UK small firms considering Cyber Essentials have a new reason to check the cost of certification. A government-backed discount launched on 3 November offers a lower assessment price for eligible businesses, while a separate supply-chain scheme provides another route for nominated suppliers.
The useful next step is to establish which route fits your business before buying an assessment or setting an internal completion date. Eligibility, available funding and the work needed to prepare should all be checked together.
What has been announced?
The government announcement introduces the Cyber Essentials First Step Fund: a 75% certification discount for eligible UK micro, small and medium-sized businesses that have not been certified in the previous four years. The £2.4 million fund is first come, first served, available until March 2027 or until funding runs out.
A separate Cyber Essentials for suppliers grant offers eligible UK SME suppliers of Cyber Resilience Pledge signatories fully funded first-time certification and tailored Cyber Advisor support. Nominated businesses will be contacted by their signatory customer and guided through applying. This is a separate referral route, rather than a promise of free certification for every supplier.
For context, our earlier coverage of the Cyber Resilience Pledge explained the direction of travel for supplier expectations. Today’s development is the practical funding offer, rather than another general warning about cyber threats.
Check the application details
The live IASME First Step application page lists discounted assessment prices of £80 plus VAT for organisations with 0–9 employees, £110 plus VAT for 10–49, and £125 plus VAT for 50–249.
IASME says applicants must register and purchase by 31 March 2027. After purchase, they have six months to complete and submit the assessment. Treat that purchase deadline alongside the government’s warning that the funding may run out sooner.
The page says organisations must be UK-registered and must not have held Cyber Essentials within the last four years. Eligibility is checked during registration using organisation details and certification history. It also states that applicants must be within the £315,000 Minimal Financial Assistance limit, including this discount, and links to the government’s subsidy guidance.
Before registering, ask the person responsible for business records to check those details and any relevant assistance records. An advertised price is a useful starting point for budgeting; the eligibility check still needs to be completed for your organisation.
Budget for the preparation as well
The assessment fee is only one part of a sensible project plan. Ask your IT provider what information they will need, who will answer the questionnaire and whether any remedial work needs a separate quote. That conversation should happen before a busy trading period turns a manageable task into a rushed purchase.
IASME describes Cyber Essentials as annually renewable and based on a verified self-assessment questionnaire, which can be downloaded free from its website. Use that opportunity to understand the questions before committing staff time. Keep a short list of unclear answers and agree who will resolve each one.
Our small-business resilience checklist provides complementary continuity questions. Certification preparation and a usable disruption plan deserve space in the same management discussion, even when different people own the work.
A practical decision this week
Give one person responsibility for checking the offer, confirming the right application route and bringing back a realistic timetable. Suppliers should ask their customer contact whether a nomination is being considered, rather than assuming a commercial relationship automatically secures support.
Keep the eligibility decision, assessment purchase and any extra IT work visible as separate budget items. The immediate opportunity is a cheaper route into certification for qualifying firms. The lasting value will depend on understanding the assessment, making the necessary improvements and keeping responsibility clear after the certificate arrives.
