Cyber Essentials now costs between £80 and £125 plus VAT for an eligible UK small business, a quarter of the usual price. The government launched the Cyber Essentials First Step Fund on 3 November 2026. It takes 75% off a new certificate for micro, small, and medium-sized businesses. The discount runs until the end of March 2027, or until the £2.4 million set aside for it runs out. If your business has not held Cyber Essentials in the last four years, apply before the money goes.
Picture a business owner who pays the discounted fee, logs in, and opens the assessment. Cyber Essentials asks how every computer, phone, account, and cloud service in the business is set up. Each answer has to be accurate on the day, and an assessor checks every one before a certificate is issued.
For a business without someone who knows its IT inside out, that takes hours. Working out which devices are in scope, checking settings, and answering the assessor's follow-up questions is where the real effort sits.
What does the First Step Fund cover?
The fund covers 75% of the assessment and, if you pass, the certificate. The government's Cyber Essentials funding package makes it clear that it does not guarantee certification, so your answers must still meet the standard. You claim the discount through IASME's First Step Fund page.
The government has put £2.4 million into the fund and expects around 6,000 businesses to use it. It is first come, first served. Once the money is gone, the price goes back up, even if March 2027 has not arrived yet.
Who qualifies for the discount?
Your business qualifies if it is a UK micro, small, or medium-sized business that has not been certified in the last four years. That rules out renewals. If you held Cyber Essentials two years ago and let it lapse, you will pay the normal price.
You can search the IASME certificate register by company name to check, but it only lists certificates issued in the last 12 months. For anything older, look through your own records or ask whoever handled it last time.
What do you get for your money?
You get a certificate showing your business has the five baseline controls the government recommends. They cover firewalls, secure configuration, security updates, access controls, and malware protection. With a turnover under £20 million and a certificate covering your whole organisation, you also get up to £25,000 of cyber liability insurance.
The certificate also helps you win work. More than 230 organisations have signed the Cyber Resilience Pledge, which commits them to a risk-based approach to requiring Cyber Essentials across their supply chains. If you sell to larger businesses, expect to be asked for it. Have a read of our blog post about how Cyber Essentials helps you win bigger contracts.
How does Kimbley IT's offer work?
We take your business through Cyber Essentials as part of our IT assistance and support package. Sign up with Kimbley IT by 31 March 2027, while the fund lasts, and your Cyber Essentials certification comes with it. You pay IASME's discounted fee of £80-£125 plus VAT, and we will waive our usual £250 assessment fee.
That fee normally covers the hours spent completing the assessment and working through the assessor's questions until the certificate is issued. Under this offer, Kimbley IT does all of that for you at no charge, so the hours do not fall on you or your team. After the first year, Kimbley IT also handles the annual reassessment to keep your certificate current.
The offer is for businesses that use Google Workspace or move to it with Kimbley IT. If your business is on Microsoft 365 today, the move is part of the package, and there is no charge for the migration. Your team moves over a weekend and starts the working week on Google Workspace.
Google Workspace by Kimbley IT is not the vanilla version you get by signing up directly. It has been set up for how a UK business runs. Much of what Cyber Essentials checks is already in place, from managed security updates to Two Step Verification on every account.
| What Cyber Essentials Costs Until March 2027 | ||
| Business size | Usual price | With the First Step Fund |
|---|---|---|
| Micro (0 to 9 team members) | £320 plus VAT, set by IASME. | £80 plus VAT. |
| Small (10 to 49 team members) | £440 plus VAT, set by IASME. | £110 plus VAT. |
| Medium (50 to 249 team members) | £500 plus VAT, set by IASME. | £125 plus VAT. |
| Kimbley IT assessment (completing it and dealing with the assessor) | £250 for each certificate, including renewals. | Included for new clients who sign up for Kimbley IT's IT assistance and support by 31 March 2027. |
What should you do before the fund runs out?
Check whether you qualify. You need to be a UK micro, small, or medium-sized business that has not held Cyber Essentials in the last four years. If you are unsure, search the IASME register and your old emails for a certificate.
Decide who will complete the assessment. You can answer the questions yourself through the First Step Fund page. Or your IT provider can complete it for you, which is usually where the rest of the cost sits.
Make sure the whole business is in scope. The cyber liability insurance only comes with a certificate that covers your whole organisation. A certificate that leaves part of the business out costs the same and gives you less.
Do not wait for March. The fund is first come, first served, and £2.4 million covers around 6,000 businesses. Once the money is allocated, the discount ends.
Frequently asked questions
-
IASME sets the fee by business size: £320 plus VAT for a micro business, £440 for a small business, and £500 for a medium-sized one. Until the end of March 2027, the First Step Fund takes 75% off a first certificate, bringing it to £80, £110, or £125 plus VAT. IT providers usually charge separately for completing the assessment.
-
No. The fund is for businesses that have not held Cyber Essentials in the last four years. A renewal is charged at the normal price.
-
The government says the discount is available until March 2027, or until the funding runs out. With £2.4 million for around 6,000 businesses, it may close before then.
-
The government's announcement and funding package describe a discount on the Cyber Essentials certificate and do not mention Cyber Essentials Plus. Plus includes a hands-on technical audit and is priced separately.
-
No. The First Step Fund is open to any eligible UK micro, small, or medium-sized business. Kimbley IT's offer includes its £250 assessment when you sign up. It is for new clients who run on Google Workspace, or move to it, and sign up for its IT assistance and support.
Book a call
If you want Cyber Essentials while it costs a quarter of the usual price, book a video call with Kimbley IT using the form below. You will find out whether your business qualifies, what moving your IT support to Kimbley IT involves, and how soon you could be certified.
