UK SMEs offered 75% discount on Cyber Essentials certification under new scheme

British small and medium-sized enterprises (SMEs) are being offered a 75% discount on Cyber Essentials certification under a new £2.4m government-backed initiative designed to strengthen business resilience against cyber threats.

Announced on 3 November by the Department for Science, Innovation and Technology (DSIT), the Cyber Essentials First Step Fund aims to make essential cyber security protections more accessible and affordable for businesses across the UK.

The initiative could help approximately 6,000 firms achieve certification, with eligible micro, small and medium-sized organisations able to secure the certification for as little as £80, with a maximum cost of £125 plus VAT.

The discount is available on a first-come, first-served basis to businesses that have not held Cyber Essentials certification within the previous four years. The scheme will run until March 2027, or until its allocated funding has been exhausted.

The announcement comes amid growing concern over the financial consequences of cyber attacks. Government estimates suggest that a significant cyber incident affecting a UK business or organisation could cost an average of £195,000, potentially diverting vital resources away from investment, employment and growth.

Free certification helps to extend cyber protection across British supply chains

Alongside the discounted certification, Westminster is introducing a separate funding package to improve cyber resilience throughout the UK’s commercial supply chains.

Under the Cyber Resilience Package: Cyber Essentials for Suppliers Grant, eligible SMEs supplying organisations signed up to the government’s Cyber Resilience Pledge will be able to obtain certification completely free of charge.

Backed by up to £7m in government funding until March 2029, the initiative is expected to benefit approximately 8,000 businesses. Selected companies will also have access to tailored support from an National Cyber Security Centre (NCSC)-assured Cyber Advisor, helping organisations with limited in-house cyber security expertise navigate the certification process.

More than 230 organisations have signed the Cyber Resilience Pledge, committing to make cyber security a board-level responsibility and encourage stronger protections across their supply chains.

Cyber Security Minister Liz Lloyd MP said: “Small and medium-sized businesses employ millions of people across our nation, and should not be left vulnerable in the age of rising cyber threats. We are not going to sit back and let malicious actors take advantage – we will back our SMEs and help them be protected and secure.”

She added that the government was making it “easier and cheaper to access expert cyber support” and achieve certification through the Cyber Essentials initiative.

Why does the Cyber Essentials scheme matter for UK businesses?

Developed with expertise from the NCSC, the Cyber Essentials scheme is the government-recommended baseline for protecting organisations against common internet-based threats. The certification is designed to help businesses address some of the most frequently exploited weaknesses in their IT systems, reducing their exposure to cyber attacks such as phishing, malware infections and unauthorised access.

Certification focuses on five fundamental technical controls: firewalls, secure configuration, security update management, malware protection and user access control. Together, these measures provide a practical framework for identifying and addressing critical vulnerabilities before they can be exploited by attackers.

For SMEs, achieving certification offers benefits beyond improving technical security. Cyber Essentials can provide independent reassurance to customers, suppliers and business partners than an organisation has implemented recognised safeguards to protect its systems and information.

This is increasingly important for smaller businesses operating within larger supply chains, where cyber security requirements are becoming a more significant consideration in procurement and contract decisions.

The government is also expanding its Software Security Ambassadors initiative, with 14 additional organisations – including Thales, Capgemini, Fortinet, SANS and QinetiQ – joining the programme to promote secure software development and wider adoption of the Software Security Code of Practice.

This expansion reflects growing recognition that cyber resilience requires action across the entire digital ecosystem, from software developers and technology providers to the smaller businesses relying on their products and services.

Taken together, the funding initiatives and industry partnerships form part of a broader government effort to improve national cyber resilience and reduce the economic impact of digital threats.

By lowering the financial barriers to certification and providing additional assistance to businesses supplying larger organisations, Westminster is seeking to make stronger cyber security practices more accessible throughout the UK economy.

For SMEs, the discounted certification creates an opportunity to review existing security arrangements, address basic weaknesses and demonstrate a recognised commitment to protecting commercially sensitive information and customer data.

It could also help firms strengthen their position when competing for contracts with larger businesses that increasingly expect suppliers to demonstrate appropriate cyber security standards.