Cyber Essentials Costs and Timing
Cyber Essentials (CE) fees, optional advice and IT changes are separate costs. Cyber Essentials Plus (CE+) needs its own assessment quote.
Published CE Assessment Fees
IASME’s current basic Cyber Essentials bands use employee count. These are assessment prices, not Hemanth Vishnu Advisory fees.
| Employees | CE Assessment |
|---|---|
| 0–9 | £320 + VAT |
| 10–49 | £440 + VAT |
| 50–249 | £500 + VAT |
| 250+ | £600 + VAT |
Check the current price and who counts in the size band, including relevant volunteers or contractors. These fees cover the CE verified self-assessment. Optional advice and IT changes are separate. Plus is quoted for your organisation and network; ask the certification body what its quote includes.
Keep the Cost Lines Separate
Assessment
The CE fee buys the scheme assessment route shown by IASME. CE+ is a separate, individually quoted technical audit.
Readiness Advice
Optional readiness advice covers agreed work such as reviewing scope, evidence and action priorities. Ask for a quote that states the outputs and any limits on support.
Implementation
Your organisation or IT provider prices and makes the changes. Budget separately for devices, licences, setup and fixes; the basic CE assessment fee does not cover them.
Four Timeframes
Published scheme windows set limits or validity. They are not a forecast of how quickly your organisation will be ready or assessed.
- Preparation: Varies
- Time before applying depends on your scope, evidence, current gaps, internal decisions and how quickly your IT provider can act. No universal preparation period can be calculated from the scheme rules.
- CE Account: Up to Six Months
- IASME allows up to six months after purchase to complete the CE assessment. Record the expiry date shown for your account and the question set it uses.
- CE+ Audit: Within 3 Months
- IASME’s current Plus guide says the Plus audit must be completed within three months of the most recent CE certificate. Confirm the practical schedule and account-specific deadline with the appointed certification body.
- Certificate: 12 Months
- CE and CE+ certificates are valid for 12 months from issue. Work backwards from a buyer’s evidence date and allow time to prepare, assess, address any findings and renew.
Build a Usable Plan
Before paying, ask the buyer and the assessment provider to confirm the dates that govern your route.
Confirm the Need
Get the certificate level, legal applicant, required scope and evidence deadline in writing.
Check Readiness
Map likely gaps and who can implement fixes. Agree the advice scope and separate IT-provider work.
Ask the Certification Body
Confirm the CE account version and expiry, its assessment scheduling, the CE+ three-month window and Plus availability and quote.
Set a Decision Date
Choose an application date only after owners, evidence, access and buyer timing are understood. Keep an allowance for findings and changes; do not rely on an assumed retest or turnaround promise.
A Deadline Without a Confirmed Scope
Fictional charity Cedar House sees a request for CE+ evidence before a grant-funded service starts in four months. Its trustees do not yet know whether a shared parent organisation or the charity itself must apply.
- Next Action
- The charity asks the funder to confirm the applicant, scope and evidence date. It maps devices and cloud services, asks its IT provider to price identified changes, and gets a CE+ quote and available dates from a licensed certification body before choosing when to open the CE account.
- What This Settles
- The plan uses the actual scope and provider schedule and preserves the separate six-month CE account and three-month post-certificate Plus windows; it does not treat four months as a guaranteed completion time.
Who Does What?
Hemanth personally advises on readiness. Your organisation or IT provider makes and operates changes. The independent certification body confirms its quote and schedule, assesses the application and decides the result.