Scope and certificate
Confirm the legal entity, staff band, sites, cloud services, remote workers and CE certification date.
Compliance · Technical audit
Cyber Essentials Plus. Prepare for the audit, not a surprise.
Independent technical verification of your Cyber Essentials controls. Understand the prerequisite, audit scope and total price before you commit.
30 minutes to clarify scope.
Two routes. No hidden addition.
Audit only, or both certifications together.
A CE pass is a prerequisite. New applicants need both assessments; an eligible recent CE holder may only need the audit.
| Organisation | Staff | Plus audit only | New applicant: CE + Cyber Essentials Plus |
|---|---|---|---|
| Micro | 0–9 | £1,095 + VAT fixed | £1,415 + VAT |
| Small | 10–49 | £1,395 + VAT fixed | £1,835 + VAT |
| Medium | 50–249 | From £1,750 + VAT | From £2,250 + VAT |
| Large | 250+ | From £2,500 + VAT | From £3,100 + VAT |
Already have Cyber Essentials?
If your CE pass is less than three months old, an audit-only route may be possible. Confirm the certificate date, scope, eligibility and remaining window: the Cyber Essentials Plus audit must be completed within three months of CE certification, not merely booked. Malwise will not automatically charge you twice.
All prices exclude VAT. Confirm sites, platforms, device sample, access, delivery approach, travel and any additional work in the proposal. Optional preparation or remediation is separate.
What Cyber Essentials Plus verifies
Your controls, put to a technical check.
Cyber Essentials Plus adds independent technical testing to the verified Cyber Essentials self-assessment. It tests a sample to check that specified controls are working in practice.
Prepare for the audit
Get the practical details ready, together.
Involve the person who manages your IT. A prepared audit needs the right devices, access and people available to answer questions.
Working devices
Identify operating systems and device types so the required sample and access can be agreed.
Access and availability
Arrange permissions, technical contacts, user availability and any remote or on-site access.
Remediation ownership
Decide who will make changes if issues are found. Implementation is not automatically part of the audit fee.
A defined audit journey
No mystery between quote and outcome.
Scope and eligibility, prepare and book, complete the technical audit, then understand the outcome and any required follow-up. Preparation is not a pass guarantee, and remediation or reassessment conditions are confirmed for the engagement.
Can I buy Cyber Essentials Plus without Cyber Essentials?
No. A CE pass is a prerequisite. New applicants should use the combined prices above.
Is the audit remote or on site?
The delivery approach depends on scope and access. Discuss locations, remote workers, platforms and travel before the proposal is confirmed.
What if testing finds something to fix?
Agree who will remediate, how follow-up works and any reassessment costs or timing. Do not assume unlimited retesting.
Can you guarantee a pass by our deadline?
No. Share the actual requirement and date so feasibility can be discussed. Controls, eligibility, preparation and availability all affect the outcome.