Small firms can get 75% off Cyber Essentials certification until March 2027
The discount brings the cost down to between £80 and £125 plus VAT for businesses not certified in the past four years. Separate free certification is coming for suppliers to more than 230 organisations.
Micro, small and medium-sized businesses can now get 75% off the cost of a new Cyber Essentials certificate, meaning they would pay between £80 and £125 plus VAT. The offer, announced on Tuesday, applies to firms that have not been certified in the last four years and runs until March 2027 or until the money runs out.
Cyber Essentials is the government's recommended minimum standard of cyber security. The scheme was developed by the National Cyber Security Centre and checks five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. A growing number of organisations ask suppliers to hold it before they can bid for work.
How the discount works
The money comes from the Cyber Essentials First Step Fund, which has £2.4m of government funding and is allocated first come, first served. The government estimates that about 6,000 businesses that are new to the scheme could benefit. Applications go through the First Step site run by IASME, the NCSC's Cyber Essentials delivery partner, at firststep.iasme.co.uk.
Certified organisations with turnover under £20m also receive up to £25,000 of cyber liability insurance.
Free certification through supply chains
A second grant, worth up to £7m until March 2029, will pay in full for first-time certification for small and medium-sized suppliers of organisations that have signed the government's Cyber Resilience Pledge, with support from a Cyber Advisor for some of them. More than 230 organisations have signed so far. Businesses nominated for it will be contacted by the pledge signatory they supply and guided through the process. The government expects around 8,000 businesses could benefit.
Signing the pledge commits an organisation to treat cyber security as a board-level responsibility, sign up to the NCSC's Early Warning service and take a risk-based approach to requiring Cyber Essentials from its suppliers.
Software makers
The announcement, made at the NCSC's Annual Review, also added 14 organisations to the Software Security Ambassadors scheme, among them Fortinet, Thales, SANS, Zscaler, Investec and QinetiQ. Ambassadors work with the government to promote the Software Security Code of Practice, which sets out expectations for how secure and resilient software should be, across their own supply chains.
