Cyber Essentials just got a 75% discount: Here's what UK SMEs need to know

Cyber security is no longer a luxury reserved for big businesses with big budgets. And thanks to a UK Government-funded initiative, protecting your business just became a whole lot more affordable.

If you're running a small or medium-sized business in the UK, there's some good news worth paying attention to.

Eligible organisations can now receive 75% off their Cyber Essentials assessment, potentially savi

ng hundreds of pounds while taking an important step towards protecting their business from cyber threats.

The initiative is being delivered through IASME, the National Cyber Security Centre's (NCSC) official Cyber Essentials Delivery Partner.

But there's a catch: the funding is time-limited, with a deadline of 31 March 2027.

Here's what you need to know, how much you could save, and why Cyber Essentials could be one of the smartest investments your business makes.

What Is the 75% Cyber Essentials Discount?

The UK Government is helping eligible micro, small and medium-sized businesses improve their cyber security by funding 75% of the cost of a Cyber Essentials assessment.

Cyber Essentials is a government-backed certification scheme designed to help businesses protect themselves against common internet-based cyber attacks.

It's a practical starting point for organisations that want to strengthen their security without getting

lost in complicated technical requirements.

And with this funding available, the financial barrier to getting certified is significantly lower.

How Much Could Your Business Save?

The discount depends on the number of employees in your organisation.

Business size	Standard price	Discounted price	Saving
Micro (0–9 employees)	£320 + VAT	£80 + VAT	£240
Small (10–49 employees)	£440 + VAT	£110 + VAT	£330
Medium (50–249 employees)	£500 + VAT	£125 + VAT	£375

That's a substantial saving for businesses already balancing rising operational costs, technology investments and the everyday demands of running a company.

For example, a business with 25 employees could reduce its Cyber Essentials assessment fee from £440 to just £110 plus VAT.

Not bad for taking a meaningful step towards better cyber security.

*Important: The discount applies to the Cyber Essentials assessment fee. Any additional consultancy, technical remediation or IT support costs are separate.

Who Is Eligible for the Cyber Essentials Funding?

Not every business will qualify, but the eligibility criteria make the scheme particularly relevant to UK SMEs that haven't previously achieved Cyber Essentials certification.

According to IASME, your organisation may qualify if:

• It is registered in the UK.

• It is a micro, small or medium-sized organisation.

• It has not held Cyber Essentials certification within the last four years.

• It meets the applicable Minimal Financial Assistance (MFA) subsidy rules.

The MFA limit is £315,000 over the relevant three-year period, including the value of this discount, under the Subsidy Control Act 2022.

Eligibility is checked through IASME's Supplier Assurance Tool when you register.

The key deadline is 31 March 2027.

Eligible businesses must register and purchase their discounted Cyber Essentials assessment by this date.

Once purchased, they have six months to complete and submit the assessment.

That gives organisations time to prepare, but it's worth remembering that resolving security gaps can take longer than expected.

What Exactly Is Cyber Essentials?

Think of Cyber Essentials as a health check for your business's basic cyber security.

It's a UK Government-backed certification scheme that focuses on five essential technical controls designed to reduce exposure to common cyber attacks.

These are:

1. Firewalls

Firewalls help protect your business network and devices by controlling unwanted network traffic.

They provide an important layer of defence against unauthorised connections.

2. Secure Configuration

Devices, software and cloud services should be configured securely, with unnecessary features disabled and default settings reviewed.

Because leaving everything on its factory settings isn't always the safest approach.

3. Security Update Management

Keeping operating systems, applications and devices updated helps protect against known vulnerabilities.

Cyber criminals regularly exploit weaknesses in outdated software, making effective patch management essential.

4. User Access Control

Employees should only have access to the systems and information they genuinely need.

Strong authentication, including multi-factor authentication where required, helps reduce the risk of unauthorised access.

5. Malware Protection

Appropriate protection helps prevent malicious software from compromising devices and business information.

Together, these five controls establish a practical baseline for improving cyber security.

Cyber Essentials won't eliminate every possible threat, but it provides a recognised framework for addressing many of the risks businesses face every day.

