The UK Government is making Cyber Essentials certification more affordable for small businesses. Here's why the funding has been introduced, what certification involves and what to consider before applying.
The UK Government has announced a new funding initiative offering eligible small and medium-sized businesses a 75% discount on Cyber Essentials certification until March 2027. The initiative is designed to encourage businesses to strengthen their cyber security, reduce their exposure to common cyber threats and improve the resilience of the UK's wider business community. For eligible businesses, the discounted certification fee starts at £80 plus VAT. But while the funding provides an opportunity, it is important to note UK Cyber Essentials certification is not mandatory for every UK business, and obtaining certification may involve more than simply completing an online assessment.
For businesses operating remotely, using cloud-based services or relying on contractors who use their own devices, there are practical considerations worth understanding before committing.
There is also another development businesses cannot afford to overlook: the growing use of artificial intelligence in cyber attacks and everyday business operations.
Why is the UK Government offering this discount?
A successful attack can interrupt operations, expose customer information, create financial losses and damage relationships with customers and suppliers. In its announcement on 3 November 2026, the UK Government highlighted the potential financial impact of cyber incidents, citing an indicative average cost of £195,000 for a significant cyber attack on a UK business or organisation. This figure should not be interpreted as the typical cost for a small to medium size businesses, but it highlights the potential financial consequences of serious incidents.
The Government recognises that smaller to medium size organisations often lack the budgets, technical resources and dedicated IT teams or specialists available to larger businesses. By reducing the cost of Cyber Essentials certification, the Government aims to encourage more businesses to implement fundamental security controls.
There is also a wider economic reason. Businesses are increasingly connected through digital services, cloud platforms, AI, and supplier relationships. A cyber incident affecting one organisation can disrupt other businesses that depend on its services. Improving security across smaller and medium size organisations can therefore support the resilience of larger supply chains and the UK economy. The funding is part of a broader Government programme to increase the adoption of baseline cyber security measures.
What is Cyber Essentials?
Cyber Essentials is a UK Government-backed certification scheme developed by the National Cyber Security Centre (NCSC). It is designed to support organisations in protecting themselves against common internet-based cyber threats.
The scheme focuses on five technical controls:
Firewalls: Protecting devices and networks from unauthorised access.
Secure configuration: Ensuring computers, devices and software are configured securely.
Security update management: Keeping software and operating systems supported and updated.
User access control: Managing who can access business systems and information.
Malware protection: Protecting devices against malicious software.
There are two certification levels.
Cyber Essentials involves a verified self-assessment reviewed by an independent assessor.
Cyber Essentials Plus involves additional independent technical testing to confirm that the required controls are operating effectively.
The new Government discount applies to the standard Cyber Essentials assessment. Certification is renewed annually, so businesses must continue maintaining the required controls after obtaining their certificate.
What is included in the 75% discount?
The Cyber Essentials First Step Fund offers eligible UK micro, small and medium-sized businesses a 75% discount on certification.
To qualify, organisations must generally:
Be registered in the United Kingdom.
Meet the relevant micro, small or medium-sized organisation criteria.
Not have held Cyber Essentials certification within the previous four years.
Meet the applicable UK subsidy control requirements.
The Government has allocated £2.4 million to the initiative and estimates that approximately 6,000 businesses could benefit. The discount is available until 31 March 2027, or until funding is exhausted, whichever happens first. Eligible businesses must register and purchase their discounted assessment by the deadline. Once purchased, they have six months to complete and submit the assessment. Apply for the discount: https://firststep.iasme.co.uk/
Is Cyber Essentials mandatory for UK businesses?
No. Cyber Essentials is not a general legal requirement for every business operating in the UK.
Although the Government encourages certification, businesses are not automatically required to obtain it simply because they operate online, use cloud services or handle customer information. However, certification may be required under certain Government contracts or as a condition of working with particular customers or suppliers.
Businesses must still meet their applicable legal obligations, including protecting personal information under the UK GDPR and Data Protection Act 2018. These laws require appropriate security measures but do not generally mandate Cyber Essentials certification. This distinction is important.
