Cyber Essentials First Step Fund: Small Businesses Can Now Get 75% Off Certification
UK small and medium-sized businesses can now get a 75% discount on Cyber Essentials certification, paying around £80 to £125 plus VAT, through a £2.4m First Step Fund that opened on 3 November 2026 and runs until March 2027 or until the money runs out.
By Entrepreneur Group · Published
Small and medium-sized UK businesses can now get Cyber Essentials, the government-backed cyber security certificate, for a quarter of the usual price. The new Cyber Essentials First Step Fund opened on 3 November 2026 and offers a 75% discount, bringing the cost down to about £80 to £125 plus VAT. The £2.4m fund is first come, first served and runs until March 2027 or until the money runs out.
The government announced the offer in a speech by Cyber Security Minister Baroness Lloyd at the National Cyber Security Centre's Annual Review. It estimates that around 6,000 businesses could benefit.
Who can apply and how
According to the government announcement and the funding package details:
- Who it is for: micro, small and medium-sized organisations seeking a new Cyber Essentials certificate.
- Prior certification: the discount is for businesses that have not been certified in the last four years.
- How to apply: through IASME, the government's delivery partner for Cyber Essentials. The discount still applies if you certify through a Certification Body rather than doing it yourself.
- What it covers: the assessment and, if you pass, the certificate. The funding does not guarantee that you will be certified.
- Deadline: until the end of March 2027, or earlier if the £2.4m runs out.
For context, the NCSC's Cyber Essentials page lists the basic certificate from £320 plus VAT, priced by organisation size, so a 75% discount on that starting price would bring it to £80 plus VAT.
What Cyber Essentials involves
Cyber Essentials is the government's recommended minimum standard of cyber security. The NCSC says it is built on five technical controls that protect against the most common internet-based attacks:
- Firewalls
- Secure configuration of devices and software
- Security update management
- User access control
- Malware protection
The basic certificate is a verified self-assessment: a board member or equivalent signs off the answers and an assessor marks them. Cyber Essentials Plus checks the same controls with independent technical testing.
There is an extra benefit for smaller firms. The government says certified organisations with turnover under £20m receive up to £25,000 of cyber liability insurance, and the NCSC says this applies where the whole organisation is certified.
Free certification for some suppliers
A second scheme, the Cyber Essentials for suppliers grant, is worth up to £7m until March 2029. It pays for first-time certification in full, plus tailored support from an NCSC-assured Cyber Advisor, for eligible small suppliers of organisations that have signed the government's Cyber Resilience Pledge. More than 230 organisations have signed the pledge so far.
You cannot apply for this grant directly. Pledge signatories identify and nominate suppliers in their supply chains, who are then guided through the process. The government estimates that around 8,000 businesses could benefit.
The government also cites an estimate that a significant cyber attack costs a UK business or organisation about £195,000 on average. It notes that this figure is based mainly on US data and is indicative only.
What it means for founders
This section is editorial guidance. If you have never had Cyber Essentials, or your certificate lapsed more than four years ago, this is the cheapest it is likely to be for some time, and the fund is first come, first served. Many larger customers and public sector buyers ask suppliers for Cyber Essentials, so it can also help when you tender. Before you apply, it is worth checking that your laptops, phones and cloud accounts meet the five controls, since the discount does not guarantee a pass. Recent warnings such as the NCSC alert on a PHP security flaw show why keeping software updated matters.
Frequently asked questions
How much does Cyber Essentials cost with the First Step Fund?
With the 75% discount, the government says Cyber Essentials certification costs about £80 to £125 plus VAT for eligible small and medium-sized businesses. The offer runs until March 2027 or until the £2.4m fund runs out.
Who is eligible for the Cyber Essentials First Step Fund?
The fund is for micro, small and medium-sized organisations seeking a new Cyber Essentials certificate that have not been certified in the last four years. Applications go through IASME, the government's delivery partner.
Can I get Cyber Essentials for free?
Some businesses can. The Cyber Essentials for suppliers grant fully funds first-time certification and a Cyber Advisor for eligible small suppliers nominated by organisations that have signed the Cyber Resilience Pledge.
Sources
- GOV.UK: New Government-backed cyber security protections could save UK businesses thousands (3 November 2026) (reviewed 4 November 2026)
- GOV.UK: Cyber Essentials funding package (3 November 2026) (reviewed 4 November 2026)
- National Cyber Security Centre: Cyber Essentials overview (reviewed 4 November 2026)
- GOV.UK: Cyber Resilience Pledge (reviewed 4 November 2026)