Why Should UK SMEs Care About Cyber Essentials?

It's easy to assume cyber criminals are only interested in large corporations.

Unfortunately, that's not how cyber crime works.

Small businesses can be attractive targets precisely because they may have fewer security resources, less formal IT management and limited time to monitor emerging threats.

And an incident doesn't need to involve a sophisticated hacker to cause serious disruption.

A compromised Microsoft 365 account, malicious email attachment or unpatched laptop could potentially result in lost productivity, financial losses or sensitive information being exposed.

For SMEs, the impact can extend well beyond the immediate technical problem.

Protect Your Business Operations

Cyber Essentials encourages businesses to implement the fundamental safeguards that help reduce the likelihood of common attacks.

That means fewer avoidable security weaknesses and a stronger foundation for day-to-day operations.

Build Trust With Customers

Customers increasingly want reassurance that their information is being handled responsibly.

Cyber Essentials certification demonstrates that your organisation has met a recognised set of cyber security requirements.

Improve Your Chances of Winning Contracts

Some organisations and public sector contracts require suppliers to hold Cyber Essentials certification.

For SMEs looking to work with larger businesses or enter new supply chains, certification can help demonstrate that cyber security is being taken seriously.

Create a Foundation for Future Growth

As businesses grow, their technology environments become more complex.

More employees, more devices, more cloud applications and more customer data all introduce additional considerations.

Establishing good cyber security practices early can make it easier to manage those risks as the business expands.

How to Apply for the 75% Cyber Essentials Discount

Getting started is relatively straightforward.

Step 1: Visit the official IASME funding website

Head to https://firststep.iasme.co.uk/ to access the Cyber Essentials funding initiative.

Step 2: Create an account

Register through IASME's Supplier Assurance Tool (SAT).

Step 3: Confirm your eligibility

The platform checks your organisation's details and Cyber Essentials certification history to determine whether you qualify for the discounted assessment.

Step 4: Purchase your assessment

If eligible, you can purchase Cyber Essentials at the discounted rate appropriate to your business size.

Step 5: Prepare your IT environment

Review your devices, software, user accounts, cloud services and security controls against the Cyber Essentials requirements.

Identify and resolve any gaps before completing the assessment.

Step 6: Complete and submit your assessment

You have six months from purchase to complete and submit your assessment.

The assessment involves a verified self-assessment questionnaire reviewed by an assessor.

Successful completion leads to Cyber Essentials certification, which is renewed annually.

Is Your Business Actually Ready for Cyber Essentials?

This is where things can get interesting.

Many businesses already have some of the necessary security measures in place.

You might use Microsoft 365, have antivirus software installed and regularly update your computers.

But having security tools doesn't automatically mean they're configured correctly or that your business meets all the Cyber Essentials requirements.

For example:

• Are all business devices running supported operating systems?

• Are security updates being installed within the required timeframes?

• Is multi-factor authentication enabled where required?

• Do employees have unnecessary administrator privileges?

• Are your cloud services configured securely?

• Do you have a clear understanding of which devices and services fall within the assessment scope?

These are the types of questions businesses need to address when preparing for certification.

And for organisations without dedicated in-house IT expertise, the process can feel a little daunting.

The good news? You don't have to navigate it alone.

How IT Desk Can Help Your Business Prepare

At IT Desk, we believe cyber security should be practical, proactive and understandable.

You shouldn't need a dictionary of technical jargon just to feel confident that your business is protected.

Whether you're starting your Cyber Essentials journey or reviewing your existing security arrangements, the right IT support can make preparation significantly easier.

Our approach to managed IT and cyber security can help businesses focus on the areas that matter most.

Understanding Your Current Security Position

Before making changes, it's important to understand what is already working and where improvements may be needed.

A review of your IT environment can help identify gaps relating to devices, software, access controls and cloud security.

Strengthening Microsoft 365 Security

For many UK SMEs, Microsoft 365 sits at the heart of daily operations.

From Outlook and Teams to SharePoint and OneDrive, securing these services is an important part of protecting business information.

Appropriate configuration, access controls and authentication measures can help reduce unnecessary risks.

