Summary
- Eligible SMEs can receive a 75% discount towards Cyber Essentials certification.
- Selected suppliers can receive fully funded certification and Cyber Advisor support through the Cyber Resilience Pledge.
- The programmes operate under different eligibility rules and funding periods.
Thousands of smaller UK businesses are eligible for a 75% discount on Cyber Essentials certification under a new UK government programme intended to increase adoption of fundamental cybersecurity controls.
The support package, introduced on 3 November, also establishes a separate grant offering fully funded certification and specialist advice to selected suppliers of organisations participating in the Cyber Resilience Pledge.
The UK government’s funding programme combines two initiatives with different eligibility requirements and delivery arrangements.
The Cyber Essentials First Step Fund provides discounted certification to qualifying micro, small, and medium-sized businesses. The government says participants could pay between £80 and £125, excluding VAT, depending on their organisation’s size.
Funding is available to eligible businesses that have not held Cyber Essentials certification during the preceding four years, subject to the programme’s conditions and available resources.
Support for smaller businesses
Cyber Essentials is a government-backed certification scheme assessing whether organisations have implemented a defined set of technical security controls.
Its requirements address firewalls, secure configuration, software security updates, user access controls, and malware protection.
These measures are intended to reduce exposure to common online attacks, particularly those that exploit poorly configured systems, excessive permissions, or known software vulnerabilities.
Although certification provides a recognised baseline, it does not establish that an organisation is protected against every type of cyber intrusion.
Businesses must demonstrate that they meet the scheme’s requirements before receiving certification. A discount towards the assessment does not guarantee a successful outcome.
Organisations may need to address weaknesses identified during their preparations, including outdated software, insecure administrative arrangements, or devices that no longer receive security updates.
The First Step Fund has been allocated £2.4 million and is expected to support approximately 6,000 businesses, according to government estimates.
It is scheduled to operate until the end of March 2027 or until the available funding has been exhausted.
Extending protection through procurement
The second programme, the Cyber Resilience Pledge: Cyber Essentials for Suppliers Grant, provides additional support to selected businesses supplying participating organisations.
More than 230 organisations have joined the Cyber Resilience Pledge, which encourages greater attention to cybersecurity responsibility and supplier protection.
Participating organisations can identify eligible smaller suppliers for fully funded Cyber Essentials certification. The programme also provides tailored assistance from an NCSC-assured Cyber Advisor.
This support addresses some of the practical difficulties faced by smaller businesses that do not employ dedicated cybersecurity specialists.
A supplier may provide maintenance, software, data processing, or other services to a larger customer while maintaining a comparatively limited internal IT function.
If an attacker compromises the supplier’s systems, the effects can extend into shared information, connected services, or operational dependencies relied upon by its customers.
Certification provides a common technical baseline that procurement teams can recognise, although the security requirements of a particular contract may extend beyond those controls.
The supplier grant is worth up to £7 million and is expected to benefit approximately 8,000 organisations, according to the government’s estimates.
It is intended to run until March 2029, with access coordinated through participating pledge signatories and the programme delivery partner, IASME.
Certification and ongoing assurance
The two schemes offer different routes into the same certification framework. One reduces the direct cost for eligible smaller businesses, while the other combines funding with specialist assistance through supplier relationships.
The arrangements could encourage businesses that have postponed certification to assess their existing security controls and address weaknesses before applying.
Maintaining those protections will still require continuing attention to software updates, account management, and changes to the organisation’s technology environment.
The funding measures also sit alongside broader government and industry initiatives intended to improve software security and organisational resilience, although the certification schemes have their own eligibility and delivery rules.
Eligible businesses can access the First Step Fund through IASME and participating certification bodies. Suppliers nominated through the Cyber Resilience Pledge will receive separate instructions through their participating customer organisations.
