Cyber Essentials just got 75% cheaper. Here’s who qualifies.

The government has launched the Cyber Essentials First Step Fund, and it takes 75% off the cost of a Cyber Essentials assessment for UK micro, small and medium-sized organisations that haven't held the certificate in the last four years. It's run by IASME, the scheme's delivery partner, and it's open until 31 March 2027 or until the money runs out.

The funding package was published by the Department for Digital, Culture, Media and Sport on 3 November, the same day the NCSC published its Annual Review 2026. That report's message was that the old weak spots are being found faster than businesses fix them. This is the government putting money behind the fix: the five basic controls in Cyber Essentials.

What it costs now

The discount comes off the assessment fee, which is set by organisation size. These are IASME's figures:

Size	Usual fee	With the First Step Fund
Micro, 0 to 9 staff	£320 + VAT	£80 + VAT
Small, 10 to 49 staff	£440 + VAT	£110 + VAT
Medium, 50 to 249 staff	£500 + VAT	£125 + VAT

Organisations with 250 or more staff aren't covered. The government says the funding covers the cost of assessment and, if you pass, certification. It doesn't guarantee you'll pass.

Who qualifies

According to IASME, you may be eligible if:

• you're a micro, small or medium-sized organisation,
• your organisation is registered in the UK, and
• you haven't held Cyber Essentials in the last four years.

There's one more rule that's easy to miss. The discount counts as a subsidy, so your organisation must stay within the Minimal Financial Assistance limit of £315,000 under the Subsidy Control Act 2022, including this discount. Most businesses won't be anywhere near it, but if you've had other public grants recently, check.

How to claim it

1. Create an account on IASME's Supplier Assurance Tool at firststep.iasme.co.uk. It checks your organisation details and Cyber Essentials history as you register, so you'll know quickly if you qualify.
2. Buy the discounted assessment by 31 March 2027. The government says the discount still applies if you choose to certify through a certification body.
3. Submit within six months. Once you've bought the assessment, you have six months to complete and submit it.

That six-month window is the useful bit. You can lock in the discount now and spend the winter getting ready properly, rather than rushing a submission.

There's a second scheme for suppliers

The same package includes the Cyber Resilience Pledge grant. Big organisations that have signed the government's Cyber Resilience Pledge can nominate their SME suppliers for fully funded Cyber Essentials plus tailored support from an NCSC-assured Cyber Advisor. You can't apply for that one yourself. If a large customer has signed the pledge, it's worth asking them whether you're on their list. It runs until the end of March 2029.

What the discount doesn't cover

The fee was never the hard part. The work is getting every laptop, phone, router and cloud account up to the standard, then answering the questions honestly. Since April 2026, missing multi-factor authentication on a cloud service that offers it is an automatic fail, and critical updates have to go on within 14 days.

So the fund removes the excuse of cost, but you still need to be ready. That's also why it's called a first step. Cyber Essentials is the baseline, and it works best alongside the habits that keep it true all year, including making sure your team knows what to look out for.

The fund removes the excuse of cost. You still need to be ready, and you've got six months once you've bought it.

Ashley Adkins, fromIT

What to do this week

• Check your history. Has your organisation held Cyber Essentials since November 2022? If not, you're likely in.
• Count your people. Your size band sets the price. If you're close to a boundary, check before you buy.
• See how ready you are. The free Cyber Essentials readiness check takes a few minutes and shows which of the five controls need work.
• Don't wait for March. The fund closes when the money runs out, which could be well before the deadline.

If you'd like help, I've put together a First Step package that pairs the discounted fee with fromIT getting you ready, so you pass first time. To back the scheme, I'm taking 15% off my own fee too, so your first year starts at £585 all in. It also explains the eligibility rules in more detail.

Sources

• GOV.UK (DCMS): Cyber Essentials funding package, published 3 November 2026
• IASME: Cyber Essentials First Step Fund, eligibility and prices
• GOV.UK: Cyber Resilience Pledge
• NCSC: Cyber Essentials overview