Pricing · every price excludes VAT

Clear prices for Cyber Essentials, Plus and Defence Cyber Certification

Pick your organisation size and every price on this page updates. Each figure is the full package price: the certification body fee and Nerdster's work, with what is not included written next to it.

Your organisation size

Starting points for 1–9 people

Cyber Essentials – Guided
£495 + VAT
Cyber Essentials – Ready
£1,315 + VAT
Cyber Essentials Plus – Ready
£3,115 + VAT
DCC Level 0 – Ready, incl. Cyber Essentials
£2,395 + VAT

A free 15-minute call confirms your band and scope. The quote matches this page unless your scope is unusual, and we tell you where.

How much help do you want?

Three levels of help. Pick the one that matches where you are.

  1. Guided

    You do the work. We review it before it goes in.

    For organisations whose controls are already in place. The certification fee is included and an assessor checks your answers before submission.

  2. Ready

    We find the gaps and fix them, then you certify.

    Everything in Guided plus hands-on readiness: a gap review, remediation of the controls that would fail, and an evidence pack built for the assessor.

  3. Managed

    We keep you certified and compliant all year.

    Certification every year plus the monitoring, patching, policies and staff training that keep the controls true between assessments.

Certification packages

Cyber Essentials and Cyber Essentials Plus, priced for 1–9 people

One payment per certification cycle, unless the card says otherwise. Certificates last 12 months; Managed packages renew them for you.

Your organisation size
Fastest route to the certificate

Cyber Essentials – Guided

Guided
£495 + VAT

One payment. Certificates last 12 months.

Your controls are already in place and you want a reviewed submission.

What's included

  • Cyber Essentials certification with the IASME fee included
  • Assessor review of your questionnaire answers before submission
  • Policy templates for the five controls
  • Email and chat support while you complete the questionnaire
  • If an answer is marked down, we help you correct it and resubmit at no extra charge
  • £25k cyber liability insurance for eligible UK organisations
What is not included

Technical fixes outside the package, replacement devices or software, new licences and an onsite Plus audit are quoted separately before you approve them.

Get a fixed quote
Most popular

Cyber Essentials Duo – Guided

Guided
£1,895 + VAT

One payment for both certificates. Renew each year.

A customer or contract asks for Plus and your controls are already in place.

What's included

  • Cyber Essentials and Cyber Essentials Plus in one engagement
  • Guided questionnaire with assessor review
  • Independent Cyber Essentials Plus technical audit
  • 12 months of external vulnerability scanning
  • Unlimited retests if a finding needs fixing
  • £25k cyber liability insurance for eligible UK organisations
What is not included

Technical fixes outside the package, replacement devices or software, new licences and an onsite Plus audit are quoted separately before you approve them.

Get a fixed quote

Cyber Essentials – Ready

Ready
£1,315 + VAT

One payment. Certificates last 12 months.

You need the gaps found and fixed before you submit.

What's included

  • Everything in Cyber Essentials – Guided
  • Gap review against the current question set
  • Remediation of failing controls: MFA, patching, admin accounts, device configuration
  • Evidence pack organised the way the assessor expects
  • Our aim is a pass at the first attempt; if an answer is marked down, we correct it and resubmit with you
What is not included

Replacement devices or software that are out of support, new licences and work outside the agreed scope are quoted separately before you approve them.

Get a fixed quote
For tenders, MOD and NHS supply chains

Cyber Essentials Plus – Ready

Ready
£3,115 + VAT

One payment for both certificates. Renew each year.

You need Plus and want us to prepare every device for the audit.

What's included

  • Cyber Essentials and Cyber Essentials Plus certification
  • Full readiness review and remediation of failing controls
  • Device preparation for the audit sample
  • A free retest within 30 days if a device fails the audit
  • Audit coordination with the certification body
  • 12 months of external vulnerability scanning
  • £25k cyber liability insurance for eligible UK organisations
What is not included

Technical fixes outside the package, replacement devices or software, new licences and an onsite Plus audit are quoted separately before you approve them.

