Government Cuts Cyber Essentials Costs For Small Businesses
The UK government is funding a 75 per cent discount on Cyber Essentials assessments for eligible small businesses, with a separate scheme offering selected suppliers free certification and support to strengthen security across supply chains.
What Has Been Announced?
Announced on 3 November, the package provides up to £9.4 million through two schemes. The £2.4 million First Step Fund is expected to help around 6,000 organisations, while up to £7 million for Cyber Essentials for Suppliers could support another 8,000.
Both aim to encourage businesses to put basic technical protections in place before an attack disrupts their operations. The supplier scheme also recognises that a smaller company’s security problems can affect customers that depend on its services or give it access to their systems.
However, the government’s funding guidance makes it clear that paying for assessment doesn’t guarantee a successful result, stating, “Funding covers the cost of assessment and, where the assessment is passed, certification.” Businesses still have to meet the requirements.
Who Can Get The Discount?
The First Step Fund is open to eligible micro, small and medium-sized organisations registered in the UK that haven’t held Cyber Essentials certification during the previous four years. That includes some businesses returning to the scheme after a gap, as well as newcomers.
The discounted assessment costs £80 plus VAT for organisations with up to nine employees, £110 plus VAT for those with 10–49 employees and £125 plus VAT for those with 50–249 employees.
Applications go through IASME, the NCSC’s official Cyber Essentials delivery partner. Organisations must create an account on its Supplier Assurance Tool, which checks their details and certification history before they purchase the discounted assessment.
IASME also requires applicants to remain within the £315,000 Minimal Financial Assistance limit, including this discount. Businesses that have received other relevant public subsidies should therefore check their records when applying.
How Long Is The Offer Available?
The First Step Fund operates on a first-come-first-served basis until 31 March 2027, or until its funding runs out. IASME says organisations must register and purchase their assessment by that date, after which they have six months to complete and submit it.
That gives applicants time to prepare, but the assessment price isn’t necessarily the total cost. For example, businesses may need to replace unsupported software, change device settings or pay for technical help before they can meet the requirements.
Before paying for an assessment, businesses can download the questions for free to check what they may need to change. The NCSC also provides a free online readiness tool to help them prepare, and SMEs can book a free 30-minute consultation with an NCSC-approved Cyber Advisor.
How Does The Free Supplier Scheme Work?
The separate Cyber Essentials for Suppliers scheme runs until March 2029 and allows organisations that have signed the government’s Cyber Resilience Pledge to nominate eligible small suppliers for free assessment and certification. Tailored help from a Cyber Advisor is also available through the programme.
Suppliers selected for the offer will hear from their customer, who will explain how to apply. Supplying a large organisation does not automatically make a business eligible, because access depends on nomination through a participating customer.
This could be particularly useful for smaller suppliers that are asked to demonstrate their security but have little technical expertise of their own. By helping them pay for certification and understand the requirements, customers can support improvements that protect both businesses.
What Does Cyber Essentials Check?
Cyber Essentials checks five areas of basic security, covering firewalls, secure settings, software updates, access permissions and protection against malicious software. In practice, that means checking matters such as whether devices receive security fixes and whether staff have more access than they need.
For standard certification, the organisation completes a self-assessment questionnaire, has its answers signed off by a senior representative and submits it for an assessor to check. Cyber Essentials Plus covers the same requirements but also includes independent technical testing to establish whether the protections work in practice.
Certification needs to be renewed each year, but maintaining those protections is an ongoing job. For example, a new laptop needs secure settings before someone starts using it, and a departing employee’s access needs to be removed when they leave.
What Does This Mean For Your Business?
For eligible businesses, this discount makes it cheaper to assess their basic security and demonstrate that they meet the scheme’s requirements. Reviewing the questions with whoever manages IT should help establish what needs changing, how much work is involved and who will take responsibility for the application.
If certification is needed for a customer contract, businesses should check exactly what that customer expects before purchasing an assessment. It may require the whole organisation to be covered or specify Cyber Essentials Plus. Confirming this early can prevent a business from paying for an assessment that does not meet the contract’s terms.
The funding could help more small businesses address weaknesses they have previously lacked the time, money or expertise to tackle. Its success will depend on those improvements becoming part of everyday IT management, with updates installed, permissions reviewed and new equipment set up securely. That would give businesses lasting protection from the investment, as well as a certificate they can show their customers.
