Cyber Essentials funding gives eligible UK businesses 75% off the cost of assessment and certification. Through the First Step Fund, your fee falls to between £80 and £125 plus VAT, depending on your organisation’s size.

Make sure before you apply, to check three things:

1. Whether your business qualifies for the funding.
2. Whether you need to update software, replace unsupported devices or change account permissions to meet Cyber Essentials requirements.
3. How much you’ll pay for technical support, software or replacement equipment alongside the discounted assessment fee.

Who qualifies for Cyber Essentials funding?

The First Step Fund supports UK micro, small and medium-sized businesses with no Cyber Essentials certification during the previous four years.

The government has allocated £2.4 million to support around 6,000 businesses. Funding operates on a first-come, first-served basis until the end of March 2027, or until funds run out.

Check your eligibility through IASME before committing to a certification package. 

To qualify, your organisation must meet all four eligibility requirements:

• Be registered in the UK: Your business must be officially registered in the United Kingdom.
• Have fewer than 250 employees: The scheme is available to micro, small and medium-sized organisations.
• Not have held Cyber Essentials certification in the past four years: Businesses applying for the first time, or those whose certification expired more than four years ago, may qualify.
• Meet the government subsidy limit: Your organisation must not exceed the £315,000 Minimal Financial Assistance allowance under the Subsidy Control Act 2022, including the value of this discount.

The most important requirement is your certification history. If your business has held Cyber Essentials certification within the last four years, you cannot use the fund to reduce your renewal costs. You will need to pay the standard certification fee.

The scheme is also unavailable to larger organisations with 250 or more employees.

How to apply through IASME

Apply for the Cyber Essentials First Step Fund through IASME. Follow the application process to confirm your eligibility and discounted fee.

Apply through IASME.

How much will you pay?

The discounted assessment and certification fee ranges from £80 to £125 plus VAT.

For a micro business with fewer than 10 employees, the standard £320 fee falls to £80 plus VAT. A saving of £240 before VAT. Your organisation’s size determines your final fee. Any business with more than 250 employees will not be classified as eligible.

What does the 75% discount cover?

The Cyber Essentials First Step Fund gives eligible businesses a 75% discount on the cost of getting Cyber Essentials certified.

The discounted fee covers:

• The online assessment: You answer questions about how your business protects its computers, systems and data.
• A review of your answers: A qualified assessor checks whether your business meets the Cyber Essentials security requirements.
• Your certification: If you pass the assessment, you receive an official Cyber Essentials certificate, valid for 12 months.

What Isn’t Covered?

The discount only covers the assessment and certification, not the cost of improving your IT security (only we do that).

For example, if your business needs to update old software, improve password security or replace outdated computers to meet the requirements, you will need to pay for these changes separately.

The discount also does not cover additional IT support, Cyber Essentials Plus certification or future renewals.

Before applying, it’s worth checking whether your business already meets the Cyber Essentials requirements. This can help you identify any changes you need to make and avoid unexpected costs.

Which costs should you budget for separately?

A discounted assessment does not remove the cost of fixing security gaps.

Your business might need newer software, replacement devices or changes to account permissions. You might also need paid support to review your systems and prepare your assessment answers.

Before purchasing support, ask your provider or us to explain the work required, the price and who will complete each task. Confirm whether the quote includes help with assessment queries.

Cyber Essentials requires annual renewal. Include future certification fees in your security budget. 

What does Cyber Essentials check?

Cyber Essentials covers five technical controls designed to protect your organisation against common cyber threats. 

Firewalls – Check how your business controls connections between your devices, networks and the internet.

Secure configuration – Review device and software settings. Remove unnecessary accounts and services.

Security update management – Check whether your devices and software receive security updates. Identify unsupported systems requiring replacement.

User access control – Review who has access to your systems. Remove unused accounts and restrict administrator permissions.

Malware protection – Check how your devices prevent harmful software from running.

How should you prepare before applying?

Start with a list of your business devices, software and cloud services. Include equipment used by remote staff.

Next, review the Cyber Essentials self-assessment questions. IASME provides these free of charge, so you have an opportunity to understand the requirements before paying. 

Assign responsibility for each security gap. Agree a deadline and confirm the work is complete before submitting your answers.

This gives you a clearer budget and reduces avoidable delays during assessment.

Does the fund include Cyber Essentials Plus?

The published First Step Fund covers Cyber Essentials assessment and certification.

Cyber Essentials Plus adds a technical audit. If a customer or contract requires Plus, request a separate quote and confirm the certification level you need before purchasing. 

Get your business ready with Support Stack

A lower certification fee helps. Knowing which changes your business needs helps you plan the full cost.

If you think your IT provider is useless (which a lot of them are) Support Stack offers Cyber Essentials preparation support. Contact our team to discuss your current systems, the requirements and the work needed before assessment. 

Tell us your employee count, your previous certification history and any customer deadlines. Ask for a clear scope and an itemised quote.

Get ready to apply with a clear understanding of your costs. Apply here.