Get a fixed quote

Cyber Essentials – Managed

Managed
£1,025 a year + VAT

Year one £1,610 including onboarding

Annual subscription, priced by number of users. Year one adds a one-off onboarding.

You need the certificate every year and want the controls looked after in between.

What's included

  • Cyber Essentials certification every year
  • Device monitoring agent on every in-scope device
  • Third-party patching
  • Security policies kept current
  • Staff training and phishing simulations
  • Onboarding by Nerdster: agent rollout, policy set-up, training launch and the first certification
What is not included

Technical fixes found at onboarding, replacement devices and new licences are quoted separately. The subscription element is priced by number of users; see Managed plans.

Ask about Managed

Cyber Essentials Plus – Managed

Managed
£2,716 a year + VAT

Year one £3,300 including onboarding

Annual subscription, priced by number of users. Year one adds a one-off onboarding.

Plus every year, with vulnerability management and the full training library.

What's included

  • Everything in Cyber Essentials – Managed
  • Cyber Essentials Plus audit each year
  • Vulnerability manager with continuous scanning
  • Privacy and UK GDPR toolbox
  • Full training library with phishing simulations
What is not included

Technical fixes found at onboarding, replacement devices and new licences are quoted separately. The subscription element is priced by number of users; see Managed plans.

Ask about Managed

Only need the certificate?

IASME's self-led Cyber Essentials starts at £320 + VAT. If your controls are already in place and you are comfortable answering alone, that may be enough, and we will tell you so on the readiness call. Our packages exist for the review, the fixing and the keeping-it-true.

Book a free 15-minute call Check your readiness first

Compare inclusions

What comes with each package

Every size is listed, so you can see how the price moves as you grow. A tick means it is in the price; a dash means it is not part of that package.

Package Guided CE Guided Guided CE Duo Ready CE Ready Ready CE Plus Ready Managed CE Managed Managed CE Plus Managed
1–9 people + VAT £495 £1,895 £1,315 £3,115 £1,025 a year £2,716 a year
10–49 people + VAT £695 £2,495 £1,935 £4,135 from £1,340 a year from £3,255 a year
50–249 people + VAT £850 £2,900 £2,495 £4,945 from £3,205 a year from £5,520 a year
250+ people + VAT £1,050 £3,850 £3,095 £6,295 Get a quote Get a quote
Billing One payment. Certificates last 12 months One payment for both certificates. Renew each year One payment. Certificates last 12 months One payment for both certificates. Renew each year Year one £1,610 including onboarding Year one £3,300 including onboarding
Cyber Essentials certificate (IASME fee included)
Cyber Essentials Plus technical audit – – – Each year
Assessor review of your answers before submission
Gap review and hands-on remediation – – Ongoing Ongoing
Evidence pack for the assessor – – – –
Device preparation and audit coordination – – – –
12 months of external vulnerability scanning – – – Continuous
Retests included – Unlimited – – – –
Security policies Templates – Templates –
Device monitoring agent – – – –
Third-party patching – – – –
Staff training and phishing simulations – – – – 18 modules Full library
Privacy and UK GDPR toolbox – – – – –
Certification every year – – – –
£25k cyber liability insurance A benefit of the scheme for eligible UK organisations: whole-organisation certification and turnover under £20m.

Defence suppliers

Defence Cyber Certification, Level 0 and Level 1

Level 0 is Cyber Essentials plus UK GDPR and resilient-systems controls, certified for three years. Prices include the assessment fee where the card says so. Read the full DCC page.

Your organisation size
Start here

DCC Level 0 – Ready (includes Cyber Essentials)

£2,395 + VAT

One payment. The DCC certificate lasts three years.

Full readiness and certification for MOD suppliers who do not yet hold Cyber Essentials.

  • Cyber Essentials certification for year one included (renewals in years two and three quoted, or inside Level 0 – Managed)
  • UK GDPR and business-resilience controls prepared and evidenced
  • Evidence pack organised for the certification body
  • DCC Level 0 assessment fee included
  • Three-year certificate with annual attestation support
Review my DCC requirement

DCC Level 0 – Ready (you already hold Cyber Essentials)

£1,570 + VAT

One payment. The DCC certificate lasts three years.

