Cyber Essentials 75% Discount, Which Small Firms Qualify

A UK business that gets certified under Cyber Essentials could now pay as little as £80 plus VAT. The government has launched a 75% discount on the scheme for micro, small and medium sized firms, with the price capped at £125 plus VAT.

Cyber Security Minister Baroness Lloyd announced the offer on 3 November in a speech at the National Cyber Security Centre's Annual Review. It comes with a separate, fully funded route for smaller suppliers to big name companies, and a second cohort of firms promising to build safer software.

What the Cyber Essentials Discount Actually Offers

Cyber Essentials is the government's recommended minimum standard of cyber security for organisations of any size. It was developed by the National Cyber Security Centre (NCSC) and is built around five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. The aim is to stop the most common internet based attacks rather than the most sophisticated ones.

Under the new offer, the Cyber Essentials First Step Fund takes 75% off the cost of a new certificate. The government says that works out at no less than £80 and no more than £125, before VAT is added. The discount still applies if a business chooses to certify through a Certification Body rather than going direct.

There is a practical catch. According to the government's funding package paper, the money covers the cost of assessment and, where the assessment is passed, certification. It does not guarantee a business will pass.

Certification also carries an extra benefit for smaller firms. The government notes that organisations holding Cyber Essentials with a turnover below £20 million receive up to £25,000 of cyber liability insurance.

Who Qualifies and How to Apply

The First Step Fund is aimed at micro, small and medium sized businesses that have not held a Cyber Essentials certificate in the last four years. Ministers estimate about 6,000 new businesses could benefit. Because the pot is fixed at £2.4 million and awarded in the order applications arrive, the scheme could close before its March 2027 end date.

IASME, which the government describes as its delivery partner for Cyber Essentials, runs the process. The offer went live on 3 November through the First Step website.

Free Cyber Essentials for Suppliers of Big Brands, How the Grant Works

The second strand targets supply chains. The Cyber Essentials for Suppliers grant is worth up to £7 million and runs until March 2029. Eligible UK based small and medium sized suppliers of Cyber Resilience Pledge signatories can receive fully government funded first time certification. Some will also get tailored support from an NCSC assured Cyber Advisor.

Businesses cannot apply for this one directly. Pledge signatories nominate their own suppliers, who are then contacted and guided through the IASME process. The government estimates about 8,000 businesses could benefit. Signatories who want to register interest on behalf of their suppliers are asked to email IASME.

The Cyber Resilience Pledge is a voluntary government initiative. Organisations that sign commit to making cyber security a board level responsibility, to joining the NCSC Early Warning service and to taking a risk based approach to requiring Cyber Essentials across their supply chains. More than 230 have signed so far. The published list, last updated on 29 October 2026, includes household names such as Aviva, BT, Capita, Argos and Balfour Beatty, alongside many specialist security firms.

Ministers say the combined package is designed to strengthen the supply chains of some of Britain's biggest brands in food, banking and essential services, as well as helping small firms act on their own account.

Why Ministers Are Targeting Small Firm Cyber Security

The government's press release cites recent estimates that a significant cyber attack could cost a UK business or organisation about £195,000 on average. It adds a health warning. Because UK specific cost data is limited, the estimate draws mainly on United States disclosures, and for medium and large firms it rests on a sample of just 18, so it should be read as indicative only.

In her speech, Baroness Lloyd said small and medium sized businesses employ millions of people and should not be left vulnerable as cyber threats rise. She said the government is making it easier and cheaper to access expert help, find weaknesses in digital systems and get certified.

Today's measures follow a wider package set out in the Budget, which the government says is meant to help the UK defend itself as artificial intelligence changes both the cyber threat and the tools used against it. That package includes £70 million for a new National Exposure and Real Time Vulnerability Centre within the NCSC, and £60 million for a national Cyber Shield using agentic AI, including a £25 million Challenge Fund for UK AI and cyber security innovators. It also includes a new NCSC AI Cyber Security Centre of Excellence in Manchester, £40 million for a National Agentic Security Unit and £24 million to strengthen public sector cyber defences.

Who Are the Software Security Ambassadors? The Voluntary Code Explained

The third strand concerns the people who write the software businesses rely on. Fourteen organisations are joining as the second cohort of Software Security Ambassadors: Fortinet, Thales, Capgemini, SANS, Risk Ledger, Zscaler, Acubed IT Solutions, CloudPeek, Dot On, Hippo Digital, Investec, IoT M2M Council, Nine23 and QinetiQ. They join an existing group that includes Accenture, Cisco, Lloyds Banking Group, NCC Group, Palo Alto Networks, Sage and Santander.

Ambassadors work with government to champion secure software development and to encourage use of the Software Security Code of Practice across their own supply chains and networks. The code was created by the Department for Science, Innovation and Technology (DSIT) and the NCSC, and is co-sealed by the Canadian Centre for Cyber Security.

It is a voluntary code. The NCSC describes it as a systemic intervention designed to make organisations build security into software from the start, setting a baseline that signals to both vendors and customers which controls should be in place. Customers can use it to guide supplier negotiations. Nothing in the announcement makes compliance mandatory.

When Does the Cyber Essentials Discount Run Out?

For small businesses the immediate step is to check eligibility on the IASME First Step website, since awards are made in application order. Firms that supply a Pledge signatory may instead hear from their customer about the free route.

The government has not said how quickly it expects the £2.4 million to be used, so it is unclear how long the discount will remain open before March 2027. Its estimate of 6,000 beneficiaries gives a rough guide to the scale it has in mind.

The announcement leaves the Software Security Code of Practice voluntary, and the Pledge is also a voluntary commitment. What changes in practice is the price of the certificate and the number of large companies now asking their suppliers to hold one.