£9.4m Cyber Essentials Funding: How UK SMEs Can Get 75% Off Certification
On 3 November 2026, the government announced new funding to make Cyber Essentials cheaper, and in some cases free, for small and medium-sized businesses. Across two schemes, the package is worth £9.4 million.
If cost has been the reason you’ve put Cyber Essentials off, that reason has largely gone. Most eligible SMEs can now get certified for between £80 and £125 plus VAT.
There are a couple of things worth knowing before you rush in, though. The money is limited and allocated first come, first served. And the discount covers the certification fee, not the work needed to pass. Here’s what’s actually on offer, who qualifies, and how to get the most out of it.
What has the government announced?
The funding was announced by Cyber Security Minister Baroness Liz Lloyd at the National Cyber Security Centre’s (NCSC) Annual Review. It’s made up of two separate offers:
| Cyber Essentials First Step Fund | Cyber Essentials for Suppliers Grant | |
|---|---|---|
| Funding | £2.4 million | Up to £7 million |
| What you get | 75% off a new Cyber Essentials certification | Fully funded first-time certification, plus support from an NCSC-assured Cyber Advisor |
| Who it’s for | UK micro, small and medium-sized businesses not certified in the last four years | SME suppliers nominated by organisations that have signed the Cyber Resilience Pledge |
| How to access it | Apply directly through IASME | By nomination only |
| Available until | March 2027, or until the money runs out | March 2029 |
| Businesses expected to benefit | Around 6,000 | Around 8,000 |
For most SMEs, the First Step Fund is the one that matters. You can apply for it yourself, today.
The Cyber Essentials First Step Fund: 75% off certification
The First Step Fund knocks 75% off the cost of a new Cyber Essentials certificate. Based on IASME’s standard fees, here’s what that looks like:
| Organisation size | Standard fee | With the First Step Fund |
|---|---|---|
| Micro (0 to 9 employees) | £320 | £80 |
| Small (10 to 49 employees) | £440 | £110 |
| Medium (50 to 249 employees) | £500 | £125 |
All prices plus VAT.
Who’s eligible?
You’ll need to be a UK micro, small or medium-sized business that hasn’t held Cyber Essentials in the last four years. If you’re already certified, or your certificate lapsed recently, this one isn’t for you. It’s designed to bring new organisations into the scheme, not to subsidise renewals.
Not sure where you stand? Our free Cyber Essentials funding eligibility check takes about a minute.
How does it work?
Applications go through IASME, the NCSC’s Cyber Essentials delivery partner, at firststep.iasme.co.uk. The discount still applies if you certify through a Certification Body.
The funding covers the cost of your assessment and, if you pass, your certification. It doesn’t guarantee you’ll pass. That distinction matters, and we’ll come back to it.
Why timing matters
£2.4 million at roughly £80 to £125 a certificate is enough for around 6,000 businesses. There are millions of SMEs in the UK. The fund runs until March 2027 or until it’s spent, whichever comes first, and it’s allocated in the order applications arrive.
That’s not a sales line. It’s simply how the scheme is set up. If you’ve been meaning to get certified, now is a sensible time to check whether you qualify for the First Step Fund.
The Cyber Essentials for Suppliers Grant: fully funded, by nomination
The second, larger pot works differently. You can’t apply for it directly.
It’s linked to the Cyber Resilience Pledge, a voluntary commitment the government launched earlier this year. Organisations that sign it agree to make cyber security a board-level responsibility, sign up to the NCSC’s Early Warning service, and take a risk-based approach to requiring Cyber Essentials across their supply chains. More than 230 organisations have signed so far.
Signatories can nominate SME suppliers for fully funded Cyber Essentials certification, along with tailored support from an NCSC-assured Cyber Advisor. If you’re nominated, the organisation will contact you and guide you through the process.
What this means for you: if you supply larger organisations, check whether any of them appear on the list of Pledge signatories published on GOV.UK. If they do, expect Cyber Essentials to become a more regular question in supplier reviews. It’s worth having a conversation with them about it before they raise it with you.
Why Cyber Essentials is worth doing (beyond the certificate)
It’s easy to treat Cyber Essentials as a badge for tenders. It’s more useful than that.
It targets the attacks SMEs actually face
The government’s Cyber Security Breaches Survey found that half of small businesses experienced a cyber breach or attack in the previous 12 months, and the government estimates cyber threats cost UK businesses £14.7 billion a year.
Most of those attacks aren’t sophisticated. They rely on unpatched software, reused passwords, accounts without multi-factor authentication, and staff using admin rights for everyday work. Cyber Essentials is built around five controls that deal with exactly those weaknesses:
| Control | What it means in practice | Why it matters to the business |
|---|---|---|
| Firewalls | Your internet connection and devices are protected by properly configured firewalls | Stops attackers reaching services that should never be exposed to the internet |
| Secure configuration | Default passwords changed, unnecessary software and accounts removed | Closes the easy doors that automated attacks look for first |
| User access control | People only have the access they need, and admin rights are kept separate | Limits the damage if a single account is compromised |
| Malware protection | Anti-malware or application controls in place on devices | Reduces the chance of ransomware or malicious downloads taking hold |
| Security update management | Supported software, with critical and high-risk updates applied within 14 days | Removes the known vulnerabilities attackers exploit most often |
It opens commercial doors
Cyber Essentials certification can help you win government contracts, and it’s increasingly asked for in supplier questionnaires and private-sector tenders. For many SMEs, it’s the difference between being considered for a contract and being filtered out at the first stage.
