Cyber Essentials Discount: What Small Businesses Should Check

A new Cyber Essentials discount gives eligible small businesses a reason to review their security arrangements now. Before applying, check what the assessment covers, what preparation your business needs and who will maintain the controls afterwards.

A lower assessment fee can make a useful project easier to start. It does not tell you how much work your business needs to complete it.

I would use this opportunity to get three things clear: what needs changing, who is responsible and what the full commitment will cost. Those answers are more valuable than buying an assessment and hoping your IT provider will sort everything out.

What changed on 3 November 2026?

The government announcement published on 3 November introduces the Cyber Essentials First Step Fund. It offers eligible UK micro, small and medium businesses a 75% discount on a new certification, bringing the advertised assessment price to between £80 and £125 plus VAT.

The press notice says the offer is for businesses that have not been certified in the previous four years, with funding allocated on a first come, first served basis.

The separate funding policy paper says the offer runs until the end of March 2027, or until funding is exhausted. Funding pays for the assessment and certification if the business passes. It does not guarantee a successful result.

There is also a separate, fully funded route for selected SME suppliers nominated by organisations that have signed the Cyber Resilience Pledge. That route includes tailored Cyber Advisor support. Supplying a large business does not, by itself, establish eligibility.

What are you actually buying?

IASME, the scheme’s delivery partner, describes standard Cyber Essentials as a verified self-assessment. You prepare answers about your organisation, a senior person confirms their accuracy and an assessor reviews them.

Cyber Essentials Plus adds technical testing. The National Cyber Security Centre’s comparison distinguishes this from the standard assessment and explains that Plus is priced according to the size and complexity of the systems involved.

If a customer has asked for certification, establish exactly what they require before buying anything. Ask which level they need, what must be covered and when evidence is due. A certificate covering the wrong scope may not answer the customer’s question.

Certification can demonstrate that an organisation has met a defined standard. It should not be treated as a promise that an attack or interruption can never happen.

Five checks before applying

1. Confirm your funding route

Start with the official funding information and follow its links to IASME. Do not assume that purchasing through an ordinary checkout will automatically apply the subsidy.

Previously certified businesses should clarify their position before paying. The government press notice uses the condition of no certification in the previous four years, while the funding summary page describes applicants seeking their first certificate. Ask IASME to confirm which wording applies to your circumstances.

If you supply an organisation participating in the Cyber Resilience Pledge, ask your existing contact whether it is nominating suppliers. Keep the confirmation with your purchasing records.

2. Establish what the assessment needs to cover

Prepare a list of the devices, accounts and services used to run the business. Include equipment used away from the office and arrangements managed by an external IT provider. Ask an assessor how those arrangements affect the scope rather than guessing.

The NCSC preparation resources include the assessment questions, a readiness tool and a free 30-minute consultation with an assured Cyber Advisor for SMEs preparing for certification.

Use that preparation to turn a vague concern about security into a clear set of questions. Which information can you provide yourself? Which answers need your IT provider? Which arrangements need changing?

3. Get the complete cost in writing

Ask for an itemised estimate separating the assessment fee from any support and changes needed to prepare. Possible commitments include staff time, technical help, software changes, replacing unsuitable equipment and ongoing maintenance.

Some businesses may already have suitable arrangements. Others may discover that the fee is only a small part of the project. Find out which position you are in before making a commitment.

Ask suppliers to distinguish necessary work from optional upgrades and explain what each charge achieves. When reviewing recurring subscriptions, the questions in our Microsoft 365 renewal guide can help you check scope and responsibility.

4. Give the work a named owner

A business owner may assume the IT provider has the answers, while the provider is waiting for a device list or approval to make changes. The assessment then becomes another unfinished task.

Assign someone to coordinate the work, collect evidence and resolve unanswered questions. Agree what the provider will do, what staff must do and who approves the submission. Set preparation dates that leave room to resolve problems.

Having an external provider is useful. Having a clear agreement about the work it is doing for this assessment is more useful.

5. Plan for the year after certification

IASME confirms that certificates expire after 12 months. Budget for renewal and the work needed to keep arrangements current.

Decide who reviews access when people join or leave, who follows up changes to devices and services, and who checks that the agreed maintenance work is happening. Put those responsibilities into ordinary business routines.

Keep your recovery arrangements in view as well. Our cloud outage planning guide covers continuity when an essential service becomes unavailable. Certification and an operating plan serve different purposes.

A short decision worksheet

Complete this before committing money or setting a completion date.

Should your business apply?

If you are eligible, understand the work involved and can assign time to complete it, the offer is worth considering. If essential questions remain unanswered, use the preparation resources and get a clear scope before purchasing.

I would not delay basic improvements while waiting for a funding decision. Equally, I would not approve a large package of upgrades solely because a small part of the bill is discounted.

The useful outcome is a business that understands its arrangements and can maintain them. Start with the evidence, agree the work and then decide whether certification is the right next step.

By Julian Frincu, Skills 2 Grow. Official funding information, IASME and NCSC guidance checked on 3 November 2026. The checklist and worksheet are Skills 2 Grow’s business analysis. For assessment scope and technical requirements, use IASME or an appropriately qualified cyber security adviser.

Featured photograph by Kari Shea on Unsplash.