Is Cyber Essentials worth it?

For most five-person businesses, the security steps behind Cyber Essentials are worth doing, and the certificate itself is only worth buying if you want work that requires it. Certification costs £320 plus VAT a year for a business of nine people or fewer. The five controls it checks cost nothing to put in place, because they're settings you already have access to.

Cyber Essentials is the UK government's baseline security standard, backed by the National Cyber Security Centre and run by IASME as the NCSC's official delivery partner. The NCSC describes it as "the minimum standard of cyber security recommended by the Government for organisations of all sizes."

What does Cyber Essentials actually check?

The scheme asks about five things:

• Firewalls - a filter between the internet and your computers, like a receptionist who decides who gets through the front door.
• Secure configuration - computers set up so there are fewer ways in, like locking the windows you never open.
• Security update management - installing updates promptly, so criminals can't use weaknesses that are already publicly known.
• User access control - who can reach what. Not everyone needs a master key.
• Malware protection - catching harmful software before it does damage.

None of that is exotic. What has changed is how strictly it's marked. For applications registered after 26 April 2026, IASME and the NCSC made several questions automatic fails. Multi-factor authentication, where you confirm a login with a code on your phone as well as a password, is now mandatory on every cloud service that offers it. High-risk or critical security updates must be installed within 14 days of release, both for operating systems and firewall software (question A6.4) and for applications (A6.5). Fail either and you fail the whole assessment, however well you did elsewhere.

One older rule sits alongside those: using software that no longer gets updates from its maker means you fail too.

If you read that and thought "we probably don't install updates within 14 days", that's useful to know whether or not you ever get certified.

The 14-day rule is also the part that's hardest to keep up by memory. If keeping track of which updates are due is the problem, we're happy to set up an automation that sends reminders and keeps a simple record of what was updated and when.

How much does it cost?

IASME publishes prices by number of employees. As checked on 15 October 2026:

• 0-9 employees: £320 + VAT
• 10-49 employees: £440 + VAT
• 50-249 employees: £500 + VAT
• 250+ employees: £600 + VAT

Cyber Essentials Plus has no published price. IASME quotes it individually "according to the size and complexity of your network", and to get a figure you fill in a form and up to three certification bodies contact you. We couldn't find a primary source for a typical small-business Plus price, so be cautious of anyone quoting a confident average.

Basic and Plus check exactly the same things

Cyber Essentials Plus doesn't add extra controls. IASME's FAQ is clear: "The controls for Cyber Essentials and Cyber Essentials Plus are exactly the same but the level of assurance is different."

The basic level is a checked self-assessment. You answer the questions, a board member signs to say the answers are true, and a qualified external assessor marks them. Nobody inspects your computers.

Plus is more like a practical driving test on top of the written one. An assessor scans each of your public internet addresses from outside, then checks a sample of your devices, which IASME says is typically around 10 per cent. They look for out-of-date software and unpatched high and critical weaknesses, test your malware protection with harmless files, confirm that everyday user accounts can't carry out administrator tasks, and check that cloud logins really do ask for that second code. The pass bar is higher too. On the self-assessment you can pass with one or two problems; on Plus you get 30 days to fix them and can't pass until you have.

Timing matters. If the Plus audit happens within three months of your Cyber Essentials certificate, you don't repeat the questionnaire. Leave it longer and you answer the questionnaire again.

How long does it take, and how often?

You have six months from buying it to complete the assessment. If you've downloaded the free question set and prepared first, IASME says filling in the self-assessment "might only take about an hour". Assessors aim to return results within three working days. If you fail on something small, you get two working days to fix it and resubmit at no extra charge. Miss that window and you pay again.

Certificates last 12 months at both levels, and you answer everything again on renewal. So the real cost at the smallest band is £320 plus VAT every year, plus your own time.

A yearly renewal is easy to lose track of, and so is the evidence you need to answer the questions again, such as which computers you have and what's installed on them. If you'd like renewal reminders and a device list that stays up to date without someone retyping it, we're happy to set up an automation for that, where your existing tools allow it. The certification itself stays between you and your assessor.

When is it actually required?