The same readiness and certification for organisations with a valid Cyber Essentials certificate.

  • Your existing Cyber Essentials reused
  • UK GDPR and business-resilience controls prepared and evidenced
  • Evidence pack organised for the certification body
  • DCC Level 0 assessment fee included
Review my DCC requirement

DCC Level 0 – certification only

£574 + VAT

One payment. The DCC certificate lasts three years.

Assessment and certificate only, for organisations that are already prepared and hold Cyber Essentials.

Review my DCC requirement

DCC Level 0 readiness only

from £1,500 + VAT

Typically £1,500 to £3,000, fixed in writing after scoping

Gap review, evidence plan, UK GDPR and resilience controls and assessment preparation. You bring your own certification body.

Review my DCC requirement
Level 1 and managed programmes Price for 1–9 people Billing
DCC Level 1 – readiness and certification Consultant-led: a gap assessment against the 101 Level 1 controls, remediation guidance over up to three rounds, the evidence pack, the Level 1 assessment and the three-year certificate. Hands-on technical fixes are quoted. Sized 1–9, 10–49, 50–249 and 250–499 people. Larger organisations are quoted. £10,733 + VAT One payment for the three-year certificate
DCC Level 0 – Managed A three-year compliance programme: Level 0 and Cyber Essentials each year plus device monitoring, patching, training and policies. £1,405 + VAT Per year on a three-year term
DCC Level 1 – Managed Level 1 and Cyber Essentials with the full managed compliance platform. £5,676 + VAT Per year on a three-year term

Independent certification is carried out by an approved DCC certification body; Nerdster prepares you and, where the package says so, pays the assessment fee on your behalf. Level 1 includes consultant-led readiness; hands-on technical fixes are quoted.

The MOD has asked its industry partners to hold DCC Level 0 by 31 December 2026. It is a request, not a contractual deadline; your contract’s Cyber Risk Profile sets the binding level. Read the MOD's request.

Managed plans

Stay compliant between certificates

These subscriptions are the platform behind the Managed packages: monitoring, patching, policies and training on every in-scope device, with the certification included each year. Priced by number of users. Columns in your organisation size are highlighted.

12-month term, billed monthly or annually. Annual billing is the cheaper route for every plan.

Plan 1–9users10–19users20–49users50–99users100–249users250+users
Cyber Essentials Managed The subscription behind Cyber Essentials – Managed.
  • Cyber Essentials certification
  • Device monitoring, up to 5 devices per user
  • Third-party patching
  • 18 training modules
  • Policy manager
 £1,025a year + VATsaves 17% £1,340a year + VATsaves 17% £2,285a year + VATsaves 17% £3,205a year + VATsaves 17% £4,750a year + VATsaves 17% Get a quote
Cyber Essentials Plus Managed The subscription behind Cyber Essentials Plus – Managed.
  • Cyber Essentials and Cyber Essentials Plus
  • Device monitoring
  • Third-party patching
  • Full training library and phishing simulations
  • Privacy and UK GDPR toolbox
  • Policy manager
 £2,716a year + VATsaves 17% £3,255a year + VATsaves 17% £4,205a year + VATsaves 17% £5,520a year + VATsaves 17% £8,190a year + VATsaves 17% Get a quote
Baseline Protect No certification. For organisations that already hold Cyber Essentials.
  • Device monitoring
  • Policy manager
  • Patching and training available as add-ons
 £300a year + VATsaves 11% £635a year + VATsaves 7% £1,500a year + VATsaves 9% £2,350a year + VATsaves 8% £4,550a year + VATsaves 8% Get a quote
Vulnerability Manager + Patch Continuous scanning to the Cyber Essentials Plus standard, with patching.
  • Continuous vulnerability scanning to CE Plus standard
  • Third-party patching
  • Device monitoring
  • Training lite
  • Policies
 £500a year + VATsaves 17% £1,818a year + VATsaves 17% £2,335a year + VATsaves 17% £4,780a year + VATsaves 17% £10,890a year + VATsaves 17% Get a quote

Add-ons and standalone products

Training, patching and scanning on their own

Add these to a Managed plan or buy them standalone. All prices are per organisation for the number of users shown.

