Summary

• Eligible UK SMEs can receive a 75% Cyber Essentials discount, reducing assessment prices to £80–£125 plus VAT, depending on organisational size.
• A separate grant provides selected suppliers with fully funded certification assessments and support from an NCSC-assured Cyber Advisor.
• The general discount runs until March 2027 or until funding is exhausted; the supplier programme is scheduled to run until March 2029.

The UK government has introduced financial support to help smaller businesses obtain Cyber Essentials certification, offering a 75% discount on assessments alongside a separate grant providing free certification and technical advice to selected suppliers.

The package, introduced on 3 November, brings together two programmes intended to increase adoption of baseline cybersecurity controls. The Cyber Essentials First Step Fund is available to eligible micro, small, and medium-sized organisations, while the Cyber Resilience Pledge supplier grant targets businesses nominated by participating larger organisations.

Under the general discount, eligible applicants will pay between £80 and £125 plus VAT, depending on organisational size. The government has allocated £2.4 million to the programme and estimates that approximately 6,000 businesses could benefit before it closes in March 2027 or exhausts its funding.

The supplier initiative has a separate allocation of up to £7 million through March 2029. It is expected to support approximately 8,000 businesses through free assessments and access to advisers assured by the National Cyber Security Centre, although participation depends on nomination and eligibility.

Certification focuses on five technical controls

Cyber Essentials establishes a set of baseline protections intended to reduce exposure to common internet-based attacks. Its requirements cover firewalls, secure configuration, security update management, user access control, and malware protection.

Each addresses a different weakness that can allow attackers to enter or operate within an organisation’s systems. Firewalls regulate network connections, while secure configuration reduces exposure created by unnecessary software services or insecure default settings.

Security update management is intended to prevent attackers exploiting vulnerabilities for which appropriate fixes are available. User access controls restrict information and system functions according to the permissions required, reducing the consequences of compromised accounts.

Malware protection provides another layer against malicious software that may reach devices through unsafe downloads, infected attachments, or other routes.

These controls are intended to work together. A fully updated device can still be exposed by weak access arrangements, while correctly configured accounts may remain vulnerable if the software they use contains an exploitable flaw.

Cyber Essentials certification provides evidence that an organisation has been assessed against the scheme’s requirements. Passing the assessment does not establish that every possible cybersecurity risk has been eliminated or that the business will never experience an incident.

Nor does the discount automatically pay for the technical work necessary to achieve compliance. Companies may need to update software, replace unsupported devices, change access arrangements, or obtain help from their IT providers before an assessment can be passed.

The funding covers assessment costs and certification where the applicant meets the standard, rather than guaranteeing a certificate regardless of its existing security arrangements.

Eligibility differs between the programmes

The First Step Fund is aimed at UK SMEs seeking to obtain Cyber Essentials certification, with the government specifying that applicants should not have been certified during the preceding four years.

That eligibility condition is more precise than a general offer to every organisation applying for renewal. Businesses holding recent certificates cannot assume the discount is available simply because they wish to undergo another assessment.

Applications are handled through IASME, the government’s Cyber Essentials delivery partner. The discount can also apply where an eligible organisation chooses to obtain certification through an approved certification body.

The supplier programme follows a different route. Businesses cannot obtain the larger grant merely by demonstrating that they supply a major company; they must be selected through an organisation participating in the Cyber Resilience Pledge.

More than 230 organisations have signed the pledge, committing to make cybersecurity a board-level responsibility, use the NCSC’s Early Warning service, and apply a risk-based approach to security expectations across their supply chains.

Participating organisations identify eligible suppliers and guide them through the application process. Successful applicants can receive a funded assessment alongside support from a Cyber Advisor, who can explain the controls and assist with preparation.

That advisory component addresses a different obstacle from certification fees. Smaller businesses may have limited internal technical expertise, particularly when cloud services, remotely managed devices, and third-party systems complicate responsibility for security.

An adviser can help establish what falls within the certification scope and which controls need attention, although the business remains responsible for implementing and maintaining the required protections.

Supplier security extends beyond individual companies

Businesses increasingly share information and operational processes with external providers. Accounting services, specialist software companies, logistics operators, and managed IT suppliers may all have access to systems or data belonging to their customers.

That creates dependencies extending beyond the direct contractual relationship. A compromised supplier account may affect customer information, while disruption to an essential service provider can interrupt several organisations simultaneously.

Customers consequently need evidence that suppliers maintain suitable security arrangements. Cyber Essentials offers a common set of controls against which smaller providers can demonstrate a baseline level of protection.

However, the significance of a supplier’s certification depends on the service it provides and the information it handles. An organisation responsible for administering sensitive customer systems may require additional contractual, technical, and operational safeguards beyond the five Cyber Essentials controls.

The new grants are intended to expand the number of businesses adopting those basic protections, with the supplier scheme creating a direct connection between larger organisations’ cybersecurity expectations and the smaller companies fulfilling their contracts.

Some SMEs may also encounter Cyber Essentials requirements when competing for particular contracts. Reducing assessment costs could make participation easier where a business already has the necessary controls, although it does not remove any separate technical investment required to satisfy them.

Ongoing security remains an operational task

Certification assesses controls at a particular point, while an organisation’s technology changes throughout the year. Employees join and leave, software is updated, new cloud applications are introduced, and devices are replaced.

Maintaining an effective security baseline therefore requires continuing attention to account permissions, configuration, updates, and the systems included within the organisation’s assessment scope.

Where a managed service provider performs some of that work, the business needs a clear understanding of which activities are covered by its contract and which responsibilities remain internal.

The government has also highlighted the financial consequences of significant cyber incidents, estimating that a serious attack could cost a UK organisation an average of £195,000. That figure describes a broader estimate of incident costs, not the amount saved automatically by obtaining Cyber Essentials certification.

Evidence of the programme’s effectiveness will depend on how many businesses obtain and maintain certification, whether the support reaches organisations with limited existing protections, and how controls are applied after the initial assessment.

The First Step Fund is available through IASME on a first-come, first-served basis, while suppliers eligible for the separate grant will be contacted through participating Cyber Resilience Pledge organisations. Both routes reduce barriers to certification, but the technical standard and responsibility for maintaining security remain unchanged.