Up to £9.4m in Cyber Essentials funding for UK SMEs

GOVERNMENT FUNDING | 3 NOVEMBER 2026

Information correct as at 3 November 2026. Funding details and deadlines may change, so check IASME and GOV.UK for the latest.

The Government has committed up to £9.4 million, expected to help around 14,000 UK SMEs achieve Cyber Essentials. The package combines a £2.4 million fund offering eligible businesses a 75% discount on certification, with a separate supplier grant worth up to £7 million for selected suppliers of organisations that have signed the Cyber Resilience Pledge.

Two funding routes, one common baseline

The two schemes are separate. The First Step Fund is available to qualifying SMEs whether or not they supply a Pledge signatory. The supplier grant is targeted at selected suppliers nominated through participating signatories.

How the funding is split

Which scheme is right for your business?

An eligible UK micro, small or medium-sized business that has not held Cyber Essentials in the last four years can apply to the First Step Fund directly, without waiting for a customer to nominate it. A business that supplies a Cyber Resilience Pledge signatory can also ask that customer whether it plans to nominate suppliers for the fully funded grant. The list of signatories is on GOV.UK. The two schemes are separate, so a business that is not nominated still has the 75% discount available.

Who is IASME, and what is a Cyber Advisor?

IASME is the Government's delivery partner for the Cyber Essentials and Cyber Advisor schemes, and it is delivering both funding schemes. A Cyber Advisor is a cyber security professional assured by the National Cyber Security Centre (NCSC), qualified to help small and medium-sized organisations put the Cyber Essentials controls in place.

1. Cyber Essentials First Step Fund: 75% off certification

The First Step Fund is designed to reduce the upfront cost for smaller businesses taking up Cyber Essentials. It is open to eligible UK micro, small and medium-sized businesses that have not held Cyber Essentials certification in the previous four years.

The Government has allocated £2.4 million and estimates that around 6,000 businesses could benefit. Applications are handled on a first-come, first-served basis. The scheme closes at the end of March 2027, or earlier if the funding is exhausted.

What will certification cost?

Eligible businesses pay between £80 and £125 plus VAT after the 75% discount. Applying the discount to IASME's published assessment rates gives the following indicative prices:

Prices are calculated from IASME's published assessment rates and the Government's 75% discount. Check the live application process for the applicable price and eligibility before applying.

Businesses can access the discount through IASME. The Government's policy paper also confirms that the discount remains available if an organisation chooses to certify through a Certification Body.

2. Cyber Resilience Pledge supplier grant: fully funded certification

The second scheme is aimed at improving cyber security across supply chains. It provides up to £7 million in Government funding for selected eligible UK SME suppliers of organisations that have signed the Cyber Resilience Pledge.

The Government estimates that around 8,000 businesses could benefit. Selected suppliers will receive fully funded Cyber Essentials certification. Some will also receive tailored support from an NCSC-assured Cyber Advisor, particularly where they have limited in-house cyber security expertise.

Participating Pledge signatories will identify and notify relevant suppliers, then help them access the scheme through IASME's process. The grant runs until the end of March 2029.

What does the grant include, and who qualifies?

According to the guidance issued to Pledge signatories, support comes as two types of digital voucher. One covers 100% of the Cyber Essentials assessment cost. The other provides four hours of time with an NCSC-assured Cyber Advisor, who helps the supplier put the Cyber Essentials requirements in place.

To qualify, a supplier must be a UK-based micro, small or medium-sized organisation achieving Cyber Essentials for the first time. A formal contract is not required, but the signatory must be able to describe the supplier relationship and confirm that the organisation would benefit from certification. IASME confirms eligibility when vouchers are allocated.

Funding is limited, and registering does not guarantee support. A supplier that is nominated but does not engage with IASME or its Cyber Advisor can have its vouchers reallocated to another business.

What should Pledge signatories do?

Signatories should register their interest with IASME and prepare to identify the suppliers most likely to benefit. IASME's Supplier Assurance Tool (SAT) provides visibility of suppliers' Cyber Essentials status and supports the funding process.

Funding is limited, so not every SME supplier will necessarily receive support. Signatories should take a considered approach to identifying suppliers, taking account of their role, access to systems or data, and importance to the organisation.

In practice, signatories register interest by emailing info@iasme.co.uk, create an account on the Supplier Assurance Tool, and send their chosen suppliers a unique invitation link. IASME offers two ways to run the process: it can manage voucher allocation and tracking on the signatory's behalf, or the signatory can manage it directly in its own SAT account. Each registered signatory is given an indicative voucher value, which is not a guaranteed entitlement.

What should suppliers do?

Eligible suppliers should look out for contact from organisations they supply that have signed the Pledge. The signatory will identify relevant suppliers and guide selected businesses through the application process. The supplier grant is not a general application route for any SME; access is through a participating Pledge signatory.

A nominated supplier receives an email from its customer with a unique registration link. It creates an account with a work email address, sets up multi-factor authentication and completes its organisation details. If it is eligible and a voucher is allocated, it receives a notification and can redeem the voucher in the SAT. Redeeming an assessment voucher gives access to the assessment platform. The customer that invited the supplier can see its Cyber Essentials status in the SAT.