Priced per organisation by number of users. Monthly billing runs on a 12-month term.

Add-on 1–9users10–19users20–49users50–99users100–249users250–499users500–749users750–999users
Security Awareness Training 70+ training modules, automated phishing simulations and completion reporting. Standalone, no plan needed. £171a year £513a year £1,197a year £2,565a year £5,985a year £12,825a year £21,375a year £29,925a year
Training add-on for Managed plans Upgrades a Managed plan from 18 modules to the full 70+ library plus phishing simulations. Annual billing only £90a year £270a year £630a year £1,350a year £3,150a year Get a quote Get a quote Get a quote
Patch Management add-on Third-party application patching for Windows and Mac: manual, automatic or scheduled. Adds to Baseline Protect. Annual billing only £60a year £174a year £414a year £894a year £2,094a year Get a quote Get a quote Get a quote
Vulnerability Scanning Continuous scanning and reporting to the Cyber Essentials Plus standard. Fair use: assets up to 1.5 times your user count. £355a year £695a year £1,540a year £3,300a year £7,700a year £16,500a year £27,500a year £38,500a year

Cyber Essentials Plus audit, every year

The Plus audit booked for you each year inside the three-month window after your Cyber Essentials renews. Same price as the one-off audit, retest included. You need a valid Cyber Essentials certificate.

1–9 people
£1,450a year + VAT
10–49 people
£1,699a year + VAT
50–249 people
£1,950a year + VAT
250+ people
£2,699a year + VAT

AI use check

A one-off review of the AI tools your staff already use with company data: an inventory, an AI use policy written for your business and a short action plan.

£750 + VAT, one-off

Why AI tools count for Cyber Essentials

Security services

Testing, audits and monitoring

For organisations that already hold Cyber Essentials or need a specific piece of work. Sized items follow your organisation size; the rest are one price.

Your organisation size

Cyber Essentials Plus – certification only

The independent Plus technical audit for organisations that already hold Cyber Essentials and are audit-ready. One free retest within 30 days if a device fails.

£1,450 + VAT

One payment, sized by organisation

Cyber Essentials Plus – Pre-checked audit

A pre-audit vulnerability assessment with a written fix list, a Nerdster engineer on hand while you close it, then the Plus audit. One free retest within 30 days if a device fails.

£2,167 + VAT

One payment, sized by organisation

Cyber Essentials Plus vulnerability assessment

A pre-audit vulnerability assessment to the Plus standard with a written fix list, so the audit holds no surprises.

£500 + VAT

One payment, sized by organisation

Cyber Essentials with 1-2-1 video support

Certification through the certification body with a Nerdster engineer on a live 1-2-1 video call while you answer. No readiness work.

£670 + VAT

One payment, sized by organisation

Annual vulnerability assessment

External vulnerability assessment of your internet-facing systems with a written report.

from £999 + VAT

Per assessment

Monthly vulnerability assessment

A monthly external scan and report.

£100 + VAT

Per month

Monthly penetration testing

A monthly penetration test of your internet-facing systems.

£100 + VAT

Per month

Monthly vulnerability assessment + penetration test

Both programmes together.

£175 + VAT

Per month

Managed SOC (Microsoft Sentinel) – per user

24/7 security monitoring of Microsoft 365 users by an ex-GCHQ-directed SOC. For 50 to 500 users.

£2 + VAT

Per user per month

Managed SOC (Microsoft Sentinel) – per node

SOC monitoring per server or network node. For 50 to 500 nodes.

