What does Cyber Essentials cost and how long does it take for a Northern Ireland business in 2026?

In 2026, the Cyber Essentials certification fee is set by IASME, the NCSC's Cyber Essentials delivery partner, and depends on the size of your organisation: £320 +VAT for 0–9 employees, £440 +VAT for 10–49, £500 +VAT for 50–249 and £600 +VAT for 250 or more [1]. Getting ready—closing any gaps against the five technical controls—is a separate cost: UK consultancies typically charge about £800 to £2,500 +VAT for guided readiness support for a small or medium business [8][9]. Once you submit, an assessor reviews your answers within three working days [1]; allow one to two weeks from start to certificate if your systems are already well managed, or four to eight weeks from a standing start [9].

The short version

• The certification fee is fixed by organisation size, from £320 to £600 +VAT, and is paid every year.
• Most of the cost and time is getting ready, not the assessment itself.
• Unsupported software anywhere in scope is an automatic fail, so old PCs and applications are the usual hold-up.
• Certification includes cyber liability insurance for eligible UK organisations with turnover under £20m.

What is Cyber Essentials?

Cyber Essentials is the UK Government's recommended minimum standard of cyber security for organisations of all sizes, run by the National Cyber Security Centre (NCSC) [2]. It certifies that five technical controls are in place: firewalls, secure configuration, security update management, user access control and malware protection [2]. Certification is valid for 12 months and is renewed annually [1].

Cyber Essentials Plus checks the same five controls but adds an independent technical audit of your systems, so it gives a higher level of assurance [3].

How much does Cyber Essentials cost?

The fee pays for the assessment itself [1]. It doesn't pay for the work to meet the controls, which is where most of the cost and time sit. Typical UK market prices for that work, from published 2026 price guides:

• Readiness review and guided support: about £800 to £2,500 +VAT for a small or medium business [8][9]. Lighter help with a self-assessment is often £300 to £600 +VAT [9].
• Fixing the gaps (remediation): from nothing for a well-managed business to roughly £500 to £5,000 for a small organisation with older devices or software [9]. Replacing a PC that can't run supported software typically costs £400 to £900 [9].
• Cyber Essentials Plus audit: from about £900 +VAT for a small, simple estate to £3,000 or more, priced on the number and type of devices, sites and servers [8][10].
• If an IT provider offers to handle certification, ask whether readiness work, remediation and the IASME fee are included in its price or charged separately.

What drives the cost of getting ready?

• Size. The number of employees sets the IASME fee band [1].
• Old software. Any unsupported software within the scope of the assessment is an automatic fail, so older devices and applications must be updated or replaced first [3].
• How well managed you already are. If devices are already patched, configured to a standard and protected, readiness is mostly gathering evidence. Only 24% of UK businesses reported controls in all five areas [4], so most have some work to do.
• Basic or Plus. Cyber Essentials Plus adds a technical audit, priced on the size and complexity of your network [1].

How long does Cyber Essentials take?

• Preparation and fixing gaps: one to two weeks if your systems are already well managed, four to eight weeks from a standing start [9].
• Completing the assessment: you have up to six months from purchase to complete and submit it [3].
• Review: a qualified assessor reviews your answers within three working days, and each resubmission within three working days [1].
• Certificate: issued as soon as your assessment meets every requirement, valid for 12 months [1].
• Cyber Essentials Plus: if you certified to Cyber Essentials less than three months earlier, you don't need to repeat the self-assessment stage [3]. From a standing start, allow eight to twelve weeks before any deadline [9].

What would a 20-person accountancy practice in Belfast pay?

A 20-person practice falls in the small band, so the certification fee is £440 +VAT [1]. Guided readiness support at typical UK market prices would add about £800 to £2,500 +VAT [8][9], plus any remediation, and the practice should allow four to eight weeks from a standing start [9]. Each year after that, renewal means another assessment at the current fee [1].

Do I need Cyber Essentials for government contracts?

For some. UK central government departments, their agencies and non-departmental public bodies, and NHS bodies must make sure suppliers meet set technical requirements on contracts that handle personal information, process OFFICIAL data or deal with the day-to-day business of government—and Cyber Essentials or Cyber Essentials Plus is the quickest way to show it [5]. Where it's required, it must be renewed annually for the life of the contract [5]. Other public sector bodies may choose to apply the same approach [5].

Does Cyber Essentials include cyber insurance?

It can. A UK-domiciled organisation with turnover under £20m that certifies its whole organisation is entitled to cyber liability insurance with a £25,000 limit of indemnity, including a 24-hour incident helpline [6]. The NCSC reports data from that insurer showing certified organisations are 92% less likely to make a claim on their insurance [7].

Why does Cyber Essentials matter in 2026?

43% of UK businesses reported a cyber breach or attack in the last 12 months, including 46% of small businesses, and phishing affected 38% [4]. Yet only 17% of businesses were aware of Cyber Essentials and just 5% held it, rising to 12% among small businesses [4]. Certification is still a way to stand out with clients, insurers and tender panels.

How does BTNI help with Cyber Essentials?

At BTNI, Cyber Essentials certification readiness is part of TechState™ Assured, and Cyber Essentials Plus readiness part of TechState™ Verified, through our Cybersecurity service. To talk through your own position, book a Business Technology Review. If you run a law or accountancy firm, our guide to Cyber Essentials for professional firms covers the client and insurer angle.