Deadlines for the supplier grant

The Government's announcement describes the supplier grant as running until March 2029, while the 15 March 2027 submission date comes from IASME's current voucher guidance. Anyone planning around a later date should confirm the applicable deadline with IASME.

A link that expires after seven days and a voucher that expires after ten working days leave little room for a slow reply, so suppliers should act on an invitation as soon as it arrives.

Key dates at a glance

1. 3 November 2026
   Both schemes open.
2. 15 March 2027
   Completed assessments for the supplier grant must be submitted for marking, under the current IASME guidance for signatories.
3. End of March 2027
   The First Step Fund closes, or earlier if the funding runs out.
4. End of March 2029
   The Government's announcement gives this as the end date for the supplier grant.

Why this matters for the Cyber Resilience Pledge

The Cyber Resilience Pledge was formally launched at 10 Downing Street on 7 July 2026. It asks signatories to:

• Make cyber security a board-level responsibility, including implementing the Cyber Governance Code of Practice and completing NCSC board training.
• Register for the NCSC's Early Warning service.
• Take a risk-based approach to requiring Cyber Essentials across their supply chains.

More than 230 organisations have now signed the Pledge. CyberSmart is among them.

The third commitment can be difficult to put into practice. Large organisations may have hundreds or thousands of suppliers, many of them smaller businesses with limited security resource. Asking those suppliers to certify can create additional cost and work, even where the requirement is reasonable.

The new grant helps address that barrier. It gives signatories a practical way to support selected suppliers as they improve their security, rather than simply passing a requirement down the supply chain. It also creates a route to improve assurance across groups of suppliers using a common baseline.

Why Cyber Essentials is a useful starting point

Cyber Essentials covers five technical control areas designed to protect organisations against common internet-based attacks:

• Firewalls: control traffic between the internet and an organisation's networks.
• Secure configuration: reduce exposure by setting up devices and systems securely.
• User access control: ensure people have appropriate access to systems and information.
• Malware protection: help prevent malicious software from causing harm.
• Security update management: fix vulnerabilities before attackers can exploit them.

Certification provides a recognised way to demonstrate that these baseline controls are in place. It is a starting point, rather than a complete security programme, and organisations should continue to manage risks that fall outside its scope.

The Government's announcement adds that certified organisations with a turnover below £20m also receive up to £25,000 of cyber liability insurance.

Frequently asked questions

Can an SME use its preferred Certification Body?

Yes. The Government's policy paper confirms that the 75% First Step Fund discount still applies when an organisation chooses to certify through a Certification Body.

Does the First Step Fund apply if a business was certified recently?

The Government's announcement says businesses must not have held Cyber Essentials certification in the previous four years. Check the current IASME eligibility terms before applying.

Can any SME apply for the fully funded supplier grant?

No. The supplier grant is for selected eligible UK SME suppliers in the supply chains of Cyber Resilience Pledge signatories. Participating signatories identify and contact suppliers through IASME's process.

Does receiving funding guarantee certification?

No. Funding covers the assessment and, where the assessment is passed, certification. The organisation must still meet the Cyber Essentials requirements.

How long are the schemes available?

The First Step Fund is available until the end of March 2027 or until its funding runs out. The supplier grant runs until the end of March 2029.

What happens if a supplier does not redeem its voucher?

Vouchers must be redeemed within 10 working days of allocation. Unredeemed vouchers are reclaimed and added back to the signatory's credit so they can be reallocated. Suppliers can ask IASME for an extension before the voucher expires.

Taking the next step

For an SME looking to achieve Cyber Essentials, the First Step Fund makes certification considerably more affordable. For selected suppliers of Pledge signatories, the supplier grant offers a route to fully funded certification and, in some cases, additional expert support.

For larger organisations, the funding provides a practical way to start turning supply-chain commitments into action. Identifying the suppliers that matter most, understanding their current certification position and helping them improve their security can strengthen the resilience of the wider supply chain.

If you are an SME planning to certify, or a Pledge signatory deciding which suppliers to support, speak to a CyberSmart advisor.

Useful links

• Apply for the Cyber Essentials First Step Fund
• IASME Supplier Assurance Tool
• Government guidance: Cyber Essentials funding package
• Cyber Resilience Pledge
• List of Cyber Resilience Pledge signatories

Sources

• https://www.gov.uk/government/news/new-government-backed-cyber-security-protections-could-save-uk-businesses-thousands - Department for Digital, Culture, Media and Sport, 3 November 2026.
• https://www.gov.uk/government/publications/cyber-essentials-funding-package/cyber-essentials-funding-package - Government policy paper, published 3 November 2026.
• https://iasme.co.uk/cyber-essentials/frequently-asked-questions - IASME published Cyber Essentials assessment fees.
• https://www.gov.uk/government/publications/cyber-resilience-pledge-list-of-signatories/cyber-resilience-pledge-signatories - Government list of Pledge signatories, updated 29 October 2026.
• https://www.gov.uk/government/publications/cyber-resilience-pledge - Cyber Resilience Pledge declaration and commitments.
• DCMS, "Cyber Resilience Pledge: Cyber Essentials for suppliers funded support", and IASME, "Supplier Assurance Tool (SAT) Funding: User Guide for Pledge Organisations" (Version 1), both issued to Pledge signatories, November 2026.