Procurement Policy Note 014, which applies from 24 February 2025, covers all central government departments, their executive agencies and non-departmental public bodies, and NHS bodies. It requires Cyber Essentials or Cyber Essentials Plus for contracts where a supplier handles citizens' personal information, handles personal information about government employees or ministers, supplies IT systems storing or processing data at the OFFICIAL level of the government's security classifications (the level most everyday government information sits at), or deals with information about the day-to-day business of government.

There is another route. To comply with section 56 of the Procurement Act 2023, buyers must accept equivalents, and a supplier without certification "must be able to demonstrate equivalent controls are in place through other means", normally checked by a competent independent third party. For a small business, proving that to a procurement team is likely to be more work than paying £320.

Outside the public sector nothing requires it, though the NCSC notes that "a growing number of organisations require suppliers to be certified to bid for work".

The included insurance is real, but limited

If you certify, you may be entitled to Cyber Liability Insurance underwritten by AIG, provided you're based in the UK, your turnover is under £20m, the whole organisation is certified, and you opt in. It covers up to £25,000 in total, with a £1,000 excess, and runs for 12 months alongside the certificate.

IASME is candid that this "might be sufficient for a small breach or incident but will be inadequate if you suffer a serious problem or more than one incident". There's also an important gap: it doesn't cover money stolen electronically or through cyber fraud. That includes invoice redirection fraud, where a criminal sends your customer a convincing email saying your bank details have changed, and for a five-person business that's the loss you'd most want covered. Raising the limit to £100,000 costs £305.76 a year at the smallest turnover band.

We couldn't find a primary source showing that holding Cyber Essentials lowers the price of a separate commercial cyber insurance policy, so we're not going to say it does. It's worth asking your broker directly.

So is it worth paying for?

Put the five controls in place whether or not you pay: second-step logins everywhere, updates within 14 days, no everyday accounts with full administrator rights, no software that's stopped getting updates, and the firewall switched on. That's the part that actually reduces risk, and it costs your time rather than money.

Pay for the certificate if you want work that asks for it. The numbers support that as the main test. The Cyber Security Breaches Survey 2025/2026, published by DSIT on 30 April 2026, found 43% of businesses had a breach or attack in the previous 12 months. Phishing, meaning fake emails designed to trick someone into clicking or handing over details, was by far the most common, at 38% of businesses, and among businesses and charities that had one, it was the most disruptive type for 69%. But the same survey found the median perceived cost of the most disruptive incident was £0, with the top 5% of micro and small businesses reaching £4,000. Against those figures, paying £320 a year purely as protection is a hard case to make.

Cyber Essentials doesn't stop phishing emails arriving. What the controls do is limit the damage after someone clicks, and the now-mandatory second login step is the one that most reduces the harm of a stolen password.

Only 5% of businesses hold Cyber Essentials, up from 3% the year before, and just 17% have heard of it. Among small businesses holding it, the rise was sharper, from 5% to 12%. That suggests it's mostly being asked for by customers further up the supply chain, rather than chosen by businesses for its own sake.

What should you do next?

Download the free question set and read it as a checklist. If you can answer all of it truthfully today, certification is about an hour and £320 plus VAT, and worth it if public sector or larger corporate work is in your plans. If you can't, fix the gaps first, because that's the valuable part and it's free. If neither kind of work is on your horizon, doing the controls and skipping the certificate is a perfectly sensible choice.

If the routine side is what slips, such as update reminders, renewal dates and keeping your records current, you can read about what we do and get in touch.

Sources

• Cyber Essentials overview - National Cyber Security Centre
• Cyber Essentials: pricing, routes and process - IASME
• Cyber Essentials frequently asked questions - IASME
• Cyber Essentials and Cyber Essentials Plus - what is the difference? - IASME
• Important update: changes to Cyber Essentials for April 2026 - IASME
• Cyber Liability Insurance - IASME
• PPN 014: Cyber Essentials scheme - Cabinet Office, GOV.UK
• Cyber Security Breaches Survey 2025/2026 - Department for Science, Innovation and Technology

Checked on 15 October 2026. Certification prices, insurance terms and scheme requirements all change - IASME updates the scheme annually - so verify the figures before budgeting against them.