The UK government has introduced a £2.4m funding scheme offering eligible small and medium-sized businesses a 75% discount on Cyber Essentials certification, alongside separate support for smaller suppliers working with major organisations.
The Cyber Essentials First Step Fund is intended to reduce the cost of adopting basic cybersecurity controls for UK businesses that have not held the certification during the previous four years. The discount is available on a first-come, first-served basis until March 2027, or until the allocated funding has been exhausted.
Ministers estimate that approximately 6,000 businesses could benefit from the first-step scheme. Applicants can access the offer through IASME, the government’s Cyber Essentials delivery partner, including where they choose to obtain certification through an accredited certification body.
Funding covers the cost of the assessment and, where an organisation meets the required standard, certification. Companies will still need to demonstrate that the necessary security measures are operating effectively before a certificate can be awarded.
Cyber Essentials is built around five fundamental technical controls: firewalls, secure configuration, user access control, malware protection and security update management. The framework is intended to help organisations protect their devices, networks and accounts against common internet-based threats.
Implementing those controls can require changes to how a business manages its equipment and information. Employees may need appropriate account permissions, unsupported software may need replacing, and administrators must ensure that security updates are applied within the required timescales.
Smaller employers often manage these responsibilities alongside routine commercial activity. A company without a dedicated technology department may rely on a business owner, an external IT provider or a member of staff with other operational responsibilities to oversee security arrangements.
Although the new funding reduces the direct certification cost, applicants may still face expenditure when bringing their systems into compliance. The assessment subsidy does not pay for every software licence, device replacement or operational change that might be needed.
A second initiative, the Cyber Resilience Pledge: Cyber Essentials for Suppliers Grant, provides more extensive assistance to selected businesses in participating supply chains. Eligible UK SME suppliers can receive fully funded certification and tailored support from a National Cyber Security Centre-assured Cyber Advisor.
The supplier grant has funding of up to £7m and is expected to operate until March 2029. The government estimates that around 8,000 businesses could benefit. Access is not universal: participating organisations identify relevant suppliers, contact them and support their applications through the scheme.
More than 230 organisations have joined the Cyber Resilience Pledge. Signatories commit to making cybersecurity a board-level responsibility, registering for the National Cyber Security Centre’s Early Warning service and taking a risk-based approach to cybersecurity requirements across their supply chains.
Supply chain security has become an important part of procurement because suppliers may have access to customer information, business applications or operational systems. A compromised account or poorly maintained device at one organisation can create risks for another company that depends on its services.
The two funding schemes address different barriers. The First Step Fund makes certification more affordable for eligible SMEs, while the supplier grant combines certification with specialist assistance for businesses identified through participating supply chains.
Companies seeking the discount can apply through the IASME First Step Fund process. Suppliers interested in the separate grant must be nominated through an eligible Cyber Resilience Pledge signatory, with the available support determined by the scheme’s conditions and remaining funding.
You must be logged in to post a comment.