The government now pays 75% of the cost of Cyber Essentials for eligible small and medium organisations. For the smallest, that brings the assessment down from £320 to £80 + VAT.
The offer is called the Cyber Essentials First Step Fund. It runs until 31 March 2027, or until the money runs out.
What the First Step Fund is
The government announced the fund on 3 November 2026 as part of a Cyber Essentials funding package (opens in a new tab). It's for micro, small and medium-sized organisations getting a new Cyber Essentials certificate.
You apply through IASME, the government's delivery partner for Cyber Essentials. The discount still applies if you certify through a certification body.
What you pay
The price depends on how many people you employ. You confirm your size when you apply.
- 0 to 9 employees (micro): £80 + VAT, down from £320.
- 10 to 49 employees (small): £110 + VAT, down from £440.
- 50 to 249 employees (medium): £125 + VAT, down from £500.
The funding covers the assessment and, if you pass, the certificate. It doesn't guarantee a pass, and it doesn't pay for work to get your systems ready.
Certification can also bring cyber liability insurance. UK-based organisations with a turnover under £20m that certify the whole organisation get up to £25,000 of cover.
Who can apply
- You're a micro, small or medium-sized organisation.
- Your organisation is registered in the UK.
- You haven't held Cyber Essentials in the last four years.
IASME checks your organisation details and Cyber Essentials history when you register. If you already renew every year, the fund isn't open to you.
The discount counts as a subsidy. It has to fit within your Minimal Financial Assistance limit (opens in a new tab) of £315,000 over three years, under the Subsidy Control Act 2022.
Key dates
You must register and buy your discounted assessment by 31 March 2027. From the day you buy, you have six months to complete and submit it.
The government has set aside £2.4m, which it expects to cover about 6,000 organisations. It's first come, first served, so the fund may close before 31 March.
How to apply
- Create an account on IASME's Supplier Assurance Tool (opens in a new tab). You set it up yourself, because you accept IASME's terms on behalf of your organisation.
- Enter your organisation details, and the tool checks you're eligible.
- Buy the discounted assessment before 31 March 2027.
- Answer the self-assessment questions within six months. A certification body marks your answers and issues the certificate once you pass.
Preparing for the assessment
Your six months start when you buy, so it's worth knowing where you stand first. Cyber Essentials checks five technical controls.
- Firewalls: every device and network in scope sits behind one.
- Secure configuration: default passwords are changed, and software and accounts you don't need are removed.
- Security update management: only supported software is in use, and high and critical updates go on within 14 days.
- User access control: people get only the access they need, with MFA wherever it's offered.
- Malware protection: every device in scope runs anti-malware or only allows approved apps.
Some gaps fail the assessment on their own. Missing MFA on a cloud service that offers it is one, and so is unsupported software anywhere in scope.
Our Cyber Essentials guide goes through each control. If you'd rather have someone check, a Cyber Advisor can review your setup and list the gaps, worst first.
Cyber Essentials for Suppliers
The same package includes a second offer for suppliers to organisations that have signed the government's Cyber Resilience Pledge. Nominated suppliers get Cyber Essentials fully funded, and some also get support from a Cyber Advisor.
You can't apply for it yourself. The signatory contacts the suppliers it nominates, and the offer runs until the end of March 2029.
Certifying with us
We're an IASME-accredited Cyber Essentials Certification Body, so the discount applies when you certify with us. See the funded prices and who qualifies, or read about Cyber Essentials certification.
Sources
- GOV.UK, Cyber Essentials funding package, 3 November 2026 (opens in a new tab)
- GOV.UK, New Government-backed cyber security protections could save UK businesses thousands, 3 November 2026 (opens in a new tab)
- IASME, Buy Cyber Essentials: First Step funding (opens in a new tab)
- IASME, Supplier Assurance Tool terms of use (opens in a new tab)
- IASME, Cyber liability insurance (opens in a new tab)
- GOV.UK, Subsidy control: a guide for beneficiaries (opens in a new tab)
- NCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 (opens in a new tab)
Common questions
What is the Cyber Essentials First Step Fund?
A government fund that pays 75% of the cost of a new Cyber Essentials certificate for eligible micro, small and medium organisations. It runs until 31 March 2027, or until the money runs out.
How much does Cyber Essentials cost with the funding?
£80 + VAT for 0 to 9 employees, £110 + VAT for 10 to 49 and £125 + VAT for 50 to 249. That covers the assessment and, if you pass, the certificate.
Can we use the discount if we already have Cyber Essentials?
Only if you haven't held it in the last four years. The fund is for organisations getting a new certificate.
Does the First Step Fund cover Cyber Essentials Plus?
Not as published. The government describes it as a discount on Cyber Essentials certification, which you need before you can get Plus.