The government has opened a £2.4m fund that cuts the price of a first Cyber Essentials certificate by 75% for UK micro, small and medium-sized firms. A separate grant of up to £7m will pay the full cost for small suppliers nominated by big companies that have signed the Cyber Resilience Pledge.
What happened
On 3 November 2026, speaking at the NCSC’s Annual Review event, Cyber Security Minister Baroness Lloyd of Effra announced two funding schemes for Cyber Essentials, the NCSC-backed baseline certification. The first, called the Cyber Essentials First Step Fund, opened the same day. It takes 75% off a new certification for micro, small and medium-sized UK businesses, so an eligible firm pays between £80 and £125 plus VAT, depending on its size.
There are limits. The fund holds £2.4m, allocated first come, first served. A business only qualifies if it has not held Cyber Essentials in the last four years. The offer runs until March 2027 or until the money is gone, whichever comes first. The government expects about 6,000 businesses to benefit. Applications go through a dedicated portal run by IASME, the scheme’s delivery partner.
The second scheme, the Cyber Essentials for Suppliers grant, is worth up to £7m and runs until March 2029. It pays the whole cost of a first certification for eligible UK-based SME suppliers of organisations that have signed the Cyber Resilience Pledge. Some of those suppliers will also get a cyber adviser to help them through the process. Small firms do not apply directly: nominated suppliers are contacted by their Pledge signatory. The government estimates that around 8,000 businesses could be covered.
The same announcement named 14 more organisations as Software Security Ambassadors, the second group to join. They include Fortinet, Thales, Capgemini, SANS and QinetiQ, and will promote the Software Security Code of Practice.
The detail
Cyber Essentials is built on five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. The basic certificate is a self-assessment, checked by a certification body. Cyber Essentials Plus adds a hands-on technical audit. The government’s announcement talks about a “new Cyber Essentials certification” and does not mention Plus, so the safe assumption is that the discount only covers the self-assessed level.
Dividing the published figures gives a rough sense of scale. The First Step Fund works out at about £400 of subsidy for each of the 6,000 expected firms. The supplier grant comes to roughly £875 per business across 8,000 firms, which is higher because it covers the full fee and some adviser time. These are averages, not published rates.
The Cyber Resilience Pledge is what links the two. It is voluntary and launched formally in July 2026. Organisations that sign it commit to three things:
- making cyber a board responsibility, by following the Cyber Governance Code of Practice and putting directors through NCSC governance training
- registering for the NCSC’s Early Warning service
- asking suppliers to hold Cyber Essentials where the risk justifies it, starting with a registration on the Supplier Check Tool and an audit of current coverage
More than 230 organisations have now signed. The new grant is a direct consequence of the third commitment: a signatory that asks its suppliers for Cyber Essentials now has public money to help them get it.
The announcement leads on a figure of £195,000 as the average cost of a significant cyber attack on a UK organisation. The government’s own footnote says that estimate rests mainly on US disclosure data, and that for medium and large firms it comes from a sample of just 18. Use it to open a board conversation, not in a risk model.
Why it matters for UK organisations
For small firms, the main obstacle to Cyber Essentials has rarely been the fee alone. It is the time needed to understand the questions, fix what the questions expose, and keep it fixed. Cutting the fee to as little as £80 removes one excuse, but it does nothing about the work. The adviser support in the supplier grant comes closer to the real problem, but it only reaches firms that a Pledge signatory decides to nominate.
For larger organisations, this changes the conversation about supply chains. Asking small, hard-to-replace suppliers for Cyber Essentials has always created friction. A signatory can now pair the requirement with funded certification, which makes it more likely suppliers will agree.
There is also a direct financial incentive. According to the government, certified organisations with turnover below £20m also receive cyber liability insurance cover of up to £25,000.
Expert view
I am broadly in favour of anything that gets more small firms through Cyber Essentials, because the five controls address a large share of the weaknesses we keep finding. In my experience of testing small and mid-sized estates, the problems are rarely sophisticated. They are unsupported systems nobody owns, admin accounts used for everyday work and patches never applied. Anthony Young, chief executive of Bridewell, said in comments reported by Infosecurity Magazine that “Cyber Essentials matters because so many attacks still exploit basic weaknesses”. I agree with him.
My concern is that a certificate only describes one point in time. A self-assessment completed in a hurry, to get the discount before the money runs out, may describe the network an owner believes they have, not the one they actually run. I would rather the next round of funding went towards hands-on adviser help than further fee cuts.
For buyers, a supplier’s certificate tells you they had a baseline at a particular date, not that they are secure. Check the expiry date, check that the scope covers the systems that touch your data, and treat certification as where due diligence begins, not where it ends.
What to do now
- Small firms without a certificate: check eligibility now, since places are first come, first served. Check the question set against your real estate first, including cloud services and home-working devices.
- Fix before you certify: the most common problems map directly onto the controls. Turn on automatic updates and remove unsupported software (security update management). Separate admin accounts from daily-use accounts and turn on multi-factor authentication for cloud services (user access control). Close any remote access ports you do not need (firewalls).
- Pledge signatories: use your Supplier Check Tool data to find SME suppliers that handle sensitive data or connect to your systems and are not yet certified, and nominate them for the funded grant first.
- Procurement and third-party risk teams: update supplier onboarding to record the Cyber Essentials certificate number, its expiry date and its scope, and set a reminder to re-check every year.
- Boards that have not signed the Pledge: look at the three commitments. The governance training and Early Warning registration cost little, and both are worth doing whether or not you sign.
Bottom line
The two schemes put public money directly into SME cyber hygiene and give larger buyers a practical lever over their supply chains. The amounts are modest and will run out, so eligible firms should move quickly. The value still depends on whether certification leads to lasting fixes, not just a certificate to file away.
Sources
- GOV.UK: New Government-backed cyber security protections could save UK businesses thousands
- GOV.UK: Cyber Resilience Pledge
- Infosecurity Magazine: NCSC Chief Warns of Imminent AI Ransomware Threat to UK Critical Infrastructure
- Entrepreneur UK: New Government-backed cyber security protections could save UK businesses thousands
- London Crime News: Government offers £2.4m cyber security discount to small firms
