Cyber Essentials funding 2026: the 75% First Step Fund and the free supplier grant
The UK government’s new Cyber Essentials funding package cuts the cost of a first Cyber Essentials certificate by 75% for eligible small and medium-sized businesses. Basic certification now costs £80 to £125 + VAT. A separate grant makes certification free for SME suppliers nominated by organisations that have signed the Cyber Resilience Pledge. The discount is first come, first served, and runs until the end of March 2027 or until the £2.4m fund runs out.
Cyber Security Minister Liz Lloyd announced the package at the NCSC Annual Review on 3 November 2026. IASME, the NCSC’s Cyber Essentials delivery partner, runs both schemes. Here is what each one offers, who qualifies, and how to use it.
The two schemes at a glance
| Cyber Essentials First Step Fund | Cyber Resilience Pledge supplier grant | |
|---|---|---|
| What you get | 75% off a new Cyber Essentials certificate | Fully funded first-time Cyber Essentials, plus support from an NCSC-assured Cyber Advisor |
| Who it’s for | UK micro, small and medium-sized businesses that haven’t held Cyber Essentials in the last four years | UK SME suppliers nominated by a Cyber Resilience Pledge signatory |
| How you get it | Apply through IASME’s First Step page | You can’t apply yourself. Your customer nominates you |
| Funding | £2.4m, about 6,000 businesses | Up to £7m, about 8,000 businesses |
| Closes | End of March 2027, or earlier if the money runs out | End of March 2029 |
The First Step Fund: 75% off your first certificate
This is the one most small businesses can use now. It went live on 3 November 2026.
The discount comes off IASME’s standard fee, which is set by organisation size and is the same at every certification body:
| Organisation size | Standard fee | With First Step Fund |
|---|---|---|
| Micro (0–9 staff) | £320 + VAT | £80 + VAT |
| Small (10–49 staff) | £440 + VAT | £110 + VAT |
| Medium (50–249 staff) | £500 + VAT | £125 + VAT |
Who qualifies. UK micro, small and medium-sized businesses applying for a new certificate that haven’t held Cyber Essentials at any point in the last four years. If you certified in 2023 and let it lapse, you are probably not eligible. If your certificate expired before late 2022, you may be. Organisations with 250 or more staff are outside the SME definition and can’t use it.
What it covers. The assessment of your self-assessment and, if you pass, the certificate. The funding doesn’t guarantee a pass. You still have to meet all five controls. The government’s material refers to a Cyber Essentials certificate throughout, so treat the discount as covering the basic level, not Cyber Essentials Plus.
The catch is the deadline, and it isn’t a date. Places are allocated in the order applications arrive. £2.4m at £80 to £125 a certificate runs out quickly once IT providers and trade bodies start telling their members. The government’s own estimate is about 6,000 businesses. “End of March 2027” is the latest the fund can close, and it may close much sooner.
The Cyber Resilience Pledge grant: free, but only if you’re nominated
The Cyber Resilience Pledge is a voluntary commitment by larger organisations. Signatories accept board-level responsibility for cyber risk, sign up to the NCSC’s Early Warning service, and require Cyber Essentials across their supply chains. More than 230 organisations had signed by November 2026.
The supplier grant exists to help those signatories bring their smaller suppliers up to standard. It pays for first-time certification in full and adds tailored support from an NCSC-assured Cyber Advisor.
You can’t apply for it directly. Signatories pick the suppliers they want to fund, register their interest with IASME, and then contact those suppliers. If a large customer has asked you for Cyber Essentials recently, ask them whether they have signed the Pledge and whether they plan to nominate you. If they haven’t signed, the First Step Fund is your route.
What Cyber Essentials gets you beyond the certificate
The scheme checks five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Together they protect against the most common internet-based attacks. These are untargeted, automated attacks that look for unpatched software, default passwords and accounts without multi-factor authentication. Since the April 2026 update, MFA is mandatory on every cloud service in scope (what changed in 2026).
There are two other practical benefits.
Public sector contracts. Under PPN 014, central government departments, their agencies, non-departmental public bodies and NHS bodies are expected to consider Cyber Essentials or Cyber Essentials Plus when they buy goods and services, particularly where a contract involves personal data or ICT. The buyer decides contract by contract, so it isn’t a blanket rule. But a supplier without a certificate can be ruled out before the bid is scored, and the certificate has to be renewed every year for the life of the contract.
Insurance. If you’re UK-domiciled, turn over less than £20m and certify your whole organisation, IASME includes £25,000 of cyber liability insurance with the certificate at no extra cost.
How to claim the discount
- Check you’re eligible. Make sure you’re a UK SME with fewer than 250 staff and no Cyber Essentials certificate in the last four years.
- Apply through IASME’s First Step Fund page at firststep.iasme.co.uk before the funding runs out.
- Get your answers right before you submit. A failed assessment uses up your time, not the discount. The common failures are MFA missing on a cloud service, patches older than 14 days, and devices or cloud accounts left out of scope.
- Complete the assessment with a certification body. GOV.UK confirms the discount still applies when you certify through a certification body.
If you’re unsure about any of the 2026 questions, it’s worth a short call with an assessor before you submit. Many failures come down to how a question is read, not how the systems are set up.
Frequently asked questions
Is Cyber Essentials free for small businesses in 2026? Only for SME suppliers nominated by a Cyber Resilience Pledge signatory. Every other eligible SME gets 75% off through the First Step Fund, which brings the fee down to £80 to £125 + VAT.
How much does Cyber Essentials cost with the First Step Fund? £80 + VAT for micro organisations (0–9 staff), £110 + VAT for small (10–49) and £125 + VAT for medium (50–249).
When does the Cyber Essentials First Step Fund close? At the end of March 2027, or earlier if the £2.4m runs out. Funding is allocated first come, first served.
Can I use the First Step Fund to renew my certificate? No. It’s for organisations that haven’t held Cyber Essentials in the last four years.
Does the funding cover Cyber Essentials Plus? The government describes it as a discount on a Cyber Essentials certificate, the basic level. Plus is quoted separately. See what Cyber Essentials Plus costs.
How do I get the Cyber Resilience Pledge grant? Your customer has to nominate you. Only Pledge signatories can put suppliers forward, and they contact the suppliers they have chosen.
Sources
- GOV.UK, Cyber Essentials funding package (3 November 2026): both schemes, the 75% discount on a new certificate, closing dates, what the funding covers, and how to apply.
- GOV.UK, New Government-backed cyber security protections could save UK businesses thousands (3 November 2026): funding totals, the four-year rule, discounted fees, estimated take-up and the Cyber Resilience Pledge.
- GOV.UK, PPN 014: Cyber Essentials scheme (February 2025): which public bodies it covers and how buyers apply it.
- IASME, Cyber Essentials FAQ: standard fees by organisation size.
- IASME, Cyber Liability Insurance: eligibility and the £25,000 limit.