At Unavoidably Secure, an independent cyber security and compliance audit for a small UK organisation costs nothing to start: the external audit is free. A full audit is a fixed fee from £950, standards readiness for the DSPT or Cyber Essentials is from £1,500, and ongoing assurance is from £250 a month. This page explains what each price covers and what else you might pay for.
On this page
Our fixed fees
We work mainly with dental practices, care providers and small charities across the UK. Every fee is fixed and quoted after a short scoping call, so there are no day rates and no surprises.
Your public web and email surface, assessed without any access to your systems. Written report within five working days.
All four components, evidence pack, remediation plan, and a re-test at 60 days.
Everything in the full audit, plus DSPT or Cyber Essentials evidence assembly and support through to submission.
Continuous monitoring, quarterly re-assessment, evidence kept current, annual submission handled.
Ongoing assurance can follow any audit, and the early months are discounted against the audit fee.
What drives the cost of an audit
"Cyber security audit" covers very different pieces of work, which is why prices quoted online vary so much. The main things that change the price are:
- Scope. A look at your public web and email setup is quick. A review that also covers documentation, internal systems and a standard such as the DSPT takes longer.
- The standard you need to meet. Preparing evidence for the NHS Data Security and Protection Toolkit or Cyber Essentials adds work on top of a general audit, which is why our standards readiness package starts higher than the full audit.
- Size and complexity. More staff, devices, sites and suppliers means more to check and more evidence to gather.
- How much testing is active. Our audits assess your systems on evidence your IT provider produces. In-depth manual penetration testing is a separate, specialist service, and we refer it to a CREST-registered partner.
- Who fixes the problems. An audit tells you what needs doing. Carrying out the technical fixes is usually done by your IT provider and is priced separately by them.
Our full audit covers four areas: your external attack surface, cookies and consent on your website, governance documentation, and internal systems. That is 26 automated technical checks and 59 documentation review criteria, mapped to the ten DSPT standards and the five Cyber Essentials controls.
Cyber Essentials certification fees (official)
Many small organisations searching for an audit actually need Cyber Essentials. The certification itself is issued by a certification body, not by us; we are not a Cyber Essentials certification body. IASME publishes these assessment fees for basic Cyber Essentials:
| Organisation size | Cyber Essentials fee (IASME) |
|---|---|
| Micro (0 to 9 employees) | £320 + VAT |
| Small (10 to 49 employees) | £440 + VAT |
| Medium (50 to 249 employees) | £500 + VAT |
| Large (250 or more employees) | £600 + VAT |
Source: IASME, checked 22 October 2026. Cyber Essentials Plus has no fixed published fee; IASME says it is priced according to the size and complexity of your network, and quotes come from certification bodies. For a fuller breakdown, see our guide to what Cyber Essentials costs in 2026.
Our standards readiness package (from £1,500) prepares the evidence so your application to a certification body goes through first time. The certification body's own fee is paid to them.
Other costs to budget for
- Fixes your IT provider carries out. For example switching on multi-factor authentication, replacing unsupported software, or correcting email records. Some cost nothing but time; others need new equipment or licences.
- Certification fees. Paid directly to a Cyber Essentials certification body if you choose to certify.
- Staff time. Someone in your organisation will need to answer questions and find documents. A good audit keeps this to a minimum.
See where you stand for free
The external audit costs nothing, needs no access to your systems, and arrives as a written report within five working days.
Request your free auditOr email support@unavoidablysecure.com
Which option is right for you
| If you need to | Start with |
|---|---|
| Find out whether your email or website is exposed | Free external audit, or the free email security check |
| Get an independent check and a remediation plan | Full audit, from £950 |
| Submit the DSPT or apply for Cyber Essentials | Standards readiness, from £1,500 |
| Stay compliant through the year | Ongoing assurance, from £250 a month |
Sector pages: DSPT support for dental practices, cyber security audit for dental practices, and DSPT help for care homes and home care providers.
Common questions
How much does a cyber security audit cost for a small business in the UK?
At Unavoidably Secure the external audit is free, a full audit is from £950, standards readiness for the DSPT or Cyber Essentials is from £1,500, and ongoing assurance is from £250 a month. All are fixed fees quoted after a scoping call.
Is the free audit really free?
Yes. It covers your public web and email surface, needs no access to your systems, and comes as a written report within five working days. There is no obligation, and you keep the report either way.
Does the price include Cyber Essentials certification?
No. We are not a Cyber Essentials certification body. IASME publishes basic Cyber Essentials fees from £320 + VAT for micro organisations to £600 + VAT for large ones, paid to the certification body. Our standards readiness package prepares you for it.
Does the audit include penetration testing?
Our audits include automated technical checks and assess internal systems on evidence from your IT provider. In-depth manual penetration testing is referred to a CREST-registered partner and priced separately.
Why are your prices given as from?
The final fixed fee depends on the size of your organisation and what you need to prove. We agree it after a 30-minute scoping call, before any work starts.
This page is general information, accurate at the time of writing (October 2026), and is not legal advice. No assessment certifies compliance with any standard. Unavoidably Secure is not a Cyber Essentials certification body. Fees are fixed and quoted after a scoping call.