News
Cyber Essentials First Step Fund: 75% Off a First Certification for UK SMEs, From £80 Plus VAT
The UK government opened the Cyber Essentials First Step Fund on 3 November 2026, in a Department for Digital, Culture, Media and Sport press release published at 06:00 UTC [1]. Micro, small and medium UK businesses not certified in the last four years get 75% off a new Cyber Essentials certification, a first one or the first in four years: as little as £80 and no more than £125, plus VAT.
The one thing to know: £2.4m pays for it, enough for about 6,000 businesses by the government's estimate, first come first served, until March 2027 or until the money runs out [1]. The offer page the release links to sets the last day to buy as 31 March 2027, then gives six months to complete and submit the assessment [2].
What changed
- Price by size. Micro (0 to 9 employees) £80, small (10 to 49) £110, medium (50 to 249) £125, against list prices of £320, £440 and £500, all plus VAT [2].
- Who qualifies. A UK-registered micro or SME organisation that has not held Cyber Essentials in the last four years. IASME's Supplier Assurance Tool checks your details and certificate history when you register [2].
- Subsidy limit. You must stay within the £315,000 minimal financial assistance limit of the Subsidy Control Act 2022, this discount included [2]; it covers the elapsed part of this financial year and the two before it [5].
- Suppliers. A separate grant, up to £7m until March 2029, fully funds a first certification and Cyber Advisor support for SME suppliers that Cyber Resilience Pledge signatories nominate and contact [1]. The pledge list totals 235 signatories, including Microsoft UK, Sage, BT and Tesco [6].
- Insurance. Certified firms with turnover under £20m get up to £25,000 of cyber liability insurance [1].
- Software. 14 new Software Security Ambassadors will promote the voluntary Software Security Code of Practice [1][7].
Key dates
| When | What |
|---|---|
| 3 Nov 2026, 06:00 UTC | Release published; offer link active from 3 November [1] |
| 31 Mar 2027 | Last day to register and buy [2], or earlier if the £2.4m runs out [1] |
| Six months after you buy | Assessment must be completed and submitted [2] |
| A year after you certify | Renewal: the certificate is annually renewable [2]; renewal price not stated |
| March 2029 | The £7m supplier grant runs until then [1] |
| Not yet decided | When the £2.4m runs out |
What it means for your systems
The clock starts when you pay. Six months is enough only if you know what you run. Inventory first, then buy, and not in March: the money goes in order.
It covers your whole IT, not one app. The certification rests on a verified self-assessment questionnaire [2] across five areas: boundary firewalls and internet gateways, secure configuration, user access control, malware protection and patch management [4]. In a firm of 10 to 249 people, those areas point at:
- the office router, and any server or app you host yourself;
- default passwords, admin panels left open, accounts nobody uses;
- who is an administrator in Microsoft 365, the accounting package, cloud hosting and each automation tool;
- every laptop and phone used for work, and whether personal ones are among them;
- unsupported operating systems, and the server or script nobody updates.
Custom software is where answers get hard. A booking app on a rented server, a script holding an admin API key, an automation running on a full-access account: these rarely have an owner. Name one for each first.
What not to buy yet. The discount is on the certification, not on tools. Book the free 30-minute Cyber Advisor consultation listed on GOV.UK [3] before buying a security product.
What is not decided yet
Not stated in anything we read: how much of the £2.4m is left; whether Cyber Essentials Plus is covered; what a renewal costs; the insurance terms beyond "up to £25,000"; which suppliers the signatories will nominate, and when. ncsc.gov.uk was down when we tried, so its detailed requirements are not quoted.
Our take
Opinion. For a firm of 10 to 249 people the fee is not the real cost; the hours spent answering honestly about systems nobody owns are. If a large customer on the pledge list might nominate you, ask it first, since a nominated supplier's first certification is fully funded [1]. Otherwise buy early, once the inventory is done: a current certificate lets you bid for government contracts that handle financial or personal data [3], and it renews every year anyway.
Sources
All read on 3 November 2026; times are UTC.
- Department for Digital, Culture, Media and Sport, "New Government-backed cyber security protections could save UK businesses thousands", press release, published 3 November 2026 06:00 UTC: the 75% discount, eligibility, £80 and £125, £2.4m, first come first served, March 2027, about 6,000 businesses, the £7m supplier grant to March 2029, insurance, the 14 new ambassadors. https://www.gov.uk/government/news/new-government-backed-cyber-security-protections-could-save-uk-businesses-thousands (read 07:24 through the GOV.UK content API)
- IASME, Cyber Essentials First Step offer page (the link the release gives): prices for each size band, list prices, the eligibility list, the Supplier Assurance Tool check, the subsidy limit, the 31 March 2027 purchase deadline, six months to submit, annual renewal, the self-assessment questionnaire. https://firststep.iasme.co.uk/ (read 07:25)
- Department for Digital, Culture, Media and Sport and Department for Science, Innovation and Technology, "Cyber Essentials scheme: overview", updated 13 March 2026: government contracts, the free 30-minute Cyber Advisor consultation. https://www.gov.uk/government/publications/cyber-essentials-scheme-overview (read 07:24)
- Department for Science, Innovation and Technology and Home Office, "Cyber security breaches survey 2025", published 10 April 2025: the five areas Cyber Essentials covers. https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2025/cyber-security-breaches-survey-2025 (read 07:26)
- Department for Business, Innovation, Science and Trade, "Subsidy Control: a guide for beneficiaries", updated 4 August 2025, section 7: the £315,000 limit and its three-year period. https://www.gov.uk/government/publications/subsidy-control-a-guide-for-beneficiaries/subsidy-control-a-guide-for-beneficiaries (read 07:27)
- Department for Digital, Culture, Media and Sport and Department for Science, Innovation and Technology, "Cyber Resilience Pledge signatories", updated 29 October 2026: the total of 235 and the names cited. https://www.gov.uk/government/publications/cyber-resilience-pledge-list-of-signatories/cyber-resilience-pledge-signatories (read 07:24)
- Department for Digital, Culture, Media and Sport and Department for Science, Innovation and Technology, "Software Security Code of Practice", updated 15 January 2026: the code is voluntary. https://www.gov.uk/government/publications/software-security-code-of-practice (read 07:24)
Not used: ncsc.gov.uk answered "Site currently unavailable" at 07:24, so the NCSC's Cyber Essentials requirements were not read.
How we made this: drafted with AI tools from the primary sources listed above, then checked fact by fact against those sources by a second reviewer on 3 Nov 2026. Opinion is labelled "Our take". This is a source-based report, not a hands-on test.