Cyber Essentials From £80: The New 75% Discount Explained

If you’ve been meaning to get Cyber Essentials but kept putting it off, the government has just made it a lot cheaper. On 3 November 2026 it announced a 75% discount on the certificate for micro, small and medium-sized businesses. Eligible businesses could pay as little as £80, and no more than £125, plus VAT.

There’s a time limit, a catch on who qualifies, and one thing the discount doesn’t change: you still have to pass. Here is what you need to know.

What is Cyber Essentials?

Cyber Essentials is the UK government’s recommended minimum standard for cyber security. It was developed by the National Cyber Security Centre (NCSC) and is built around five basic controls that stop the most common attacks from the internet:

• a properly set up firewall, the barrier between your network and the internet
• secure settings on computers, phones and other devices
• keeping software and devices up to date
• controlling who has access to what
• protection against viruses and other harmful software

You answer a set of questions about how your business is set up, and an assessor checks your answers. The certificate lasts 12 months, so it needs renewing every year.

More and more customers, public sector contracts and insurers ask for it. If you’re new to the scheme, our Cyber Essentials certification guide explains the process in more detail.

What’s on offer

The government announced two schemes.

The Cyber Essentials First Step Fund. This is the one most small businesses will use. The government has put £2.4 million into it and estimates around 6,000 businesses could benefit. It pays 75% of the certification fee.

To put that in context, the usual fee from IASME, the organisation that runs Cyber Essentials certification, is £320 + VAT for a business with fewer than 10 staff and £500 + VAT for one with 50 to 249. Take 75% off those and you get the £80 to £125 range in the announcement.

A grant for suppliers to larger organisations. Over 230 organisations have signed the government’s Cyber Resilience Pledge, a promise to take cyber security seriously at board level and across their supply chains. These organisations can nominate small businesses that supply them for a fully funded first certificate, with a free cyber adviser for some. There’s up to £7 million for this, available until March 2029. You can’t apply for it yourself: the larger organisation contacts you.

Who qualifies for the First Step discount

• You must be a UK micro, small or medium-sized business.
• You must not have held Cyber Essentials in the last four years. This is for newcomers, so if you already renew every year, this offer isn’t for you.
• It’s first come, first served, and runs until March 2027 or until the money runs out, whichever comes first.

That last point matters. With funding for around 6,000 businesses across the whole UK, it would be sensible not to leave it until the spring.

How to apply

Applications opened on 3 November 2026. The government’s announcement points businesses to the IASME First Step website at firststep.iasme.co.uk, where you check your eligibility and start the process.

Once you start, IASME gives you six months to complete your assessment. So the best order is usually: get your IT ready first, then apply, then complete the questions while everything is fresh.

The fee was never the hard part

Even at full price, the fee for Cyber Essentials is small compared with most business costs. What stops businesses getting certified, or makes them fail, is the work needed to meet the controls.

That work got stricter this year. Since 27 April 2026, two things lead to an automatic fail:

• Two-step sign-in not switched on for cloud services. If an online service you use for work offers two-step sign-in (a code from your phone as well as your password), it must be turned on. That includes Microsoft 365, other cloud email, and any online software where you keep business information.
• Important updates not installed within 14 days. High-risk and critical security updates must be installed within 14 days of release. This covers Windows and Mac computers, the software on them, and the firmware (built-in software) on your router and firewall.

Other things that often trip small businesses up:

• old computers that can no longer receive security updates, such as machines still running Windows 10 without paid extended updates
• staff working as “administrators” on their everyday accounts, which lets harmful software do far more damage
• shared logins, or accounts for people who left months ago (our new starters and leavers checklist helps here)
• staff phones used for work email with no screen lock or updates
• not knowing exactly which devices and services you have

None of this is complicated, but it does take time to find and fix, especially if nobody in the business looks after IT day to day. The five Cyber Essentials controls article goes through each one in plain English.

Why it’s worth doing

The government estimates a significant cyber attack could cost a UK business or organisation an average of £195,000. It describes that figure as indicative, as it’s based mainly on US data, but even a fraction of it would hurt most small firms.

Cyber Essentials won’t stop every attack. What it does is close the common gaps that most attacks rely on: missed updates, stolen passwords and devices nobody is looking after. The NCSC’s Annual Review this week made the same point: most successful attacks still get in through familiar weaknesses.

There are practical benefits too:

• Insurance. According to the government, organisations with Cyber Essentials and a turnover under £20 million receive up to £25,000 of cyber liability insurance. Check the details when you certify and see how it fits with any policy you already have. Our guide to cyber insurance for small businesses explains what to look for.
• Winning work. Many public sector contracts, and a growing number of larger customers, ask suppliers for Cyber Essentials.
• Peace of mind. You’ll know your basics are covered, rather than hoping they are.

A simple plan

1. Check you qualify. No Cyber Essentials in the last four years, and a UK small or medium-sized business.
2. Find out where you stand. List your computers, phones, online services and who has access to what. Spot anything out of date or without two-step sign-in.
3. Fix the gaps. Switch on two-step sign-in everywhere it’s offered, set updates to install automatically, replace or remove unsupported devices and tidy up old accounts.
4. Apply while funding lasts. Start on the IASME First Step site and complete the questions within six months.
5. Keep it green all year. The 14-day update rule applies every day, not just on assessment day, so make sure someone is checking.

Need a hand?

My Tech Team is Cyber Essentials certified ourselves, so we know the questions and where businesses usually get stuck. Our free Get It Green IT audit takes about half a day and gives you a simple red, amber and green report, which is a quick way to see how close you are to passing before you spend a penny.

If you’re a business or charity in Sussex and want to make the most of the discount before it runs out, book a free call or IT audit and we’ll help you get ready. You can also read more about how we approach cyber security.