There’s good news for smaller organisations looking to strengthen their cyber security. The UK Government has launched the Cyber Essentials First Step Fund, offering eligible micro, small and medium-sized organisations a 75% discount on their first Cyber Essentials certification.
For eligible organisations, this reduces the cost of certification to between £80 and £125 plus VAT, making it more affordable to put essential cyber security controls in place.
Cyber Essentials First Step Fund at a glance
- Discount: 75% off your first Cyber Essentials certification
- Cost: £80 to £125 plus VAT for eligible organisations
- Who it’s for: Eligible micro, small and medium-sized organisations with fewer than 250 employees
- Available until: 31 March 2027 or until funding runs out
- How to apply: Reach out to one of our specialists and we'll talk you through it
What is Cyber Essentials?
Cyber Essentials is a Government-backed scheme designed to help you protect your organisation against some of the most common cyber threats.
It focuses on five fundamental technical controls:
- Firewalls
- Secure configuration
- Security update management
- User access control
- Malware protection
Putting these controls in place can help you reduce common vulnerabilities and demonstrate to customers, partners and suppliers that you take cyber security seriously.
If you’re new to the scheme, our guide to what Cyber Essentials is and how certification works explains the difference between Cyber Essentials and Cyber Essentials Plus, the benefits of certification and how to get started.
Who can get the 75% discount?
The Cyber Essentials First Step Fund is available to eligible micro, small and medium-sized organisations with fewer than 250 employees seeking their first Cyber Essentials certificate. The Government’s announcement says this includes organisations that haven’t been certified in the last four years.
Funding covers 75% of the cost of the Cyber Essentials assessment and, where the assessment is passed, certification. Receiving funding doesn’t guarantee that your organisation will achieve certification.
Eligibility and applications are managed through IASME, the Government’s delivery partner for the Cyber Essentials scheme. You can also receive the discount when you certify through an approved Certification Body, such as Wavenet.
The funding is time-limited: you must register and purchase your Cyber Essentials assessment by 31 March 2027. Once purchased, you’ll have six months to complete and submit your assessment.
The pricing depends on your organisation size, which you confirm when you apply.
If you supply an organisation that has signed the Government’s Cyber Resilience Pledge, you may be able to get Cyber Essentials certification free of charge through the separate Cyber Essentials for Suppliers Grant. Pledge signatories nominate eligible suppliers directly.
Cyber Essentials is a strong starting point
Getting certified is an important step, but lasting cyber resilience goes further. Your IT environment keeps changing. New devices are introduced, employees join and leave, software is updated and vulnerabilities emerge. That means your security needs to keep evolving too.
Cyber Essentials gives you a strong baseline. From there, you can build additional layers of protection based on the risks facing your organisation.
Organisations looking for greater technical assurance can also consider Cyber Essentials Plus. It covers the same five controls but adds an independent technical assessment to verify that they’re working effectively. You can learn more about the benefits of Cyber Essentials Plus and how it differs from the standard certification.
Build on your Cyber Essentials foundations
We’re an IASME-accredited Cyber Essentials Certification Body. Our CyberGuard team can support you through Cyber Essentials and Cyber Essentials Plus certification, from understanding the requirements and preparing for assessment to completing the certification process.
We can also help you build on your Cyber Essentials foundations with wider cyber security services.
- Vulnerability management can help you continually identify and prioritise weaknesses across your environment.
- Penetration testing can test your defences and identify vulnerabilities that could be exploited.
- Managed detection and response can help identify and respond to suspicious activity.
- SIEM and security monitoring can provide greater visibility across your environment.
- Incident response can help you prepare for and respond effectively if an incident occurs.
It means moving beyond achieving certification towards continually understanding and reducing your cyber risk.
Why work with Wavenet?
Working with an experienced Certification Body can make it easier to understand the Cyber Essentials requirements, define the right scope and identify areas that need attention before submission.
Our Cyber Essentials support can include:
- Help defining the scope of your assessment
- Guidance through the self-assessment questionnaire
- Gap analysis and prioritised remediation guidance
- Review and verification of your responses
- Support preparing for Cyber Essentials Plus technical assessment
- Wider cyber security support after certification
Read more about why organisations choose Wavenet for Cyber Essentials and how our workshops can help you prepare for assessment.
Ready to take the first step?
With the Government covering 75% of Cyber Essentials certification costs for eligible SMEs, now could be a good time to put certification on your agenda.
Whether you want to understand your readiness for assessment, need support through certification or want to build on your Cyber Essentials foundations, our CyberGuard team can help.
The First Step Fund is available until 31 March 2027 or until funding runs out, so it’s worth checking your eligibility early.
Talk to our CyberGuard team to check your eligibility and get started.
Frequently asked questions
How much does Cyber Essentials cost with the discount?
Eligible SMEs can receive a 75% discount, reducing the cost of certification to between £80 and £125 plus VAT, depending on organisation size.
Is the discount available for Cyber Essentials Plus?
The published First Step Fund guidance refers to Cyber Essentials assessment and certification. It doesn’t currently state that Cyber Essentials Plus assessments, consultancy or remediation work are covered.
Does receiving the funding guarantee certification?
No. The funding covers the discounted assessment and, where the assessment is passed, certification. Your organisation will still need to meet the Cyber Essentials requirements.
Can Wavenet certify my organisation?
Yes. Wavenet is an IASME-accredited Cyber Essentials Certification Body and can support organisations through Cyber Essentials certification and Cyber Essentials Plus technical assessment.
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Cyber Essentials is based on a self-assessment questionnaire reviewed by a Certification Body. Cyber Essentials Plus adds independent technical testing to verify that the required controls have been implemented effectively.
When does the First Step Fund close?
The fund is scheduled to run until 31 March 2027 or until the available funding runs out.