A business can have legal security and privacy responsibilities without being required to hold a Cyber Essentials certificate.
Why might certification be worthwhile?
Even when certification is voluntary, there are several potential benefits.
Strengthening basic security
Cyber Essentials focuses on controls that reduce exposure to common cyber threats, including compromised accounts, malicious software and exploitation of unpatched systems. For smaller to medium size businesses, the assessment can provide a structured way to identify weaknesses in existing security arrangements.
Building customer and supplier confidence
Customers increasingly want reassurance that businesses handling their information have appropriate security measures in place. Certification provides an independently assessed baseline that businesses can use to demonstrate their security practices. However, certification does not guarantee that an organisation will never experience a cyber incident as well as maintain best practices.
Supporting business growth
As mentioned before some procurement processes and supplier agreements require Cyber Essentials certification. For businesses seeking Government contracts or opportunities with larger organisations, certification may provide commercial value.
Accessing additional insurance benefits
Also, eligible certified organisations with annual turnover below £20 million may receive up to £25,000 of cyber liability insurance, subject to policy terms and eligibility conditions.
Improving internal accountability
Preparing for certification can encourage businesses to review important questions. Who has access to company information? Are devices updated? Are former employees' accounts disabled? What security requirements apply to contractors? These are worthwhile considerations regardless of whether certification is pursued.
The challenge for remote-first businesses
Many small businesses no longer operate from a phyiscal office with company-managed computers and an internal IT department. Instead, employees and contractors may work remotely, use personal devices and access business information through cloud-based platforms such as Google Workspace or Microsoft 365. These arrangements provide flexibility, but they can also make meeting and demonstrating Cyber Essentials requirements more complicated.
At Hyplon, we recently worked through the Cyber Essentials readiness assessment for a client. The organisation operates remotely and relies on contractors using their own devices. As we progressed through the assessment, we identified several questions that weren't necessarily straightforward for a small to medium size business understands without technical expertise. This consideration can easily be overlooked when a business first sees the discounted certification fee and thinks they need to take up the offer ASAP, it’s not that simple.
Does Cyber Essentials require company-owned devices?
Not necessarily. Cyber Essentials permits personally owned devices to be used, provided relevant devices meet the applicable technical requirements.
However, the business must ensure that devices within its certification scope satisfy those requirements. This includes matters such as supported operating systems, security updates, malware protection, firewalls and appropriate access controls. The challenge is often not device ownership itself.
It's whether the organisation has sufficient visibility and control to establish that the required security measures are in place, especially if a contractor’s device isn’t solely being used for just your business or is also being used for personal used or by other family members.
For businesses relying on self-employed contractors or BYOD for employees, this may require reviewing existing working arrangements if wanting to undergo UK Cyber Essentials.
Company-managed devices can make it easier to enforce consistent controls, but they are not automatically required. A properly managed Bring Your Own Device arrangement may also be suitable as well as a remote working checklist where the contractor or employee checks off and acknowledges, and a Remote Device - BYOD policy that obtains acknowledgement should be considered.
Likewise, Cyber Essentials does not generally require an organisation to take control of every employee's home internet router. The applicable requirements depend on the devices, networks and services within the assessment scope.
What about cloud-based businesses?
Many organisations rely almost entirely on Google Workspace, Microsoft 365 and other cloud platforms. These services offer important security capabilities, including multi-factor authentication, access controls and administrative settings. However, using a reputable cloud platform does not automatically mean a business meets Cyber Essentials requirements. Consider a contractor or employee who downloads customer information from Google Workspace onto a personal laptop. The business may have strong controls over access to Google Workspace but limited visibility over what happens to the information once it is downloaded. Is the device appropriately secured? Are files stored locally? Can the information be accessed by other applications? What happens when the contractor finishes working with the organisation? These are security and privacy considerations worth addressing regardless of certification.
Could certification cost more than the discounted fee?