£73 + VAT

Per node per month

Managed SOC – onboarding

Microsoft Sentinel deployment and SOC onboarding, scoped to your tenant and log sources.

from £8,000 + VAT

One payment, scoped

Quoted by scope

  • Penetration testing (project) A scoped penetration test: external, internal, web application or red team. Get a quote
  • ISO 27001 support Readiness and certification support for an information security management system. Get a quote
  • Framework assessment (NIST CSF or NCSC CAF) A gap assessment against NIST CSF or the NCSC Cyber Assessment Framework. Get a quote
  • Incident response Breach response and recovery, as a retainer or a project. Get a quote

How quoting works

From this page to a fixed quote

  1. Tell us what you need

    The requirement you have been given, your deadline and your organisation size. The form below takes two minutes.

  2. A free 15-minute call

    We confirm the band, the certification level and anything in your environment that would change the scope.

  3. One written quote

    The package price from this page, plus any separately scoped items listed line by line. Nothing starts without your approval.

What could change the final price

  • Your organisation size, if the count differs from the band you picked.
  • Devices or software that are out of support and have to be replaced before you can pass.
  • Technical fixes beyond the package scope, quoted after the gap review.
  • An onsite Cyber Essentials Plus audit where the certification body requires one.
  • New licences, for example a security tool the controls need.

Certification is always the certification body's decision. Buying preparation does not buy a pass; it removes the reasons you would fail.

Questions

Pricing questions

Are these the prices I will actually pay?

Yes, for the package as described and a straightforward scope in the size band you choose. Your written quote repeats the figure and lists anything outside it before you approve any work. Prices exclude VAT.

Which size band am I in?

Count everyone who uses a device or account in the organisation, including part-time staff and contractors with company logins. Certification packages use four bands: 1 to 9, 10 to 49, 50 to 249 and 250 or more people. Managed subscriptions and add-ons use finer user bands; the tables list them all.

What is the difference between Guided, Ready and Managed?

Guided includes the certification fee and an assessor review of your answers; you make any changes yourself. Ready adds a gap review, remediation of failing controls and an evidence pack. Managed is a yearly programme: certification every year plus device monitoring, patching, policies and staff training that keep the controls true between assessments.

Do I pay the IASME certification fee on top?

No. Every certification package on this page includes the certification body fee for one cycle. Cyber Essentials Plus packages include the Plus technical audit fee too.

What is never included in the price?

Technical fixes beyond the package scope, replacement of devices or software that are out of support, new licences, and onsite assessment where the certification body requires it. We identify these at the readiness stage and quote them separately; nothing is added once the assessment has started.

Why do your prices differ from certification-only prices?

Self-led Cyber Essentials through IASME starts at £320 + VAT. Our £495 Guided package adds the assessor review, policy templates and support; Ready adds hands-on remediation. If the self-led route is enough for you, we will say so on the readiness call.

How does a Managed package work after year one?

Managed is an annual subscription priced by number of users. Year one adds a one-off onboarding: the monitoring agent on every device, policies set up, training launched and your first certification. For 1 to 9 people that is £1,610 in year one, then £1,025 a year. From year two you pay the annual subscription shown in the Managed plans table for your number of users, with the certification included each year. You can stop at renewal.

Does the Level 0 request from the MOD make DCC compulsory?

No. The MOD has asked its industry partners to hold DCC Level 0 by 31 December 2026. Your contract’s Cyber Risk Profile sets the binding level. If you supply the MOD or a prime contractor and hold nothing yet, Level 0 is the sensible place to begin.

Can you work alongside our existing IT provider?

Yes. We can handle the certification scope, readiness review, evidence and assessor coordination while your provider completes the technical fixes, or we quote for the fixes ourselves. You decide who does what before work starts.

Get your quote

Tell us the requirement. We confirm the price.

Your size band carries into the form. An engineer replies the same business day with the next step and a written scope.

  • A quote that matches this page, with exclusions listed line by line.
  • Help choosing between Cyber Essentials, Plus and DCC.
  • Works alongside your existing IT provider if you have one.

Prefer to talk? Book a free 15-minute call or ring 0330 043 7414.

Request a fixed quote

Choose the route if you know it. If not, tell us the requirement you have been given and we will recommend one.

Free enquiry, no obligation. We use these details to respond to your request. Privacy policy

Call us Get a quote