Cyber Essentials is not a purchase, it is a subscription to a standard

Cheap Cyber Essentials › Annual renewal cost

Cyber Essentials lasts twelve months. At the end of that period you do it again, at the full tier price, against whatever the requirements say at that point. There is no loyalty rate, no reduced renewal fee and no multi-year certificate.

None of that is controversial and most buyers know it. What goes wrong is the accounting: the first certificate gets funded as a one-off, usually out of whatever budget the deadline came from, and then reappears a year later as an unbudgeted surprise in a month that had other plans. This article is about treating it as what it is, which is a recurring annual cost with a fairly predictable shape.

The three-year total, which is the number that should drive the decision

Take the tier fee and multiply it by three. For a twenty-person organisation that is £440 + VAT a year, so £1,320 over three years in assessment fees alone. For a two hundred person organisation it is £1,500.

Then add the internal cost, which is the part that changes shape over time.

How the cost typically distributes over three years

Year	Assessment fee	Internal effort	Remediation
One	Full tier price	Highest. Inventory built from scratch, questions read for the first time	Usually the largest, because everything that was wrong is found at once
Two	Full tier price	Lower, if the inventory was kept. As high as year one if it was not	Whatever fell out of support during the year, plus anything the revised question set now asks for
Three	Full tier price	Lowest, and largely a review exercise	Small and predictable, assuming years one and two were fixed properly rather than worked around

The shape of that table is the argument for fixing things properly the first time. An organisation that excluded an awkward system from scope in year one pays the year one internal cost again in year two and year three, because the same awkward conversation happens every time. An organisation that dealt with it pays it once.

Why the second year lands harder than the first

Three reasons, and all of them are about money rather than process.

The first year was funded by an event

Most first certificates are bought because something forced it: a tender, an insurance renewal, a customer's supplier questionnaire. That gives the spend an owner and an obvious justification. The second year has neither, because the tender was won and the insurance was renewed, and it lands on a budget holder who now has to justify a cost with no deadline attached to it. The certificate expiring is the deadline, and it is much less visible than the one that prompted the original purchase.

The remediation was capitalised and the renewal was not

If year one involved replacing a firewall and two laptops, that spend went somewhere sensible in the accounts and it does not repeat. What repeats is the fee plus the internal time, and because those look small next to the first year's total they frequently get left out of the following year's budget entirely.

Headcount moves you between bands

This one catches people out with some regularity. The tier price is set by staff numbers. Growing from nine people to ten moves you from £320 to £440. Passing fifty moves you to £500, and passing two hundred and fifty moves you to £600. A growing organisation should budget for the band above the one it is currently in if it expects to cross the threshold before the renewal date, and should check the headcount definition rather than guessing at it.

What actually recurs, and what does not

Splitting these two apart is most of the budgeting exercise.

• Recurring every year without exception: the assessment fee, and the internal time to refresh the inventory, read the current question set and complete the submission.
• Recurring but variable: whatever went out of support during the year. This is the line to watch, because it is the one that turns a £440 year into a £2,000 one, and it is forecastable if you keep a list of vendor end-of-support dates.
• Recurring monthly rather than annually: any licence uplift you bought to get multi-factor authentication, and any device management subscription. These are easy to forget when totalling the cost of certification because they arrive on a different invoice.
• Genuinely one-off: the initial inventory build, and the structural fixes such as separating administrative accounts or segregating a legacy system. You pay for these once if you do them properly.

Where the line should sit

Put it in the annual operating budget, in the same place as insurance and the accountant's fee, rather than in a project or capital line. It behaves like those costs: fixed, annual, non-negotiable if you want to keep trading with the customers who asked for it.

Give it a named owner, and make that owner the person who would be embarrassed if it lapsed rather than the person who happens to look after IT. In small organisations that is usually whoever handles insurance renewals, because they already run an annual diary of things that expire.

And set the reminder for three months before expiry rather than one. The fee does not change with notice, but the remediation cost does: finding an out-of-support server twelve weeks out is a planned replacement, and finding it three weeks out is an emergency purchase at whatever price is available.

Expiry dates and financial years

A small practical point that saves an annual argument. Your certificate expires twelve months after it is issued, which is unlikely to align with your financial year. If the first certificate was issued in February and your year ends in March, the renewal will always fall in the last month of the year, which is the month with the least budget flexibility.

You cannot move the expiry date backwards, but you can certify slightly early. Recertifying a few weeks ahead of expiry moves the anniversary forward permanently, and doing that once to land the renewal in a quieter month is worth the small amount of certificate life you give up. What you should not do is let it lapse in order to restart the clock, for the reasons below.

What a lapse costs, in money rather than principle

Letting a certificate expire does not incur a penalty and there is no late fee. The cost is entirely in what happens during the gap.

If a client checks the public register while you are uncertified, you are uncertified on the day they looked, and the cost of that is whatever the relationship is worth. If an insurance renewal falls in the gap, you may be answering a question about certification with a no. If a tender closes in the gap, you are ineligible for it. None of these costs appear on an invoice, which is exactly why they are easy to leave out of the comparison when deciding whether to defer the renewal by a month to help the quarter's numbers.

The saving from deferring is zero, because you pay the same fee whenever you pay it. The exposure is not zero. That is an unusually one-sided trade and it is worth pointing out to whoever is proposing it.

A budgeting method that takes ten minutes

1. Enter the tier fee as a fixed annual line, using the band above your current one if you expect to cross a headcount threshold.
2. Add a fixed allowance for internal time, based on what the last cycle actually took rather than what you hoped it would.
3. Keep a list of vendor end-of-support dates for everything in scope, and review it quarterly. Anything expiring in the next twelve months becomes a budgeted replacement rather than an emergency.
4. List the monthly licence and subscription costs that exist because of the five controls, and count them in the total so the real annual figure is visible.
5. Set the renewal reminder at three months, owned by a named person, with the expiry date recorded next to the insurance renewal.

Do that once and the fourth certificate costs the same as the third, arrives without drama, and never turns up as a surprise in somebody's month end.