Cyber Essentials First Step Fund

The government pays 75 per cent of your Cyber Essentials assessment. You pay the remaining 25 per cent, from £80 plus VAT, until the end of March 2027 or until the money runs out.

This is the Cyber Essentials First Step Fund, and it is the cheapest a first certificate has ever been. The catch is not in the small print, it is in the mechanics: the discount is attached to a specific application link and cannot be added afterwards. Buy the normal way and you pay full price, with no route back.

What you actually pay

The fund covers 75 per cent of the assessment fee. What is left is 25 per cent of IASME’s published price for your size band, so the figure depends on how many people you employ.

Cyber Essentials with the First Step Fund applied

Organisation size	Standard price	You pay
Micro, 0 to 9 staff	£320 + VAT	£80 + VAT
Small, 10 to 49 staff	£440 + VAT	£110 + VAT
Medium, 50 to 249 staff	£500 + VAT	£125 + VAT
Large, 250 or more staff	£600 + VAT	Not eligible

Size is counted on staff numbers across the whole organisation, not on the part of it you intend to certify. If you sit close to a band boundary, use your actual payroll figure rather than a rounded one, because the band determines both the price and, at 250, whether you qualify at all.

Are you eligible?

Three tests, and you need all three.

• A UK organisation with fewer than 250 staff. Micro, small and medium. At 250 or more you fall outside the scheme entirely and pay the standard price.
• No Cyber Essentials certificate in the last four years. This is the one that catches people. It is not only about first-time applicants: an organisation that certified in 2023 and let it lapse does not qualify. If you are not certain, check before you start rather than after.
• Purchased before 31 March 2027. Or until the funding is exhausted, whichever comes first. Allocation is first come, first served, and the pot is finite.

Charities, schools, not-for-profits and public sector bodies are organisations too. If you are UK based and under 250 staff, the size test is the test.

How to claim it

Four steps, and the first one is the one that matters.

1. Use the funded application link. It takes you to the IASME Supplier Assurance Tool with the funding already attached.
2. Create your account on the IASME site.
3. Eligibility is checked automatically. If you qualify, the discount is applied to the price without you having to ask for it or enter a code.
4. Pay your 25 per cent and complete the assessment within six months of purchase.

The discount is only applied through that link. It cannot be claimed separately, added to an application you have already started, or applied retrospectively to an assessment you have already bought. If you buy Cyber Essentials the ordinary way, you pay the full price and the funding is gone. This is the single most expensive mistake available on this page, and it is entirely avoidable.

Start your funded application →

You have six months to complete it

Buying and passing are two different deadlines, and the second one is easy to lose track of.

The assessment must be purchased before 31 March 2027. Once purchased, you have six months to complete and submit it. Buy on 30 March 2027 and you have until the end of September 2027 to finish, which is generous, but it is a clock and it starts the moment you pay.

Practically, that is an argument for buying sooner rather than later. The money is finite and first come, first served, and buying early both secures your place and gives you the full six months to work through anything that needs fixing.

What the funding covers, and what it does not

Worth being precise, because the gaps are where people get caught out.

It covers the Cyber Essentials assessment and, if you pass, the certificate.

It does not cover Cyber Essentials Plus. Plus is the audited level, a separate exercise with its own cost and its own timetable, and nothing in this scheme reduces it. If a contract has asked you for Plus specifically, budget for it separately and plan both stages together, because Plus has to follow a valid Cyber Essentials certificate within three months.

It does not cover consultancy, gap analysis or remediation. If you need help getting the controls right before you submit, that is a separate piece of work.

It does not guarantee a pass. This is the one worth dwelling on. The funding buys you an assessment, and if the assessment is not passed, it has been spent. There is no second funded attempt.

Before you click: the fifteen minute check

Because there is one funded attempt, it is worth spending a quarter of an hour establishing where you stand before you buy. Four questions account for most failures.

• Is anything running software that no longer gets security updates? An operating system, a browser, a plugin or an application past its support date. The scheme has no tolerance for it and it cannot be argued around. One forgotten machine is enough.
• Is multi-factor authentication on every cloud account? Not most. Every one, including the shared mailbox, the administrator account and the legacy application somebody made an exception for.
• Do you know what is in scope? Every device used for organisational work that reaches the internet, including personal phones used for work email. Cloud services count. Getting this wrong at the start wastes more time than anything else.
• Are high and critical security updates applied within fourteen days? An estate that patches monthly will fail on something.

If all four answers are comfortable, apply. If one is not, fix it first. The funding is not going anywhere in the next week, and a failed assessment is.

What usually fails, and it is the same two things

Across the submissions we assess, unsupported software and partial multi-factor authentication account for the overwhelming majority of problems.

Unsupported software is binary. Either everything in scope is receiving security updates or it is not, and an assessor will see the version numbers. The fix is usually to update, replace or remove one machine, and it is almost always cheaper than people fear.

Multi-factor authentication is the one that gets missed because it is nearly done. It was rolled out across the organisation, and then an exception was made for a shared account, or an old system that would not support it, or one person who found it inconvenient. The scheme asks about every account in scope, and the exception is what fails the submission.

Neither of these is a reason to delay applying. They are reasons to look before you do. Our Cyber Essentials checklist covers the rest.

The insurance that comes with it

Certification carries up to £25,000 of cyber liability insurance at no extra cost, for UK organisations with a turnover under £20 million, provided the whole organisation is in scope and the cover is taken up at the point of certification.

Note the condition. A sub-scoped certificate, where you certify part of the organisation rather than all of it, does not qualify for the cover. That is sometimes a reason to certify the whole organisation after all, and it is worth deciding deliberately rather than discovering it afterwards.

If you are not eligible

Two common reasons, and neither is a dead end.

You held Cyber Essentials within the last four years. You pay the standard price. If you are recertifying, that was always the position, and the cost is the same as it was last year.

You employ 250 or more people. Outside the scheme. The standard large band applies.

There is also a separate and larger scheme worth knowing about. Up to £7 million is available until March 2029 for SME suppliers nominated by organisations that have signed the government’s Cyber Resilience Pledge, covering certification in full along with Cyber Advisor support. You cannot apply for that one directly: a pledge signatory nominates you. If you supply a large organisation, it is worth asking whether they have signed.

Why go through a Certification Body

You can apply directly. Plenty of organisations do, and if your controls are in good order it is straightforward.

What a Certification Body adds is the review before submission rather than the verdict after it. We look at your answers, tell you which ones would not pass and why, and you fix them before the assessment is submitted rather than after it comes back. Given that the funded attempt is the only funded attempt, that is worth more here than it normally would be.

Solusec is an appointed Certification Body for Cyber Essentials and IASME Cyber Assurance, so the people who help you get the answers right are the people who assess them. There is no handoff in the middle and no third party involved. You get a named assessor throughout.

The link on this page is ours, which is how the funding reaches your application. It costs you nothing extra: you pay the same 25 per cent either way.