Quick answer: How can my business get Cyber Essentials for £80?
A new government fund covers 75% of the Cyber Essentials certification fee for eligible micro, small and medium-sized UK businesses, so certification now costs from £80 and no more than £125 (plus VAT). It’s for businesses that haven’t been certified in the last four years, it’s first come, first served, and it runs until March 2027 or until the funding runs out. You buy it through IASME’s Cyber Essentials First Step, and Reflective IT can take care of everything else, from getting your systems ready to passing the assessment.
Government-Backed Cyber Security for Less
On 3 November 2026, the government announced the Cyber Essentials First Step Fund: £2.4 million to help around 6,000 small businesses get certified for the first time. It’s one of the best-value ways we’ve seen for a business to prove it takes cyber security seriously.
Cyber attacks are expensive. The government puts the average cost of a significant attack on a UK business or organisation at around £195,000, and most attacks still rely on the same basic weaknesses: unpatched devices, weak passwords and missing MFA. Cyber Essentials closes exactly those gaps.
What Is Cyber Essentials?
Cyber Essentials is the UK government-backed scheme, run by the National Cyber Security Centre (NCSC) with IASME, that protects organisations against the most common cyber threats. Certification shows clients, suppliers and insurers that you have the essential controls in place. This short NCSC video explains it in a couple of minutes:
Video: National Cyber Security Centre (NCSC). Can’t see it? Watch on YouTube.
The 5 Technical Controls
To get certified, your business needs to meet all five controls across your devices, cloud services and network:
- Firewalls - unused ports closed and admin interfaces secured.
- Secure configuration - devices hardened, with default passwords and unnecessary software removed.
- User access control - a unique account for everyone, admin rights only where needed, and MFA on all cloud services.
- Malware protection - antivirus or EDR installed and actively scanning.
- Security updates - high-risk and critical updates applied within 14 days, and no unsupported software (such as Windows 10 without extended security updates).
Why It’s Worth Doing
- Lower cyber risk - protection against malware, ransomware, phishing and unauthorised access.
- Client data protection - safeguards confidential client and employee data across your systems.
- Regulatory alignment - supports your UK GDPR and Data Protection Act 2018 obligations.
- Reputation and tenders - builds client trust, and is often required for public sector and larger corporate contracts.
- Free cyber insurance - eligible UK organisations with a turnover under £20m that certify their whole organisation receive up to £25,000 of cyber liability insurance, including a 24-hour incident helpline.
How to Claim the 75% Discount
- Check you’re eligible: a UK micro, small or medium-sized business that hasn’t held Cyber Essentials in the last four years.
- Buy your certification through Cyber Essentials First Step (IASME) - the discount is applied there, so you pay from £80 to £125 plus VAT depending on your size.
- Get your IT ready and complete the self-assessment questionnaire - this is where we come in.
- Pass the assessment, receive your certificate and, if eligible, your cyber insurance.
Funding is limited and allocated on a first come, first served basis, so we’d recommend securing your place sooner rather than later.
End-to-End Delivery From Reflective IT
Buying the certificate is the easy part. Passing it - and genuinely being protected - means making sure every laptop, phone, cloud service and firewall meets the standard. Reflective IT manages the whole process for you:
| Phase | What you get |
|---|---|
| 1. Discovery | Scope and risk baseline report |
| 2. Gap analysis | A prioritised remediation plan |
| 3. Remediation | We fix the gaps, so your IT environment fully complies |
| 4. Pre-assessment | Evidence bundle ready for the assessor |
| 5. Submission | Your assessment submitted to IASME |
| 6. Certification | Your Cyber Essentials certificate and a renewal roadmap |
For many small businesses, our managed delivery takes around a day of our time, and you can pay the certification fee up front and spread the implementation cost over 12 months. Once you’re certified, we can help you go further with Cyber Essentials Plus, penetration testing and security awareness training.
Reflective IT Tip
Many of our clients already meet most of the controls through Microsoft 365 Business Premium, Microsoft Defender and Intune. Ask your Technical Account Manager for a quick readiness check before you buy, so you know exactly what’s left to do.
Frequently asked questions
Who is eligible for the 75% discount?
UK micro, small and medium-sized businesses that haven’t been certified to Cyber Essentials in the last four years. Funding is first come, first served.
How much will it cost?
The discounted certification fee is from £80 to a maximum of £125 plus VAT, depending on the size of your business. Any work needed to get your systems ready is separate, and we’ll quote this up front.
When does the offer end?
The fund runs until March 2027, or earlier if the £2.4 million of funding runs out.
We were certified years ago - can we still apply?
Yes, as long as you haven’t held Cyber Essentials in the last four years.
Do we have to renew?
Yes. Cyber Essentials lasts for 12 months, and we’ll give you a renewal roadmap so next year is straightforward.
Need Help or Have Questions?
Our team is always happy to help. Contact us, speak to your Technical Account Manager, or get in touch directly:
Sources: GOV.UK: New government-backed cyber security protections could save UK businesses thousands, IASME Cyber Essentials First Step, NCSC Cyber Essentials.
