How Much Does Cyber Essentials Plus Cost? (2026 UK Price Guide)
Cyber Essentials Plus from Layer 7 costs from £900 plus VAT, all in. That covers both the base Cyber Essentials certificate and the hands-on Plus audit. The only thing that changes the price is your organisation size, because that sets the standard IASME certification fee. We do not price by device count, so your quote does not balloon with the size of your estate. This guide shows exactly what you pay, what it includes, and the extra costs to budget for, updated for the April 2026 changes to the scheme.
Across the UK, Cyber Essentials Plus is often quoted between £1,400 and £4,000 plus VAT, usually priced by the number of devices. Layer 7 prices differently, and more simply.
We are an IASME-licensed Cyber Essentials Certification Body, and have been since the scheme launched in 2014. We run the hands-on Plus audit in-house, so the numbers below are exactly what you pay, not estimates.
Cyber Essentials Plus cost at a glance (2026)
Our combined price covers base Cyber Essentials and the Plus audit in one. It is set by your organisation size, which determines IASME’s certification fee. Nothing else moves it.
| Organisation size | Employees | Combined CE + CE+ (+VAT) |
|---|---|---|
| Micro | 0 to 9 | £900 |
| Small | 10 to 49 | £1,140 |
| Medium | 50 to 249 | £1,450 |
| Large | 250 or more | £1,800 |
Already hold a current Cyber Essentials certificate and only need the Plus audit? That starts at £580 plus VAT.
In short, a Layer 7 Cyber Essentials Plus runs from £900 plus VAT for the smallest organisations to £1,800 for the largest. Our entry price undercuts the market, and even our largest sits well below what other providers charge for large estates, which routinely runs to £4,000 or more. Very large or complex estates are confirmed at scoping.
What is included in your Cyber Essentials Plus price
A Cyber Essentials Plus fee normally covers:
- The IASME certification fee.
- The hands-on technical audit: an assessor independently tests a sample of your live systems, rather than taking your word for it.
- Assessor guidance through scoping and the assessment itself.
- Your certificate on a pass, valid for 12 months.
- One resubmission window if a small issue is found and fixed quickly.
What it does not include is major remediation. If the audit finds gaps that need real work to close, that work sits outside the certification fee. Good scoping up front keeps surprises to a minimum.
What sets the price, and what doesn’t
Two things set a Layer 7 Cyber Essentials Plus price, and only two:
- IASME’s certification fee, by your organisation size. This is a fixed, published rate for the base Cyber Essentials level: £320 for micro, £440 for small, £500 for medium, £600 for large, all plus VAT.
- Our certification work. The hands-on Plus audit and issuing your certificate.
That is the whole price. What does not change it is your device count, your number of users, or how many cloud apps you run. Most providers price the Plus audit by device count, which is why their quotes climb as your estate grows. We do not, so you know the figure up front.
The audit still samples your live systems, so a genuinely large or complex estate takes more time on the day, and we confirm those at scoping. For the vast majority of organisations, the price above is the price.
Remote or on-site: does it change the price?
No. The certification price is the same either way. Most Cyber Essentials Plus audits now run fully remotely, which is usually the faster route. On-site makes sense when devices cannot be accessed remotely, when a site has segregated networks, or when you simply prefer an assessor in the room.
Layer 7 certifies fully remotely, or on-site across the North East, whichever suits your environment. We agree the approach at scoping, with no surprise travel costs later.
Cyber Essentials vs Cyber Essentials Plus: the cost difference
Base Cyber Essentials is a verified self-assessment, priced by organisation size. Cyber Essentials Plus is the same five controls, then proven by an independent audit of your live systems. The audit is hands-on assessor work, which is why Plus costs more than the base level.
If you are still deciding which level you need, read our guide on the difference between Cyber Essentials and Cyber Essentials Plus, or see the base Cyber Essentials service.
Extra costs to budget for
Our combined price already includes base Cyber Essentials and the Plus audit, so there is no separate certificate fee to find. Two things can sit outside it:
- Remediation. If the audit finds gaps that need real work to close, such as unsupported software or controls that are not yet in place, fixing them is your cost, not ours.
- Annual renewal. Certification lasts 12 months, so the combined fee is an annual cost, not a one-off.
If a small issue is found at audit, a free resubmission window usually lets you fix it and be re-tested at no extra charge.
How the April 2026 changes (Danzell, v3.3) affect your cost
The Cyber Essentials requirements were updated in April 2026. The current question set is “Danzell”, running on Requirements for IT Infrastructure v3.3, in effect for applications from 27 April 2026. Two changes matter for budgeting:
- Multi-factor authentication on cloud services is now mandatory, and its absence is an automatic fail. If a cloud service supports MFA and it is not switched on, you fail, regardless of how strong everything else is.
- Critical security updates must be applied within 14 days, or you fail. This applies to operating systems, firmware and applications.
Neither change raises the certification fee directly. What they can change is your remediation budget. If MFA is not yet enforced across every cloud service, or patching is not consistently inside 14 days, that is work to do before the audit. Getting it right early is the cheapest path through Plus.
Free £25,000 cyber insurance you get back
There is value coming the other way too. UK-domiciled organisations that certify at the base Cyber Essentials level, with the whole organisation in scope and annual turnover under £20m, are included in the scheme’s cyber liability insurance: £25,000 of cover, included. It does not cancel out the cost of Plus, but it is worth factoring in.
Is Cyber Essentials Plus worth the cost?
For most organisations, yes. Cyber Essentials Plus is a frequent requirement in tenders and supply chains, so it wins and protects work. It proves your controls actually function, rather than declaring they do. And the cost of certifying is small against the cost of a breach the controls would have stopped.
How to get a fixed-price quote
We price Cyber Essentials Plus once scope is agreed, and we can often complete the audit in a single day from there. Email us with your organisation, rough device and user count, and what you need.
Get a fixed-price quote: hello@layer7.uk or see Cyber Essentials Plus certification.
Cyber Essentials Plus cost FAQs
How much does Cyber Essentials Plus cost? At Layer 7, a combined Cyber Essentials and Cyber Essentials Plus costs from £900 plus VAT for the smallest organisations, rising to £1,800 for the largest. The only variable is your organisation size, which sets IASME’s certification fee. If you already hold Cyber Essentials, the Plus audit alone starts at £580 plus VAT.
Why is Cyber Essentials Plus more expensive than Cyber Essentials? Cyber Essentials is a verified self-assessment. Cyber Essentials Plus adds an independent, hands-on audit of a sample of your live systems. That assessor time is the main reason Plus costs more.
Does the price include base Cyber Essentials? Yes. Our combined price covers both the base Cyber Essentials certificate and the Plus audit. If you already hold a current Cyber Essentials certificate, we charge from £580 plus VAT for the Plus audit alone.
What does it cost if we fail the audit? If a small issue is found, a free resubmission window usually lets you fix it and be re-tested at no extra charge. Larger remediation, or a re-test outside that window, can carry additional cost.
How is the Cyber Essentials Plus price calculated? By your organisation size, which sets IASME’s standard certification fee, alongside our certification work. We do not price by device count, so your quote does not grow with the size of your estate.
Do I get free cyber insurance? UK-domiciled organisations certifying at the base Cyber Essentials level, with the whole organisation in scope and turnover under £20m, are included in the scheme’s cyber liability insurance, currently £25,000 of cover.