Cyber Essentials Plus assessment fees are fixed by your certification body and your employee-count band — but the total cost of getting certified is not fixed at all. Most of what businesses overspend on comes from scope creep, failed retests, and running the audit before the environment is actually ready.
Why this matters
Cyber Essentials Plus costs money in two places: the certification body's fee, and the internal hours spent getting ready for the assessor. Businesses that focus only on the first number miss the second, bigger one.
A badly scoped audit forces an assessor to test devices and servers that have nothing to do with day-to-day operations. That inflates the assessment, and if any of those extra devices fail a vulnerability check, you're paying for a retest too.
Getting this right in 2026 means treating the audit like a project with a defined boundary, not a box-ticking exercise you schedule and hope for the best.
What you'll need
- A current asset inventory — every laptop, server, and cloud service in scope
- Admin access to firewalls, routers, and endpoint management tools
- A patch management log covering the last 90 days
- MFA enabled on all admin and remote-access accounts
- A named internal owner for the certification project
- OneClickComply or an equivalent automation tool to pull evidence without manual screenshotting
The steps
1. Define your scope before you request a quote
A narrow, accurate scope is the fastest way to cut cost. Exclude legacy systems that don't touch the internet, retire shadow IT nobody uses, and separate any subsidiary networks that don't need certifying this cycle.
Assessors quote based on the number of devices and the employee band you fall into — IASME uses four bands (1-9, 10-49, 50-249, and 250+ employees). A smaller, cleaner scope keeps you in a lower testing bracket even if your headcount doesn't change.
Common mistake: including every device "just in case." That's how a 40-person company ends up paying for a scope built for 200.
2. Run your own vulnerability scan first
Failing the assessor's external vulnerability scan means booking a retest — a second fee on top of the original one. Running your own scan two to three weeks before the audit date catches the same issues for free.
Patch anything with a critical or high severity rating immediately. Cyber Essentials Plus fails on unpatched software more often than any other single control.
Common mistake: patching servers but forgetting laptops that were offline during the last update cycle.
3. Fix MFA gaps before the assessor logs in
Multi-factor authentication on every admin and cloud account isn't optional under Cyber Essentials Plus — it's tested directly. A single account without MFA can trigger a full retest of that control area.
Audit every admin account, not just the obvious ones. Shared service accounts and old contractor logins are the ones that get missed.
4. Automate your evidence collection
Manual evidence gathering — screenshots of firewall rules, spreadsheets of patch dates — is where internal hours quietly disappear. OneClickComply automates this collection so your team isn't burning a week pulling together proof the assessor already expects in a standard format.
This doesn't reduce the assessment fee itself, but it cuts the labour cost of getting ready, which for most small businesses is larger than the fee.
5. Bundle Cyber Essentials with Cyber Essentials Plus
If you haven't certified Cyber Essentials (the self-assessment tier) in the last 12 months, doing both in the same cycle avoids paying two separate application fees across the year. Most certification bodies price the combined route lower than two standalone submissions.
See how certification bodies compare on scope and pricing structure before you commit to one.
6. Pick a certification body that matches your sector
Not every certification body prices the same way for the same scope. Bodies working heavily with public sector suppliers or regulated industries sometimes quote differently than generalist assessors for an identical device count.
Get two or three quotes against the same defined scope document — never let the assessor define the scope for you after the quote is agreed.
7. Schedule the audit for a quiet operational week
An assessor working around live incidents, staff on leave, or a mid-migration environment takes longer and asks more follow-up questions — which can extend billable time on some contracts. Pick a week where your systems are stable and your internal owner is fully available.
Common mistake: booking the audit the same month as a major infrastructure change. Wait until the dust settles.
Get compliant without the manual work
Automated evidence collection for Cyber Essentials Plus, ISO 27001, and SOC 2.
Troubleshooting
The quote came back higher than expected. Check whether the assessor's scope matches yours. A quote built on a wider device count than you intended is the most common cause of sticker shock.
You failed the external vulnerability scan. Patch the flagged CVEs, close any exposed ports, and request the retest rather than a full resubmission — most certification bodies price a retest lower than a fresh application.
MFA rollout is taking longer than the audit date allows. Push the audit date back rather than sitting the assessment with known gaps. A guaranteed fail costs more than a two-week delay.
Your team can't produce evidence fast enough. This is the labour-cost problem, not the fee problem. Prepare properly for the Cyber Essentials Plus audit before the assessor is booked, not after.
You're recertifying and the scope has grown since last year. Re-scope from scratch rather than copying last year's document. Headcount growth, new SaaS tools, and remote staff all expand scope quietly.
A certification body quoted a much lower price than the others. Check what's excluded. Some low quotes assume a narrower testing window or exclude retest fees entirely — read the scope of work line by line.
Tools and resources
- Asset inventory spreadsheet or CMDB export
- Patch management dashboard covering the last 90 days
- MFA audit report from your identity provider
- External vulnerability scanner (run 2-3 weeks pre-audit)
- Evidence automation software like OneClickComply
What to do next
Once Cyber Essentials Plus is certified, the cost conversation doesn't end — renewal happens every 12 months, and scope drift between cycles is what pushes prices up again. Build a lightweight quarterly review of your asset inventory so next year's audit starts from a clean scope, not a bloated one.
Frequently asked questions
One last thing
The certification body's fee is usually the smaller number on the invoice — the bigger cost is the week your team spends chasing screenshots and patch logs the assessor already expects in a standard format. Fix the scope, automate the evidence, and Cyber Essentials Plus stops being an annual scramble.