Cyber Essentials funding: could your business qualify for 75% off or fully funded support?

What has changed?

On 3 November 2026, the UK government launched a new Cyber Essentials funding package to help smaller businesses adopt baseline cyber security controls. There are two separate offers, and the route you can use depends on your circumstances.

The first is a broad discount for eligible SMEs seeking a new Cyber Essentials certificate. The second is a fully funded option for selected businesses supplying organisations that have signed the government's Cyber Resilience Pledge.

Both routes fund the assessment and certification if you pass. Neither guarantees a certificate, and neither should be confused with funding for every remedial security change your business may need.

Who qualifies for the 75% discount?

The First Step Fund is intended for UK micro, small and medium-sized organisations seeking a new Cyber Essentials certificate. Before applying, check these four points:

IASME administers the scheme and confirms eligibility. You can use the discount through an authorised Certification Body if you prefer. The published discounted assessment cost is between £80 and £125 plus VAT, depending on organisation size.

What if one of your customers has signed the Cyber Resilience Pledge?

The separate Cyber Essentials for Suppliers Grant is designed for selected SMEs in the supply chains of organisations that have signed the government's Cyber Resilience Pledge.

If your customer participates, it may identify and nominate your business for a fully funded Cyber Essentials assessment and tailored Cyber Advisor support. This is not an open application route for any supplier. Your Pledge-signatory customer must nominate you and guide you through the process.

The government says the scheme will operate until the end of March 2029. If you're unsure whether your customer participates, ask your contact or check the government's Cyber Resilience Pledge guidance.

Why this matters if you want public-sector contracts

Missing or expired Cyber Essentials certification is a recurring gap we identify when assessing Crown Partners clients. In many public-sector technology and digital procurements, buyers require Cyber Essentials or equivalent security controls as a condition of a contract. It is not mandatory for every framework or tender. Requirements depend on the buyer and the information-security risks. Discovering that gap late can put an otherwise competitive bid or contract award at risk.

That makes this funding an excellent opportunity for eligible SMEs to remove a common barrier at a reduced cost. But Cyber Essentials is only one piece of public-sector readiness. Buyers may also assess insurance, financial standing, policies, accreditations, carbon reduction, social value, technical experience and the evidence that proves a supplier can deliver.

What should your business do now?

1. Check the correct funding route. Use IASME for the First Step Fund. For the supplier grant, speak to the Cyber Resilience Pledge customer that may nominate you.
2. Assess your current security position. Identify obvious shortcomings across the five technical controls before buying the assessment.
3. Fix what is necessary. The discount reduces the certification cost; you still need the right controls in place.
4. Think beyond the certificate. Make sure your wider policies, supplier evidence and public-sector readiness support the opportunities you want to pursue.