Pass Cyber Essentials First Time: 75% Funding

The government now pays 75% of your Cyber Essentials assessment. It won't pay for you to pass.

Since 3 November 2026, eligible small and medium organisations can certify through the First Step Fund from £80 + VAT. The funding covers the assessment, and the certificate only once you pass. To pass Cyber Essentials first time, the preparation has to happen before you submit.

The scheme also has a deadline. The government expects (opens in a new tab) its £2.4m budget to fund around 6,000 organisations on a first come, first served basis, and the discount closes on 31 March 2027 at the latest. Once the assessment is bought, you have six months to submit your answers.

This guide covers how to secure the funding, what each of the five controls checks, a 30-minute readiness check and a six-month plan from purchase to certificate.

The 75% Cyber Essentials funding in 60 seconds

Our Cyber Essentials funding page covers the scheme in full. These are the figures that matter.

Organisation size	Employees	Usual price	With 75% funding
Micro	0 to 9	£320 + VAT	£80 + VAT
Small	10 to 49	£440 + VAT	£110 + VAT
Medium	50 to 249	£500 + VAT	£125 + VAT

You qualify if you:

have fewer than 250 employees
are registered in the UK
haven't held Cyber Essentials in the last four years

You register and buy the discounted assessment on IASME's Supplier Assurance Tool (opens in a new tab) by 31 March 2027, or sooner if the money runs out. IASME's terms make the account holder the client, so you set the account up yourself. Tell us before you buy and we'll talk you through it.

The discount counts as a subsidy, so it has to fit within your Minimal Financial Assistance limit (opens in a new tab) of £315,000 over three years.

Check the free route before you pay anything

The government has also launched a second scheme. The Cyber Essentials for Suppliers grant, worth up to £7m and running until March 2029, pays for first-time certification in full. Some suppliers also get support from an NCSC-assured Cyber Advisor.

You can't apply for it yourself. More than 230 organisations have signed the government's Cyber Resilience Pledge, and they nominate SME suppliers from their own supply chains. If you supply a larger organisation, check the signatory list on GOV.UK. If a customer of yours is on it, ask them whether you're being nominated before you buy the discounted assessment.

Why funded doesn't mean certified

The discount pays for one attempt at the assessment.

The funding doesn't cover getting ready. The government's funding notice (opens in a new tab) says it pays for the assessment and, if you pass, the certificate. It doesn't guarantee certification. Work to close gaps, such as switching on MFA, replacing old laptops or tightening admin rights, sits outside it.
Failing has a short safety net. If you fail, IASME gives you two working days (opens in a new tab) to fix simple issues and update your answers at no extra cost. After that window, or if the fix takes longer, you'll need to reapply and pay again, and the discount may no longer be available.
The six-month clock starts at purchase. IASME allows six months from purchase to complete the assessment. After that, the account may be closed, and the fee isn't refunded.

For most organisations, the time and equipment needed to meet the five controls cost more than the £80 to £125 fee. Our guide to how much Cyber Essentials costs breaks that down.

When to secure the funding

Secure the funding early and submit when you're ready. Funding is first come, first served, so waiting risks missing out. Once the assessment is bought, you have six months to get ready, working with one team from start to finish. The readiness check further down tells you which route fits.

Route	Sounds like you if	What to do	Aim to submit
Ready	You answer yes to all 10 readiness questions	Secure the funding, then submit	Within 2 to 4 weeks
Gaps to fix	You have a handful of gaps you can close in-house or with some help	Secure the funding now, book a readiness check and work through the fix list	By month 3 or 4
Major gaps	Old devices across the organisation, no MFA, shared admin logins	Get the fixes costed first, then secure the funding once they'll land inside six months	By month 5, leaving a buffer

Two examples:

A six-person accountancy runs on Microsoft 365, with MFA already on and up-to-date laptops. That's the ready route, and a quick review mostly confirms what's in place.
A 30-person manufacturer has a few older shop-floor PCs, one shared admin login and staff reading work email on personal phones. That's gaps to fix. The phones are in scope, the old PCs need replacing or moving onto a separate network with no internet access, and the shared login needs splitting into named accounts. Allow around three months.

The five Cyber Essentials requirements, and where small organisations fail

Cyber Essentials checks five technical controls across everything in scope. Under the current requirements (opens in a new tab) (v3.3, in force since April 2026), every cloud service you use is in scope and can't be left out. So is any personal device that accesses work data or services.

Firewalls

What's checked: every in-scope device and network sits behind a firewall, and default admin passwords on routers and firewalls have been changed.

Where people fail: home working. Routers you give to staff are in scope. Staff's own home routers aren't, so each laptop needs its own software firewall switched on.

The fix: check the firewall is on for every laptop and change any default router passwords.

Secure configuration

What's checked: default passwords changed, unused software and accounts removed, auto-run turned off, and every device locked with a PIN, password or biometric.

Where people fail: old user accounts, trial software nobody uses, or a default password still on a network storage box.

The fix: a one-off tidy-up, then a short checklist whenever someone joins, leaves or gets a new device.

Security update management

What's checked: all software is licensed and still supported, and high-risk or critical updates are installed within 14 days of release.

Where people fail: unsupported software. Anything that no longer gets security updates has to be removed, or moved onto a separate network with no internet access. Windows 10 reached end of support in October 2025, so older PCs are a common sticking point.

The fix: turn on automatic updates everywhere you can, then replace or isolate anything the vendor no longer supports.

User access control

What's checked: people only have the access they need, admin rights sit on separate admin accounts, and MFA is in place.

Where people fail: MFA. The v3.3 requirements (opens in a new tab) say logins to cloud services must always use MFA. If a service offers it and it's switched off, that fails the assessment on its own. The other common issue is an admin account used for everyday email and browsing.