Keeping Devices Updated and Protected

Effective device management helps businesses maintain supported software, apply security updates and manage endpoint protection.

It's the kind of ongoing work that's easy to overlook when everyone is busy running the business.

Making Cyber Security More Manageable

Cyber Essentials preparation isn't just about ticking boxes.

It's an opportunity to understand how your organisation uses technology and introduce better security practices that support long-term growth.

IT Desk can help you work towards a more secure, manageable IT environment while you prepare for the certification process.

Cyber Essentials certification is awarded through the official assessment process. Any assessment or certification services should be arranged through the appropriate IASME-approved channels.

Why Waiting Could Cost More Than You Think

The funding deadline might seem comfortably far away.

But when it comes to cyber security, preparation is rarely something worth leaving until the last minute.

Depending on your current IT environment, you may need to update devices, review permissions, change security configurations or replace unsupported software before you're ready to submit your assessment.

Starting early gives your business more time to make improvements without unnecessary pressure.

It also means you can begin benefiting from stronger security practices sooner.

And while the discounted assessment fee is attractive, the bigger opportunity is building a business that's better prepared for today's cyber threats.

Take the First Step Towards Better Cyber Security

For UK SMEs, the 75% Cyber Essentials discount is an opportunity worth exploring.

With assessment prices starting at just £80 + VAT for eligible micro businesses, the initiative makes recognised cyber security certification more accessible.

But the real value goes beyond the discount.

Cyber Essentials helps businesses establish essential safeguards, demonstrate their commitment to security and build confidence with customers and partners.

Ready to find out whether your business qualifies?

Visit the official IASME Cyber Essentials funding website to check your eligibility and get started.

And if you're unsure whether your current IT setup is ready, speak to IT Desk about strengthening your cyber security and preparing your business for the next step.

Because good cyber security shouldn't be complicated. And it definitely shouldn't be an afterthought.

People Also Ask

Is Cyber Essentials free for small businesses in the UK?

No. However, eligible UK micro, small and medium-sized businesses can currently receive a 75% discount on their Cyber Essentials assessment through a government-funded initiative. Discounted prices start at £80 plus VAT.

How much does Cyber Essentials cost in 2026?

Standard Cyber Essentials assessment prices are £320 plus VAT for micro businesses, £440 plus VAT for small businesses and £500 plus VAT for medium-sized businesses. Eligible organisations can currently access a 75% discount through IASME.

Who qualifies for the Cyber Essentials 75% discount?

Eligible organisations must be UK-registered micro, small or medium-sized businesses, must not have held Cyber Essentials within the previous four years and must satisfy the applicable subsidy rules. IASME confirms eligibility during registration.

When does the Cyber Essentials funding end?

The published deadline to register and purchase a discounted assessment is 31 March 2027. Businesses then have six months from purchase to complete and submit their assessment.

Is Cyber Essentials mandatory for UK businesses?

Cyber Essentials is not universally mandatory for UK businesses. However, certification may be required for certain government contracts, supply chain relationships or customer agreements.

Can IT support providers help with Cyber Essentials?

Yes. IT support providers can help businesses review their security arrangements, identify technical gaps and implement appropriate controls. Official assessment and certification are handled through the Cyber Essentials scheme's authorised process.

What's the difference between Cyber Essentials and Cyber Essentials Plus?

Cyber Essentials uses a verified self-assessment questionnaire. Cyber Essentials Plus builds on the same technical requirements but includes an independent technical audit of the organisation's IT systems. The 75% funding offer described here is for the standard Cyber Essentials assessment.

Further Reading

For businesses wanting to understand the scheme and its requirements in more detail, these official resources are useful starting points.

• IASME – Cyber Essentials Funding and Eligibility — Official funding information, discounted prices, eligibility and registration.

• IASME – Cyber Essentials — Overview of the certification scheme, assessment routes and preparation resources.

• IASME – Find a Cyber Advisor — Information about accessing practical cyber security guidance, including a free 30-minute consultation.

• National Cyber Security Centre — UK Government cyber security guidance for organisations.

• GOV.UK – Subsidy Control — Guidance on the subsidy control rules relevant to funding eligibility.