# How much is Cyber Essentials, and what does it ask? Know what the fee buys before you book an assessment or pay for help. The Assurance Desk. Published 7 October 2026. Last checked 7 October 2026. **The short answer.** Cyber Essentials starts at £320 plus VAT. The fee depends on your organisation’s size. Cyber Essentials Plus adds independent technical testing, with a price based on your network’s size and complexity ([NCSC, Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview), checked 7 October 2026). ## In this series - [Cyber Essentials Plus: what does the technical test add?](https://theassurancedesk.com/guides/cyber-essentials-plus-technical-test.md) ## What does the Cyber Essentials fee cover? The basic route uses a questionnaire about your security. A board member, or someone with the same level of responsibility, signs off the answers. An assessor then marks them. This is a verified assessment, so filling in the form is not the whole process ([NCSC, Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview), checked 7 October 2026). You can follow that route yourself or hire a licensed certification body to help. That is a firm allowed to assess you. Its support can help you understand what each question means for your company ([NCSC, Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview), checked 7 October 2026). **Separate the assessment from help with preparation** | Item | What to expect | Question for the quote | | --- | --- | --- | | Cyber Essentials assessment | Starts at £320 plus VAT, based on organisation size | Which size band applies? | | Support with the questions | A licensed certification body can help | Is this support included or charged separately? | | Cyber Essentials Plus | Technical testing, priced by network size and complexity | What will be tested, and what does the price include? | Source: NCSC, Cyber Essentials, https://www.ncsc.gov.uk/cyberessentials/overview (checked 7 October 2026) ## What are the Cyber Essentials requirements? Both levels cover the same five security controls. A control is a way to reduce a security risk. Plus goes further by testing whether those controls work in practice ([NCSC, Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview), checked 7 October 2026). **The five controls, in plain English** - Firewalls: Filter traffic between your network and the internet. - Secure settings: Set up computers to reduce the ways an attacker can get in. - Software updates: Fix weaknesses that attackers could use. - Access controls: Limit who can reach data and services, and what they can do. - Malware protection: Find and stop harmful software. Both levels cover these controls. Plus also tests them in practice. Source: NCSC, Cyber Essentials, https://www.ncsc.gov.uk/cyberessentials/overview (checked 7 October 2026) ## Can you see the questions before you pay? Yes. You can preview the question set for free. The requirements document explains the technology the questions cover. Read both before deciding how much help to buy ([NCSC, Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview), checked 7 October 2026). A useful first step is to ask your IT team to go through the questions with you. Mark the answers you can explain and the ones you cannot. Use that list when asking a certification body for help ([NCSC, Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview), checked 7 October 2026). ## Do you need Cyber Essentials or Plus? Start with what the person asking for the certificate needs. Basic Cyber Essentials uses verified answers. Plus tests the same controls on your systems. The extra test, rather than a different set of controls, is the key difference ([NCSC, Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview), checked 7 October 2026). Ask for a quote that names the assessment and any support. For Plus, ask how the size and complexity of your network affect the fee. That makes it easier to compare what you are buying ([NCSC, Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview), checked 7 October 2026). ## What to do 1. Read the free question set and requirements ([NCSC, Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview), checked 7 October 2026). 2. Write down which certificate the customer or buyer has asked for. 3. Ask whether help with the questions is included in the quote ([NCSC, Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview), checked 7 October 2026). 4. For Plus, agree what the network price covers ([NCSC, Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview), checked 7 October 2026). ## Common questions ### Is £320 the price for every organisation? No. It is the starting fee, plus VAT. The price depends on organisation size ([NCSC, Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview), checked 7 October 2026). ### Does Plus cover different controls? No. It covers the same five controls and adds independent testing to see whether they work ([NCSC, Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview), checked 7 October 2026). ### Can someone help us fill in the assessment? Yes. A licensed certification body can help you understand the questions and how they apply to your company ([NCSC, Cyber Essentials](https://www.ncsc.gov.uk/cyberessentials/overview), checked 7 October 2026). ## Where next - [Customer security questionnaires: what they ask and how to answer](https://theassurancedesk.com/guides/customer-security-questionnaires-what-they-ask-and-how-to-answer.md) - [What does ISO 27001 certification take, and who can certify you?](https://theassurancedesk.com/guides/iso-27001-certification-and-who-can-certify-you.md) - [Cyber Essentials Plus: what does the technical test add?](https://theassurancedesk.com/guides/cyber-essentials-plus-technical-test.md) ## Sources - NCSC, Cyber Essentials: https://www.ncsc.gov.uk/cyberessentials/overview (checked 7 October 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.