On 3 November 2026 the government announced the Cyber Essentials First Step Fund, a 75% discount on Cyber Essentials certification for micro, small and medium-sized businesses. With the discount, the government says businesses could pay as little as £80 and no more than £125 (plus VAT).
The fund is £2.4 million, which the government expects to cover around 6,000 businesses. It runs until March 2027 or until the money runs out, and it is first come, first served. If you have been meaning to get certified, now is the time.
What is Cyber Essentials?
Cyber Essentials is the government-backed certificate that shows your business has the basic protections in place against the most common cyber attacks. The government describes it as the minimum standard of cyber security it recommends.
It covers five areas:
- Firewalls: your internet connection and devices are protected from unwanted traffic
- Secure settings: default passwords are changed and unused software is removed
- User access: staff only have the access they need, and admin accounts are kept separate
- Malware protection: antivirus or equivalent protection on every device
- Updates: security updates are installed within 14 days of release
You answer an online questionnaire about how your IT is set up, and an assessor checks your answers. If you pass, you get a certificate that is valid for 12 months.
Why it’s worth having
- Contracts and tenders: many local authorities, public bodies and larger companies ask for Cyber Essentials before they will work with you. For children’s homes and care providers, it is increasingly asked for by commissioning local authorities.
- Free cyber insurance: organisations with Cyber Essentials and a turnover under £20 million can receive up to £25,000 of cyber liability insurance included with the certificate.
- It actually reduces risk: the government estimates a significant cyber attack costs a UK business around £195,000 on average. The five controls above stop the large majority of everyday attacks.
- Timing: the National Cyber Security Centre’s annual review, also published this week, warns of a real prospect of a sharp rise in cyber incidents in the coming months.
Who qualifies for the discount?
The discount is for micro, small and medium-sized businesses that are getting their first Cyber Essentials certificate. The government’s press release says it is for businesses that have not been certified in the last four years.
If you already hold Cyber Essentials, or have held it recently, you are unlikely to qualify for this fund. Renewals are still worth doing at the normal price.
There is also a separate, fully funded offer for small suppliers to large organisations that have signed the government’s Cyber Resilience Pledge. You cannot apply for that one yourself: the large organisation you supply will contact you if you have been nominated.
How to apply
Applications go through IASME, the body that runs Cyber Essentials for the National Cyber Security Centre, at firststep.iasme.co.uk.
Before you pay, we strongly recommend checking that your IT will actually pass. The questionnaire asks detailed questions about every device, every user account and every piece of software that touches your business data, including staff phones and laptops used for work. The most common reasons businesses fail are:
- Computers or phones running out-of-date software (for example Windows 10 PCs that are no longer receiving updates)
- Staff using admin accounts for everyday work
- Multi-factor authentication not switched on for email and cloud services
- Old routers with default passwords or unsupported firmware
- Personal phones used for work email with no screen lock or updates
How QLine IT can help
QLine IT holds Cyber Essentials Plus, the higher level of the scheme with a full independent audit, so we have been through the process ourselves and know what the assessors look for.
For our managed IT clients, most of the five controls are already in place. We can:
- Check your devices, accounts and network against the Cyber Essentials requirements before you apply
- Fix anything that would cause you to fail
- Help you complete the questionnaire accurately
- Keep you compliant through the year so renewal is straightforward
The discount is limited and first come, first served. If you’d like us to check whether your business is ready, get in touch with our team and we’ll talk you through it.
Source: GOV.UK, “New government-backed cyber security protections could save UK businesses thousands”, 3 November 2026 and Cyber Essentials funding package.
