Cyber Essentials · 4 min read
Cyber Essentials First Step Fund: how the 75% discount works
How the Cyber Essentials First Step Fund works: 75% off for eligible UK SMEs until 31 March 2027, from £80 + VAT, and how to apply through IASME.
Certified and accredited
See our trust centre
What you pay.
The price depends on how many people you employ. You confirm your size when you register.
Micro
0 to 9 employees
£80 + VAT
Usual price £320 + VAT · you save £240
Small
10 to 49 employees
£110 + VAT
Usual price £440 + VAT · you save £330
Medium
50 to 249 employees
£125 + VAT
Usual price £500 + VAT · you save £375
Prices are IASME's, from the First Step page. The discount covers the assessment and certificate. Help getting ready is quoted separately.
Why certify with us.
We're the certification body, so one team sees your Cyber Essentials through from start to finish.
Certification body
IASME accredits us as a Cyber Essentials Certification Body, so we mark your submission and issue the certificate ourselves.
The whole process
We guide you from registering for the discount to holding your certificate, with no hand-offs to another firm.
Cyber Advisors in house
Our NCSC-assured Cyber Advisors check your setup against the five controls and help close the gaps.
Plus when you need it
We certify Cyber Essentials Plus too, and the work you do now carries straight into it.
Who qualifies.
IASME checks your organisation details and Cyber Essentials history when you register.
Fewer than 250 staff
Micro, small and medium-sized organisations with up to 249 employees qualify.
Registered in the UK
IASME checks your organisation is registered in the UK when you create your account.
New to Cyber Essentials
You haven't held a Cyber Essentials certificate in the last four years.
The discount counts towards your £315,000 Minimal Financial Assistance limit. Read the rules on GOV.UK.
Key dates.
The funding is limited and runs until 31 March 2027, or until it's used up.
Now
Register and buy
Create an IASME account, confirm you're eligible and buy the discounted assessment.
31 March 2027
Last day to buy
The discount ends on this date, or sooner if the funding runs out.
Six months on
Submit your assessment
You have six months from buying to complete and submit your answers.
How to claim it.
You register and buy through IASME with our help. We get you ready and issue your certificate.
Register
You create an account on IASME's Supplier Assurance Tool, which checks you're eligible, and we talk you through it.
Buy
Buy the discounted assessment before 31 March 2027 and choose Osiris as your certification body.
Prepare
A Cyber Advisor checks your setup against the five controls, or your own team handles it.
Certify
We mark your answers and issue your certificate once you pass.
What Cyber Essentials checks.
Five technical controls that stop most common attacks.
Firewalls
Every device and network in scope sits behind a firewall.
Secure configuration
Default passwords go, and software and accounts you don't need are removed.
Security updates
High and critical updates go on within 14 days of release.
User access control
People get only the access they need, with MFA wherever it's offered.
Malware protection
Every device in scope runs anti-malware or only allows approved apps.
Not sure you'd pass?
Missing MFA on a cloud service that offers it fails the assessment on its own. A Cyber Advisor checks your setup first and gives you a list of the gaps, worst first.
Funding questions.
What is the Cyber Essentials First Step Fund?
A UK Government fund, delivered by IASME, that takes 75% off a new Cyber Essentials certificate for eligible small and medium organisations. It runs until 31 March 2027 or until the money runs out.
Who can get the 75% discount?
UK-registered organisations with fewer than 250 employees that haven't held Cyber Essentials in the last four years. IASME checks this when you register.
Can we use the discount with Osiris?
Yes. The government confirms the discount applies when you certify through a certification body, and IASME accredits us as one.
When does the funding end?
You must register and buy your assessment by 31 March 2027, or sooner if the funding runs out. You then have six months to submit.
Does the discount cover help getting ready?
No. It covers the assessment and the certificate. We quote any readiness work or fixes before they start.
What happens if we don't pass?
The funding pays for the assessment, not a pass. A readiness check before you submit shows what would fail while there's time to fix it.
Does it cover Cyber Essentials Plus?
Not as published. The government describes it as a discount on Cyber Essentials certification, which you need before you can get Plus.
Does the discount count as a subsidy?
Yes. It counts towards your Minimal Financial Assistance limit of £315,000 under the Subsidy Control Act 2022.
Related insights.
Cyber Essentials · 5 min read
How much does Cyber Essentials cost?
What sets the cost of Cyber Essentials and Cyber Essentials Plus, from IASME's size bands and your scope to the work to get ready, and how to get an accurate quote.
Cyber Essentials · 3 min read
Cyber Essentials v3.3 (Danzell): what changed in April 2026
What changed in Cyber Essentials v3.3 (Danzell) in April 2026, including the MFA and patching questions that now fail automatically, and what it means at renewal.
Check your eligibility.
Tell us how many people you employ and when you need the certificate, and we'll reply within one working day.