It can come with cyber insurance
Organisations with Cyber Essentials covering the whole organisation and a turnover under £20 million can receive up to £25,000 of cyber liability insurance, subject to terms. Check the details with IASME before you rely on it, but it’s a genuinely useful extra for a small business.
What the funding doesn’t cover
This is the part most announcements skip.
The First Step Fund pays for the assessment. It doesn’t pay for the work needed to pass it. If your systems aren’t ready, you’ll either fail or stall partway through, and the clock on the fund keeps ticking.
The common sticking points tend to be the same:
-
Unsupported software. Windows 10 devices that aren’t enrolled in Microsoft’s Extended Security Updates are now out of support and won’t meet the requirements. The same applies to old server operating systems, unsupported browsers and legacy applications.
-
Missing multi-factor authentication. Cloud services such as Microsoft 365 need MFA in place for users and administrators.
-
Patching that isn’t fast enough. Critical and high-risk updates need to be applied within 14 days of release, across every in-scope device. This is where secure, proactive IT support pays for itself.
-
Admin rights used for everyday work. Staff shouldn’t be browsing or reading email from accounts with administrator privileges.
-
Default passwords and forgotten devices. Routers, firewalls and other kit still running factory settings.
-
Personal devices. If staff access company email or data from their own phones or laptops, those devices are usually in scope too, and need the same endpoint protection as company kit.
None of these are difficult to fix on their own. Together, and with a business to run at the same time, they can take a while. The sooner you know where your gaps are, the better.
How to apply for Cyber Essentials funding: step by step
-
Check you’re eligible. UK-based SME, and no Cyber Essentials certificate in the last four years. Our 60-second eligibility checker will tell you.
-
Find your gaps. The NCSC’s free Cyber Essentials Readiness Tool is a good starting point. Alternatively, a short readiness review with someone who’s been through the process many times will tell you exactly what needs fixing.
-
Fix what needs fixing. Update or replace unsupported devices, switch on MFA, tighten admin access and get patching under control.
-
Apply for the First Step Fund through IASME at firststep.iasme.co.uk.
-
Complete your assessment. Answer the self-assessment questionnaire accurately; it’s reviewed by a Certification Body.
-
Plan for next year. Cyber Essentials lasts 12 months, and the discount only applies to new certifications, so budget for the standard fee at renewal. More importantly, keep the controls in place all year rather than rushing to fix things each time renewal comes round. Ongoing managed cyber security makes that far easier.
How Be Tech Secure can help
We help UK SMEs get Cyber Essentials ready, get certified and stay compliant afterwards. We hold Cyber Essentials and Cyber Essentials Plus ourselves, so we’ve been through exactly the process we’ll take you through.
In practice, that means:
-
A free eligibility check and readiness review that shows you where you stand against the requirements, in plain English.
-
Hands-on remediation across Microsoft 365, endpoints, MFA, patching and firewalls, so you’re not left with a to-do list and no time to work through it.
-
Guidance through the application, including the First Step Fund, so you get the discount and submit with confidence.
-
Ongoing support through our managed cyber security services and security awareness training, so your controls stay in place between renewals rather than a scramble every 12 months.
The funding has made certification affordable. Our job is to make sure you pass first time and get real protection out of it, not just a certificate.
Check My Eligibility: free, 60 seconds →
Frequently asked questions
How much does Cyber Essentials cost with the new funding?
With the First Step Fund, eligible SMEs pay between £80 and £125 plus VAT, depending on the size of the organisation. That’s 75% less than the standard fee.
Can I use the funding to renew my Cyber Essentials certificate?
No. The First Step Fund is for organisations that haven’t held Cyber Essentials in the last four years.
When does the Cyber Essentials First Step Fund close?
It runs until March 2027, or until the £2.4 million is spent, whichever happens first. Applications are dealt with first come, first served.
Is Cyber Essentials Plus covered by the funding?
The government’s published material doesn’t say that Cyber Essentials Plus is included. Check with IASME before you apply if Plus is what you need.
How do I get fully funded Cyber Essentials?
The fully funded route is the Cyber Essentials for Suppliers Grant. You can’t apply directly; you need to be nominated by an organisation you supply that has signed the government’s Cyber Resilience Pledge.
Does the funding guarantee I’ll pass?
No. It covers the cost of the assessment and, if you pass, certification. Your systems still need to meet the requirements, which is why preparing beforehand matters.
Do I need an IT provider to apply?
No, you can apply yourself. Many SMEs find it quicker and less stressful to have someone check their readiness and fix the gaps first, particularly around Microsoft 365, device patching and admin access. If you’d like a hand, speak to a Cyber Essentials expert.
