In short
- ✓Cyber Essentials is the UK government-backed certification for five core security controls.
- ✓IASME's fee is £320 + VAT for 0–9 staff, £440 for 10–49, £500 for 50–249 and £600 for 250+.
- ✓Certificates last 12 months, and eligible UK businesses get £25,000 of cyber insurance included.
- ✓Since 27 April 2026, missing MFA on cloud services or late critical updates means automatic failure.
- ✓Most small businesses can be ready in 1–4 weeks.
What is Cyber Essentials?
Cyber Essentials is a certification scheme backed by the National Cyber Security Centre (NCSC) and delivered by IASME. It shows your business has five technical controls in place: firewalls, secure configuration, security update management, user access control and malware protection.
There are two levels. Cyber Essentials is a verified self-assessment questionnaire. Cyber Essentials Plus covers the same controls with independent, hands-on technical testing of your devices and systems.
Why Surrey businesses need it
Cyber Essentials is required for many central government contracts, and it's increasingly a condition of working with larger organisations. In Surrey and its borders that includes the defence and aerospace supply chain around Farnborough and Camberley, corporate headquarters along the M3 and M25 corridors, and public-sector buyers across the county.
It still sets you apart: in the government's 2025 Cyber Security Breaches Survey only 12% of UK businesses had heard of the scheme.
How much does Cyber Essentials cost?
IASME sets the certification fee by organisation size: £320 + VAT for micro organisations (0–9 staff), £440 for small (10–49), £500 for medium (50–249) and £600 for large (250+). Support to get you ready is separate and depends on how many fixes are needed.
UK organisations with annual turnover under £20m that certify their whole organisation can opt in to £25,000 of cyber liability insurance at no extra cost.
What changed in April 2026
- Multi-factor authentication is mandatory on cloud services wherever it's available, including cloud email, identity providers, remote access and admin tools. Not using it is an automatic fail.
- High-risk and critical security updates must be applied within 14 days of release, across operating systems, applications and router or firewall firmware. Missing the deadline is an automatic fail.
- Scope must be described in more detail, with every legal entity listed and any exclusions explained.
- For Cyber Essentials Plus, assessors test a fresh random sample of devices, and you can't change your self-assessment answers once testing begins.
How to get certified
- Decide on Cyber Essentials or Cyber Essentials Plus, and what's in scope.
- Run a gap assessment against the five controls and the current question set.
- Fix the gaps: MFA, updates, admin accounts, firewalls and malware protection are the usual ones.
- Complete and submit the questionnaire. For Plus, prepare for the technical audit.
- Recertify every 12 months to keep your certificate current.
Questions
How long does it take to get Cyber Essentials?
Most small businesses are ready in 1–4 weeks. The time depends mainly on how many fixes are needed, such as turning on MFA or updating old devices.
Can I do Cyber Essentials myself?
Yes, you can complete the questionnaire yourself. Many small businesses use a consultant to find and fix gaps first, because the 2026 rules turn some mistakes into automatic failures.