The government has launched a 75% discount for eligible small and medium-sized UK businesses seeking Cyber Essentials, a certification that checks basic cyber security protections. The offer is subject to available funding.
The First Step Fund opened on 3 November and is backed by £2.4 million. The discounted assessment fee ranges from £80 to £125 plus VAT, depending on the organisation’s size.
Among the conditions, applicants must be micro, small or medium-sized UK businesses seeking a new certificate and must not have been certified under the scheme in the previous four years. Funding is allocated on a first-come, first-served basis. The offer is due to end at the end of March 2027, or sooner if the money runs out. Applicants must meet the scheme’s eligibility requirements.
The government estimates that around 6,000 businesses could benefit. That is an estimate of potential take-up, not a count of firms that have already qualified or been certified.
A separate route for suppliers
A second scheme will fund first-time certification for eligible UK-based smaller suppliers nominated by organisations that have signed the Cyber Resilience Pledge. The grant is worth up to £7 million and is intended to run until the end of March 2029. The government estimates that roughly 8,000 suppliers could benefit.
The two routes have different eligibility and access arrangements. Under the supplier scheme, participating pledge signatories identify and notify relevant suppliers and guide them towards the application process. Supplying an organisation that has signed the pledge does not, by itself, mean a business has been selected for funding.
Selected suppliers can also receive tailored support from a cyber security adviser assured by the National Cyber Security Centre. The First Step Fund, by contrast, offers a discount rather than the supplier grant’s fully funded assessment.
What the funding covers
IASME, the scheme’s delivery partner, provides the route to the discount. Businesses can choose to work with a licensed certification body and still use the offer. The funding applies to the assessment and, if the assessment is passed, certification; it does not guarantee a certificate.
Businesses should also consider any work needed to meet the standard. The discount is for the assessment and certification rather than a general fund for putting the required protections in place.
The basic Cyber Essentials route uses a verified self-assessment. An organisation’s answers are signed off by a board member or equivalent and marked by an assessor. A licensed certification body can help a business understand the questions and how they apply to its systems.
The protections being assessed
Cyber Essentials is built around five areas: firewalls, secure configuration, security update management, user access control and malware protection. Together, they provide a baseline for addressing common internet-based threats.
A firewall filters connections between the internet and a network. Secure configuration is about setting up devices to reduce opportunities for unauthorised access. Security updates address vulnerabilities in software, while access controls govern who can reach data and services. Malware protection is intended to identify and deal with malicious software.
The standard is a starting point, not a guarantee that a business will avoid a cyberattack. Controls need to be maintained after certification. A separate Cyber Essentials Plus option covers the same five areas but includes more rigorous independent technical testing.
Businesses preparing for certification can use free resources, including the assessment questions, requirements for IT infrastructure and a readiness tool. Small and medium-sized enterprises preparing for Cyber Essentials can also book a free 30-minute consultation with an assured cyber adviser.
Wider supply-chain work
The Cyber Resilience Pledge is voluntary. Signatories commit to making cyber security a board-level responsibility, using an early-warning service and taking a risk-based approach to requiring Cyber Essentials across their supply chains.
More than 230 organisations had signed the pledge when the funding package was announced. The supplier grant is designed to help eligible smaller firms in those supply chains, but nomination and selection remain important parts of the process.
The announcement also introduced 14 organisations joining the second cohort of Software Security Ambassadors. They will work to promote secure software development and encourage adoption of the Software Security Code of Practice across their networks and supply chains.
