The government has announced a new funding package to help small and medium-sized businesses get Cyber Essentials certified, and for most SMEs it cuts the cost of certification by 75%.
Published on 3 November 2026, the package is designed to make the scheme more affordable and to encourage more organisations to put the basic security controls in place that stop the most common cyber attacks.
What is Cyber Essentials?
Cyber Essentials is a government-backed certification that shows your business has the fundamental protections in place against everyday online threats. It's suitable for organisations of every size and sector, and it's increasingly asked for by customers and in supply contracts.
To pass, your business needs five technical controls in place:
- Firewalls: a security filter between the internet and your network.
- Secure configuration: computers and devices set up securely, so there are fewer ways in for cyber criminals.
- Security update management: software kept up to date, so known weaknesses can't be used to get into your systems.
- User access control: control over who can access your data and services, and what they can do.
- Malware protection: viruses and other malicious software found and stopped before they cause harm.
What's in the funding package?
The package brings together two separate schemes, with different support and eligibility.
1. The Cyber Essentials First Step Fund
- Open to micro, small and medium-sized organisations across the economy.
- Gives a 75% discount on certification for SMEs getting a new Cyber Essentials certificate.
- Available through the IASME website, the government's delivery partner for Cyber Essentials. The discount still applies if you certify through a Certification Body.
- Runs until the end of March 2027, or until the funding runs out.
2. The Cyber Resilience Pledge: Cyber Essentials for Suppliers Grant
- Targeted at SME suppliers nominated by organisations that have signed the government's Cyber Resilience Pledge.
- Gives fully funded Cyber Essentials certification plus tailored support from an NCSC-assured Cyber Advisor.
- Pledge signatories identify and notify the suppliers who qualify.
- Runs until the end of March 2029.
In both cases, the funding covers the cost of the assessment and, if you pass, certification. It doesn't guarantee that you'll pass.
What should your business do?
If you've been thinking about Cyber Essentials, this is a good time to act. The First Step Fund has a fixed end date and could close sooner if the money runs out.
Before you apply, it's worth checking your systems against the five controls above. In our experience, the most common things to trip businesses up are:
- devices or software that are no longer getting security updates
- old user accounts that are still active, or staff with more access than they need
- routers and firewalls still on their default settings
- missing or out-of-date antivirus on some devices
Getting these right first gives you the best chance of passing at the first attempt and, more importantly, makes your business genuinely safer.
Get certified with Q6IT
Q6IT offers Cyber Essentials certification. We'll check your IT against the five controls, fix anything that would fail, and guide you through the assessment to your certificate, while helping you make the most of the new funding.
Find out more on our Cyber Essentials Certification page, or get in touch with Q6IT to get started.
Source: Department for Digital, Culture, Media & Sport, Cyber Essentials funding package, GOV.UK, published 3 November 2026.