Yes. The 75% discount reduces the cost of the certification assessment. It does not necessarily cover the cost of preparing your business to meet the requirements. Additional costs may include:
Replacing unsupported devices or software.
Implementing security or device management tools.
Improving authentication and access controls.
Reviewing contractor and remote-working arrangements.
Obtaining technical assistance.
Addressing weaknesses identified during the readiness assessment.
For businesses already maintaining appropriate controls, the additional work may be minimal. However, for those relying on unmanaged devices or outdated technology, the costs may be considerably higher. Understanding these implications before purchasing certification can prevent unexpected expenses.
What does AI have to do with Cyber Essentials?
Cyber security threats are evolving as attackers increasingly use artificial intelligence such as deploying AI agents. In its 2026 Annual Review, the NCSC warned that AI is increasing the speed, scale and efficiency of cyber operations. AI can assist attackers with identifying vulnerabilities, developing convincing phishing messages, creating a copy of your website to lure your customers so to extract informaiton such as payment details or personal information that may put them at risk, researching potential targets and automating parts of their activities. This makes fundamental security controls increasingly important.
Weak passwords, outdated software and excessive access permissions remain vulnerabilities that attackers can exploit, regardless of whether AI is involved. Cyber Essentials provides a useful foundation for addressing these common weaknesses. However, there is another consideration.
Businesses are also introducing AI tools into their everyday operations. Employees may use AI to analyse information, summarise documents or support customer interactions. AI agents may be connected to business applications and given permission to retrieve information or carry out tasks. These developments create additional security, privacy and governance considerations. For example, a business may have appropriate technical security controls but limited oversight of which AI applications employees use, what information is shared with those tools or what permissions an AI agent has been granted.
Cyber Essentials certification does not mean a business has addressed all its AI governance and privacy risks.
Businesses need to consider both their technical security foundations and how AI is being introduced, accessed and managed. We explore this further in our companion article: AI Agents Are Changing Cyber Attacks. Is Your Business Prepared?
Start with the free Cyber Essentials readiness tool
Before purchasing certification, businesses can use IASME's free Cyber Essentials readiness tool. The tool supports organisations in reviewing their current arrangements and identifying areas that may require improvement. Access the free readiness tool: https://getreadyforcyberessentials.iasme.co.uk/
We recommend using the assessment as an initial learning and planning exercise. If you're unsure how a question applies to your business, particularly where remote workers or contractors are involved, seek clarification rather than assuming you meet the requirement. Understanding your existing controls and any gaps will put you in a better position to decide whether certification is appropriate.
At the end of day, should your business pursue Cyber Essentials?
Before committing, consider whether certification is required by your customers or contracts, whether you already meet the technical requirements and what it would cost to address any gaps. Also consider whether your organisation has sufficient oversight of the devices, cloud services and third-party tools accessing business information. For some businesses, certification may support customer confidence, supplier requirements and future growth. For others, improving existing security arrangements may be the more immediate priority.
Security should come before certification
The UK Government's 75% discount provides an opportunity for small to medium size businesses to strengthen their cyber security at a reduced certification cost. Cyber Essentials establishes a useful baseline, but certification should not become a box-ticking exercise. The most important outcome is having appropriate security controls that work for your organisation and can be maintained over time. More importantly businesses should really focus on have strong privacy controls and governance including around the use of AI as organisation must comply to the UK GDPR.
As businesses adopt more cloud services, remote-working arrangements and AI technologies, understanding how information is accessed, processed and protected becomes increasingly important.
A certificate can demonstrate that certain security requirements have been met. But it does not replace the need for ongoing security, privacy and governance oversight, including where AI is being used.
How Hyplon supports businesses
At Hyplon, we support businesses in understanding their security, privacy and AI governance responsibilities and translating those requirements into practical business decisions. This includes considering how cloud services, remote-working arrangements, contractors and AI technologies affect the way business information is managed and protected. So, before investing in certification, understand what your business needs, what controls are already in place and where improvements may be required.
Useful resources
Information correct as at November 2026. Eligibility and certification requirements should be confirmed with IASME before applying.
