Cyber Essentials from £80: how the government's 75 per cent discount for small firms works

The government has launched a 75 per cent discount on Cyber Essentials certification for micro, small and medium sized businesses. Cyber Security Minister Baroness Lloyd announced it in a speech at the National Cyber Security Centre's Annual Review on 3 November. GOV.UK says it means eligible businesses could pay as little as £80 and no more than £125, plus VAT, for certification.

Who can get it

The offer is called the Cyber Essentials First Step Fund. According to GOV.UK, it gives eligible micro, small and medium sized UK businesses a 75 per cent discount on the cost of a new Cyber Essentials certification, on a first come, first served basis, to businesses that have not been certified in the last four years. It is backed by £2.4 million of government funding and is available until March 2027, or until the money runs out. The government estimates about 6,000 new businesses could benefit. Applications go through firststep.iasme.co.uk, which GOV.UK says has been active since 3 November. The Register described the discount as being for businesses applying for their first certificate, while the notes to the GOV.UK announcement set the test as no certification in the last four years, so if your business held Cyber Essentials some time ago, check the criteria when you apply.

Free certification through larger customers

There is a second route for businesses that supply larger organisations. More than 230 organisations have signed the government's Cyber Resilience Pledge, and GOV.UK says they will be able to refer groups of small and medium sized suppliers for Cyber Essentials certification free of charge, with a free cyber security advisor for some businesses. This Cyber Essentials for suppliers grant is worth up to £7 million until March 2029, and the government estimates about 8,000 businesses could benefit. Suppliers do not apply for it directly: GOV.UK says nominated businesses will be contacted by the pledge signatory whose supply chain they are in.

What Cyber Essentials covers

The NCSC describes Cyber Essentials as the minimum standard of cyber security recommended by the government for UK organisations of all sizes. It is renewed each year and works as a self assessment questionnaire built around five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. GOV.UK adds that organisations with Cyber Essentials and a turnover below £20 million also receive up to £25,000 of cyber liability insurance. Take up is growing: the NCSC's Annual Review reports 47,661 Cyber Essentials certifications awarded between September 2025 and August 2026, up 19.6 per cent.

Why now

The government says recent estimates suggest a significant cyber attack on a UK business or organisation could cost £195,000 on average, though its own footnote says the estimate is based primarily on US disclosures. Speaking at the same event, NCSC chief executive Richard Horne said the foundations recognised through Cyber Essentials are the foundations of a resilient business for most organisations in an AI enabled world.