The UK government will now pay 75% of the cost of a new Cyber Essentials certificate. The scheme is called the Cyber Essentials First Step Fund, it went live on 3 November 2026, and the money is limited.
Here's who qualifies, what you'll pay, how to apply, and what to sort out before you do.
What is the Cyber Essentials First Step Fund?
It's a government-backed discount on the assessment fee for a new Cyber Essentials certificate.
£2.4 million has been set aside, and the government expects it to reach around 6,000 businesses.
Cyber Essentials is the NCSC-backed certification that proves the basics of cyber security are in place.
If you're not sure what it involves, we've covered it in what Cyber Essentials is and whether your business needs it.
How much will it cost?
The government says eligible businesses could pay as little as £80 and no more than £125, plus VAT, depending on the size of the business.
| Business size | Employees | Normal fee | First Step Fund price |
|---|---|---|---|
| Micro | 0–9 | £320 + VAT | £80 + VAT |
| Small | 10–49 | £440 + VAT | £110 + VAT |
| Medium | 50–249 | £500 + VAT | £125 + VAT |
Source: IASME, Cyber Essentials First Step Fund. Prices checked 5 November 2026.
For a small business that's been putting certification off because of cost, the price barrier has pretty much gone.
Who is eligible?
The fund is for UK micro, small and medium-sized businesses that haven't held a Cyber Essentials certificate in the last four years.
So it's aimed at first-timers and anyone whose certification lapsed a good while ago. If you're already certified and renewing, this isn't aimed at you.
How do you apply?
Through IASME, the organisation that runs Cyber Essentials for the government, at firststep.iasme.co.uk.
The discount still applies if you choose to certify through a Certification Body rather than directly.
What's the catch?
There are a few things worth knowing before you rush in.
It's first come, first served. The fund closes at the end of March 2027, or sooner if the money runs out. With a limited pot, waiting until the new year is a gamble.
It covers the assessment, not a guaranteed pass. The funding pays for the assessment and, if you pass, the certification. If your setup isn't up to scratch, you can still fail.
VAT is on top.
You still have to do the work. The discount cuts the fee. It doesn't configure your firewalls, patch your devices or sort out who has admin rights.
That last point is where most businesses get caught.
What does passing actually involve?
Cyber Essentials checks five areas: firewalls, secure configuration, user access control, malware protection and security update management.
You answer a self-assessment questionnaire about how your business handles each, and an assessor marks it.
The questionnaire itself is straightforward. The hard part is the honest answers.
Are all devices patched?
Does everyone have only the access they need?
Is multi-factor authentication switched on everywhere it should be?
A cheap assessment fee doesn't help much if you fail on something you could have fixed in an afternoon.
Our advice: before you apply, check your setup against the five areas. Fix what's wrong, then submit.
It's far less stressful than discovering the gaps halfway through the questionnaire.
What else do you get from certifying?
Quite a lot, which is why the discount is worth taking seriously:
Contracts. Many public sector and larger commercial contracts ask for Cyber Essentials, and a growing number of customers ask suppliers for it.
Insurance. Businesses with Cyber Essentials and turnover under £20m also get up to £25,000 of cyber liability insurance, according to the government.
Proof. It's an independently assessed answer when a customer asks, "How secure are you?"
There's a separate scheme for suppliers
If you supply a larger organisation, check whether they've signed the government's Cyber Resilience Pledge. Over 230 organisations have. Signatories can nominate SME suppliers for fully funded certification, and some suppliers also get support from an NCSC-assured Cyber Advisor. That grant runs until March 2029.
You can't apply for it directly, because the signatory contacts you. But if a customer has mentioned supply chain security lately, ask them.
How RefynIT can help
We're Cyber Essentials certified ourselves, and we know what the assessment looks for. e
Our Compliance Manager service keeps your devices checked against the Cyber Essentials requirements all year round, collects the evidence as it goes, and gives the right people in your business access to answer the questions that apply to them.
If you're thinking about applying for the First Step Fund, we can check where you stand first, so you're not paying to find out the hard way.
Get in touch and we'll talk through where you stand before you apply.
