In short
Cyber Essentials Plus cost is not set on a fixed scale. The NCSC lists Plus as quoted, priced according to the size and complexity of your network, and the audit is carried out by an IASME-licensed Certification Body. You also need a current Cyber Essentials certificate, whose fee IASME bands by organisation size, plus any remediation needed to pass.
Get a quote for Cyber Essentials Plus cost and quote
Ask us for a quote and we will reply by email with options priced for your organisation.
Why Cyber Essentials Plus is quoted, not fixed
The verified self-assessment for Cyber Essentials basic certification has a fixed fee from IASME, banded by employee count. Cyber Essentials Plus is different. The NCSC lists it as quoted, priced according to the size and complexity of your network, and the audit is quoted by the Certification Body that carries it out.
Plus is a hands-on audit: an assessor scans your public IP addresses, runs authenticated scans and observed tests on a sample of devices and cloud accounts, and reviews every result. How much testing that takes depends on your estate, not just your headcount.
The total cost of holding Plus has three parts:
- The Cyber Essentials self-assessment fee, because Plus builds on a current Cyber Essentials certificate covering the same scope. See Cyber Essentials certification cost.
- The Plus audit fee, quoted by the Certification Body.
- Remediation before the audit: the work and licences needed so that every sampled device and account passes.
What drives the audit fee
The NCSC names one pricing factor for Plus: the size and complexity of your network. The NCSC's *Cyber Essentials Plus Test Specification* shows what that means in practice, because it sets how much the assessor has to test.
| Part of your estate | What the test specification requires |
|---|---|
| End user devices and servers | The assessor tests a representative sample of devices, sized using the method set by IASME as Delivery Partner. The number needed depends on how much variation there is in how your devices are set up |
| How standardised your builds are | Where servers and end user devices share standardised configurations, much of the estate can be covered by a small number of representative samples |
| Cloud services and sign-in services | Each cloud service is tested with at least one normal and one administrative user; where several cloud services share an authentication service, the MFA test is done once for that service |
| Internet-facing IP addresses | Every IP address associated with your organisation is scanned with an approved vulnerability scanning tool |
| Servers and IaaS | The authenticated patch scan covers sampled end user devices, servers and infrastructure-as-a-service instances |
| Retests | Under Danzell, if the update check fails, the retest covers the original sample plus a new random sample, and a second failure revokes the verified self-assessment certificate |
Not sure which option fits? Ask us
We will match the right option to your requirements and quote for it, with no hard sell.
Remediation before the audit
Every sampled device and account has to pass, so the work needed beforehand is part of the cost. The controls the five test cases check most directly are:
- replacing or upgrading devices on unsupported operating systems, such as Windows 10 devices without Extended Security Updates
- clearing critical and high-risk updates older than 14 days, including third-party applications and firmware
- licensing or switching on MFA for every cloud service, for standard users and admins alike
- malware protection that blocks the assessor's test files delivered by email and from the web
- removing local admin rights from everyday accounts, so the account separation test passes
The Cyber Essentials Plus requirements page explains what each test case needs, the Cyber Essentials Plus audit page covers sampling and test day, and Cyber Essentials Plus vulnerability scans covers the two scans in detail.
How to keep Cyber Essentials Plus costs down
- Pass first time. Rehearse the tests before the assessor arrives. A retest under Danzell is bigger than the original test, and a second failure costs you the self-assessment certificate too.
- Standardise devices. Managing laptops and phones through device management, such as Microsoft Intune, keeps builds consistent, which can mean fewer samples.
- Consolidate sign-in. Putting cloud services behind single sign-on with one strong MFA policy means fewer authentication services to test.
- Plan both stages together. Book the Plus audit when you submit the self-assessment, so testing falls inside the three-month window and you do not have to repeat the self-assessment.
- Scope sensibly. A whole-organisation scope is simplest. A sub-set only reduces the work if it is genuinely segregated, and the assessor checks that technically.
Want a price for your organisation?
Tell us your users, sites and timescales and we will come back with a clear quote, with no obligation.
Paying every year
Cyber Essentials Plus certificates last 12 months, the same as Cyber Essentials. Keeping Plus means renewing the self-assessment and repeating the Plus testing every year, so budget for both annually; see Cyber Essentials renewal.
For some enterprise-scale organisations with complex or legacy estates, the NCSC is developing Cyber Essentials Pathways, an alternative route to Plus. The NCSC expects it to cost more than the standard route, because alternative controls take more effort to assess.
How we help, and getting a quote
Forever Systems prepares you for the Plus audit and works alongside an IASME-licensed Certification Body, which carries out the testing and issues the certificate. We rehearse the five test cases, fix what fails and help you line up users, devices and the test mailbox for the day, so the audit you pay for is the one you pass.
Prices depend on your devices, cloud services, sites and starting point, so ask us for a quote. Contact us with a rough count of users, devices and cloud services.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Frequently asked questions
How much does Cyber Essentials Plus cost?
There is no fixed price. The NCSC lists Plus as quoted, priced according to the size and complexity of your network, and the Certification Body carrying out the audit quotes for it. You also need a current Cyber Essentials certificate, with its own fee, plus any remediation.
Why does Cyber Essentials Plus cost more than Cyber Essentials?
Plus adds hands-on testing by an assessor: an external scan, authenticated patch scans, malware tests, MFA sign-in checks and an account separation test on a sample of your systems. Because that work depends on your estate, the NCSC lists Plus as quoted rather than on the tiered scale used for Cyber Essentials.
Is the Cyber Essentials fee included in the Plus price?
Treat them as separate costs. Plus builds on a current Cyber Essentials certificate covering the same scope, so you pay for the verified self-assessment and then for the Plus audit.
Does a failed Cyber Essentials Plus audit cost more?
It can. Under Danzell, a failed security update sample is retested with the original sample plus a new random sample, and a second failure revokes your self-assessment certificate. Rehearsing the tests first is the cheapest way to avoid that.
Do I have to pay for Cyber Essentials Plus every year?
Yes, to keep it. Certificates last 12 months, so you renew the self-assessment and repeat the Plus testing each year against the requirements in force at the time.
Still have a question about Cyber Essentials Plus cost and quote?
Ask us and a member of our team will reply by email.