The fix: switch on MFA for Microsoft 365 or Google Workspace, your accounting software, your CRM and every other cloud service. Give admins a separate account for admin tasks only, and remove leavers promptly.

Malware protection

What's checked: every in-scope device runs anti-malware software, or only allows approved apps to run.

Where people fail: personal laptops and phones used for work, and protection someone switched off months ago.

The fix: confirm anti-malware is running and updating on every computer. On phones and tablets, restricting installs to the official app stores is the usual approach.

The 30-minute Cyber Essentials readiness check

Answer each question with a plain yes or no. "Mostly" counts as no.

Do you have a complete list of every laptop, desktop, server, phone, tablet and cloud service that touches company data, including personal phones that get work email?
Is MFA switched on for every cloud service that offers it?
Is every device running an operating system and apps that still get security updates?
Are high-risk and critical updates installed within 14 days, ideally automatically?
Have default passwords been changed on routers, firewalls and other network kit?
Do staff use standard accounts day to day, with admin rights kept on separate admin accounts?
Are leavers' accounts disabled promptly, and unused accounts removed?
Does every computer have a firewall switched on, including laptops used at home?
Is anti-malware running and up to date on every computer, with phones and tablets limited to official app stores?
Does every device need a PIN, password or biometric to unlock?

How to read your score:

10 out of 10 (green): you're on the ready route. Secure the funding and submit.
8 or 9 (amber): secure the funding now, fix the gaps, then submit. Aim to submit within three months.
7 or fewer (red): talk to a Cyber Advisor before anything is bought. They'll turn your no answers into a prioritised fix list, worst gaps first.

Our free Cyber Essentials guide covers each control in more detail.

Your six-month plan from purchase to certificate

This is how the six months break down on the gaps-to-fix route. On the ready route, the whole process can take a few weeks.

Week 1: secure the funding. You register on IASME's Supplier Assurance Tool and buy the discounted assessment, and we talk you through it.
Weeks 1 to 2: set your scope. List every device, user and cloud service. Decide whether you're certifying the whole organisation, which you'll need for the included insurance, or a defined part of it.
Weeks 2 to 8: fix the gaps. Work through your no answers, worst first. MFA and unsupported devices usually come top.
Weeks 8 to 10: readiness review. We check your answers against the requirements before you submit. Fixing a gap now costs less than failing.
Weeks 10 to 12: submit. Complete the online questionnaire and we mark it. If anything simple needs correcting, you have two working days to fix it.
Certificate issued. It's valid for 12 months.
Month 11 after certifying: plan your renewal. The funding only covers new certificates, so renewal is at the usual price. IASME emails a reminder about a month before expiry.

Submitting by week 12 leaves months four to six as a buffer if anything slips.

Many organisations then move on to Cyber Essentials Plus, which adds a hands-on technical audit. As published, the First Step Fund doesn't cover Plus.

What certification gives you

Certification brings three practical benefits.

Cyber insurance. UK organisations with turnover under £20m that certify the whole organisation can opt in to cyber liability insurance (opens in a new tab) worth up to £25,000.
Contracts. IASME says (opens in a new tab) Cyber Essentials is now required in a large number of central government contracts and a growing number of local government ones. Larger private customers increasingly ask for it too, especially the 230-plus Cyber Resilience Pledge signatories, who've committed to requiring it across their supply chains where the risk warrants it.
Lower risk. The government estimates (opens in a new tab) that a significant cyber attack could cost a UK organisation around £195,000 on average. The estimate draws heavily on US data, so treat it as a guide. The five controls are designed to stop the most common online attacks.

Get certified with Osiris IT

We're an IASME-accredited Cyber Essentials Certification Body, based in Norwich since 2018. We talk you through buying the discounted assessment, then one team handles everything to your certificate, with no hand-offs to another firm. Our NCSC-assured Cyber Advisors check your setup first, so you know what would fail before you submit.

As your certification body, we:

talk you through checking your eligibility and buying the discounted assessment
run a readiness check against the five controls, with gaps listed worst first
help you close the gaps (quoted separately), or leave them to your own team
mark your assessment and issue your certificate

Get in touch before you buy anything. Check your eligibility or book a readiness check. You can also call 01603 986500 or email hello@osirisit.co.uk.

Sources

Common questions

What happens if we fail the Cyber Essentials assessment after using the funding?

The funding covers the assessment only. If you fail, IASME gives you two working days to fix simple issues and resubmit at no extra cost. After that, you reapply and pay again, and the discount may no longer be available. A readiness check beforehand shows what would fail.

Do we have to buy the assessment ourselves?

Yes. IASME's terms make the account holder the client, so you register and buy on its Supplier Assurance Tool, and we talk you through it. Buy by 31 March 2027, or sooner if the funding runs out, and you then have six months to submit.

Can any organisations get Cyber Essentials for free?

Yes, through the Cyber Essentials for Suppliers grant, which runs until March 2029. It fully funds first-time certification for SME suppliers nominated by organisations that have signed the government's Cyber Resilience Pledge. You can't apply directly: your customer nominates you.

Does the funding cover the cost of fixing problems before the assessment?

No. The First Step Fund covers the assessment and, if you pass, the certificate. Work to get ready, such as setting up MFA, replacing unsupported devices or reconfiguring firewalls, is paid for separately.

Can we use the discount if we already have Cyber Essentials?

Only if you haven't held it in the last four years. The fund is for organisations getting a new certificate.

How long does it take to get Cyber Essentials certified?

A few weeks, if your setup already meets the five controls. If you have gaps to fix, allow two to three months: the funding gives you six months from purchase.

Book a readiness check

75% off Cyber Essentials: how to pass first time