAT |
| 50–249 users | Contact us |
| 250+ users | Contact us |
| Cyber Essentials Plus Independent technical audit. Includes 12 months vulnerability scanning at no extra cost. | |
|---|---|
| Organisation size | Annual price |
| 1–9 users | £1,350 + VAT |
| 10–49 users | £1,600 + VAT |
| 50–249 users | Contact us |
| 250+ users | Contact us |
| Cyber Essentials Duo — Basic and Plus combined Both certifications in a single engagement. Includes 12 months vulnerability scanning at no extra cost. | |
|---|---|
| Organisation size | Annual price |
| 1–9 users | £1,800 + VAT |
| 10–49 users | £2,250 + VAT |
| 50–249 users | Contact us |
| 250+ users | Contact us |
Prices correct as of July 2026. All prices are per year, exclusive of VAT, and include the IASME certification fee.
The government’s Cyber Security Breaches Survey 2025 found that 43% of UK businesses had experienced a cyber security breach or attack in the previous 12 months. For the businesses affected, the impact ranges from lost working time and lost data to lost customers and reputational damage.
Cyber Essentials is designed to protect against around 80% of the most common cyber attacks. For a 1 to 9 user organisation, Cyber Essentials Basic costs £450 + VAT per year. Cyber Essentials Plus, which adds an independent technical audit and continuous vulnerability scanning, costs £1,350 + VAT per year.
Insurer data reported by the National Cyber Security Centre shows that organisations with Cyber Essentials are 92% less likely to make a claim on their cyber insurance than those without it. For organisations that are required to hold cyber insurance, certification may reduce premiums as well as risk.
Cyber Essentials Duo covers both Cyber Essentials Basic and Cyber Essentials Plus in a single engagement with a single assessor. For most organisations that know they want full coverage, it is the most straightforward route to both certifications.
The price comparison is transparent. For a 10 to 49 user organisation, Cyber Essentials Basic costs £650 + VAT and Cyber Essentials Plus costs £1,600 + VAT, a total of £2,250 + VAT if bought separately. Cyber Essentials Duo costs £2,250 + VAT. The price is the same, but there is no separate process, no three-month deadline between the two certifications, and no risk of your Basic certificate expiring before the Plus assessment is completed.
For organisations with 1 to 9 users, Duo costs £1,800 + VAT, the same as buying Basic and Plus separately, with a simpler process.
If you are confident you want both certifications, Duo removes the complexity without adding cost. If you would rather start with Basic and then decide whether to proceed to Plus, buying them separately is a reasonable approach. Just be aware that Cyber Essentials Plus must be completed within three months of your Basic certification.
Cyber Essentials Plus goes beyond the self-assessed Basic certification. Where Basic asks you to confirm your controls are in place, Plus involves an independent assessor testing that they actually work, examining your systems directly rather than reviewing your answers.
Every Cyber Essentials Plus and Cyber Essentials Duo package from Forensic Control includes:
| Cyber Essentials requires high-risk and critical vulnerabilities to be fixed within 14 days of an update becoming available. Continuous vulnerability scanning gives you an ongoing view of what needs patching, rather than relying on a single annual snapshot. Most certification bodies charge separately for this. At Forensic Control it is included with every Plus and Duo package. |
Not sure where you stand? Our free Cyber Essentials readiness tool gives you a clear picture of your current security posture in under five minutes, with no commitment required.
No. The version 3.3 update to the Cyber Essentials scheme, which took effect on 27 April 2026, did not change certification fees. Pricing remains as shown above.
What changed is the assessment itself. Multi-factor authentication (MFA) is now mandatory for every cloud service that offers it. If a cloud service in your scope has MFA available and it is not enabled for all users, the assessment is an automatic fail. Cloud services can no longer be excluded from your assessment scope, and the scheme now encourages passwordless sign-in methods such as passkeys. These changes affect what you need to have in place before your assessment, not how much you pay for it.
If you are not yet compliant with the current requirements, our free Cyber Essentials readiness tool will show you where the gaps are. You can also read our full guide to the Cyber Essentials version 3.3 update for a complete explanation of what changed and what can cause an automatic failure.
Forensic Control is a licensed Certification Body under the IASME scheme, the National Cyber Security Centre’s official delivery partner for Cyber Essentials. In practice, that means we assess your systems and issue your certificate directly. We are not a reseller passing your application to a third party to mark.
We have been issuing Cyber Essentials and Cyber Essentials Plus certifications since 2017. Our assessments are led by Jonathan Krause, who founded Forensic Control after a career securing UK central government systems and working as a digital forensics investigator at New Scotland Yard’s Hi-Tech Crime Unit. We have 44 Google reviews averaging five stars and have certified more than 400 organisations, from two-person businesses to large public bodies including Ofsted and the Church of England.
| “Expert and friendly support towards our achieving Cyber Essentials Plus certification. Clearly laid out the expectations for meeting the standards and navigated us through. Kept us on track even when business demands were pulling our attention elsewhere.” – Forensic Control client, verified Google review |
Cyber Essentials Plus costs from £1,350 + VAT per year for organisations with up to nine users, and £1,600 + VAT per year for organisations with 10 to 49 users, with Forensic Control. For organisations with 50 or more users, contact us for a tailored quote. Every Cyber Essentials Plus package includes 12 months of vulnerability scanning at no extra cost, and there is no charge for resubmissions..
Cyber Essentials Basic costs from £450 + VAT per year for organisations with up to nine users, and £650 + VAT for 10 to 49 users. Cyber Essentials Plus costs from £1,350 + VAT per year for up to nine users. Cyber Essentials Duo, which covers both Basic and Plus in a single engagement, costs from £1,800 + VAT per year. All prices are per year and include the IASME certification fee.
Pricing is tiered by number of users. For 1 to 9 users: Basic £450 + VAT, Plus £1,350 + VAT, Duo £1,800 + VAT. For 10 to 49 users: Basic £650 + VAT, Plus £1,600 + VAT, Duo £2,250 + VAT. For organisations with 50 or more users, contact Forensic Control for a tailored quote. All prices are per year, exclusive of VAT, and include the IASME certification fee.
Cyber Essentials Duo covers both Cyber Essentials Basic and Cyber Essentials Plus in a single engagement. The price is the same as buying the two certifications separately. For 1 to 9 users, Duo costs £1,800 + VAT, the same as Basic and Plus bought individually. The advantage of Duo is that there is no three-month deadline to manage between the two certifications and the process is simpler. Vulnerability scanning is included throughout.
The government’s Cyber Security Breaches Survey 2025 found that 43% of UK businesses were breached or attacked in the previous year. Cyber Essentials is designed to protect against around 80% of the most common cyber attacks, and insurer data reported by the National Cyber Security Centre shows certified organisations are 92% less likely to make a cyber insurance claim. Cyber Essentials Basic starts from £450 + VAT per year.
No. The version 3.3 update, which took effect on 27 April 2026, did not change certification fees. It changed the technical requirements for the assessment, in particular multi-factor authentication (MFA), which is now an automatic fail if it is available on a cloud service in scope but not enabled for all users. Forensic Control’s pricing is unchanged.
Safeguard your business with our expert cyber security solutions. Whether you require digital forensics, penetration testing or proactive security assessments, our team is ready to assist. Contact us today to discuss your security needs and take the first step towards a more secure future.
