What size business needs Cyber Essentials?

Cyber Essentials applies to UK organisations of every size, from sole traders to multi-thousand-employee enterprises. The scheme uses a four-tier pricing structure based on headcount, with the same five technical controls assessed at every tier. A buyer, contract or insurer may specify CE or CE Plus; confirm the exact requirement before purchasing. SJP's published reporting describes Cyber Essentials Plus or its Device as a Service route for Partner Practices, not a general basic-CE requirement. See the SJP guidance and sources.

UK-wide pricing; Fig Group's published tiers are the lowest of any IASME-licensed body. See the full pricing page.

Include:

• Full-time employees on payroll
• Part-time employees on payroll
• Directors (working or non-executive)
• Contractors with persistent access to organisational systems / data
• Consultants in a long-term engagement with organisational email accounts

Exclude:

• One-off project contractors without ongoing access
• Clients, customers, or end-users of your service
• Group companies or subsidiaries that would be assessed under their own scope

Total headcount at the point of assessment determines tier.

Larger organisations will typically have:

• More in-scope endpoints
• More in-scope cloud services
• More complex Conditional Access / identity policies
• A need for more rigorous internal controls around joiner / mover / leaver processes

The assessment depth scales accordingly, but the five controls remain the five controls.

Yes. The Large tier covers 250 to 9,999 employees. Organisations with 10,000+ employees fall into the Enterprise tier, which is priced as a custom quote and scoped individually - the standard turnaround SLA does not apply because IASME requires pre-certification checks at this size. Where more depth is needed, organisations also progress to IASME Cyber Assurance Level 2 or to ISO 27001.

Yes. See Can a sole trader get Cyber Essentials?.

Yes - Large-tier CE is held by many large organisations and multinationals (250 to 9,999 employees). Organisations with 10,000+ employees use the Enterprise tier (custom quote, IASME pre-certification checks required). At this scale CE is typically paired with ISO 27001 rather than being the primary cybersecurity credential.

Every UK business size is covered by Cyber Essentials, and pricing is tiered to match. For the overwhelming majority of UK SMEs, the Micro or Small tier is the right starting point - certified in 6 working hours with Fig Group from £299.99 + VAT.

Start Cyber Essentials from £299.99 + VAT | All pricing tiers | Cyber Essentials Online