How much does Cyber Essentials cost — and is it worth it?

Cyber Essentials comes up in two situations: a customer or funder has told you that you need it, or you have decided you would rather not be the next business explaining a breach to its clients. Either way, the first question is always the same.

What does it cost?

There are two costs, and people usually only think about the first.

The certification fee is set by IASME on a sliding scale by organisation size, and starts in the low hundreds of pounds for a micro business. Cyber Essentials Plus, which adds a hands-on technical audit, costs more.

The remediation cost is the one that varies. If your systems are already patched, backed up and sensibly configured, it is close to nothing. If you are running unsupported operating systems, a firewall nobody has touched since installation and shared admin passwords, it is the cost of fixing all that — which you needed to do anyway.

Rather than guess, ask us for a quote against your actual setup. Our technical account managers will come to site free of charge and tell you where you stand.

What you get for it

• Protection from around 98.5% of common cyber threats — the scheme deliberately targets the attacks that make up the overwhelming majority of real-world incidents.
• The ability to bid for government contracts. Certification is mandatory for many central government tenders and increasingly required down the supply chain.
• £25,000 of free cyber insurance included with certification for eligible UK organisations.
• Credibility. A badge that answers the “how do we know you are secure?” question on a tender document without a three-page essay.

Where people trip up

Two things account for most failed first attempts:

1. Unsupported software. One forgotten Windows 10 machine, or an old server, will fail you. Everything in scope must be receiving security updates.
2. Scope confusion. Home workers’ laptops, personal phones with work email on them, and cloud services all count. Defining the boundary badly is how organisations end up failing on something they did not realise was included.

Neither is difficult — but both are much cheaper to find before you submit than after.

Is it worth it?

If you handle anyone else’s data, bid for public sector work, or would struggle to trade for a fortnight without your systems: yes, comfortably. It is the cheapest structured security improvement available to a UK small business, and around 21,000 cyber attacks happen in the UK every day.

Read more on our Cyber Essentials page, or see the wider picture on cyber security.