Updated: 12 November 2026
Funding window: until 31 March 2027, or until the allocation runs out.
The UK Government has introduced funding that can reduce the cost of Cyber Essentials certification by 75% for eligible micro, small and medium-sized organisations. Through the Cyber Essentials First Step Fund, a qualifying business with fewer than 10 employees can pay £80 + VAT, rather than the standard £320 + VAT assessment fee.
The offer applies to organisations seeking a new Cyber Essentials certificate that have not held Cyber Essentials within the previous four years. It does not cover the separate technical audit for Cyber Essentials Plus, and it does not guarantee that an applicant will pass.
Apply through Malwise
The application and eligibility check are handled on IASME's own platform. Using the link below keeps your certification associated with Malwise as your certification body.
The application and eligibility assessment are handled through IASME’s official platform. You should complete the eligibility process and purchase your funded assessment there, rather than assuming a discount can be applied to an ordinary invoice afterwards.
What is the Cyber Essentials First Step Fund?
Announced on 3 November 2026, the First Step Fund is a government-backed initiative delivered through IASME, the National Cyber Security Centre’s official Cyber Essentials delivery partner. It is designed to help smaller UK organisations adopt the Cyber Essentials baseline security controls.
Cyber Essentials covers five technical areas:
- Firewalls: control traffic between systems and untrusted networks.
- Secure configuration: reduce unnecessary services, insecure defaults and avoidable exposures.
- Security update management: install required security updates within the scheme’s timescales.
- User access control: manage account privileges and enforce appropriate authentication.
- Malware protection: use an accepted approach to defend in-scope devices from malicious software.
Funding reduces the cost of the assessment, not the standard required to pass. The applicant must still complete the self-assessment accurately, obtain the required senior sign-off and meet the scheme requirements.
Who is eligible for the 75% Cyber Essentials discount?
You may be eligible if your organisation:
- Is registered in the UK and meets the scheme’s UK eligibility conditions.
- Has fewer than 250 employees, within the micro, small or medium-size categories.
- Has not held a Cyber Essentials certificate in the last four years, including first-time applicants.
- Meets the relevant subsidy control conditions, including the applicable £315,000 Minimal Financial Assistance limit, taking this discount into account.
- Completes the IASME eligibility process and purchases the assessment while funding is still available.
The IASME Supplier Assurance Tool checks the organisation’s eligibility during registration. If your business is part of a group or has an unusual ownership structure, provide accurate details and follow IASME’s assessment rather than relying on an estimate.
Does an expired Cyber Essentials certificate qualify?
Potentially. The key condition is whether the organisation has held Cyber Essentials within the previous four years. If your last certificate was more than four years ago, you may qualify, subject to the other checks. If you certified last year or are due for your annual renewal, this specific fund is not intended for that renewal.
How much does Cyber Essentials cost with the grant?
IASME’s published assessment fees depend on organisation size. The First Step Fund covers 75% of those fees for eligible applicants.
| Organisation size | Employees | Standard fee | With 75% funding | Saving |
|---|---|---|---|---|
| Micro | 0 to 9 | £320 + VAT | £80 + VAT | £240 |
| Small | 10 to 49 | £440 + VAT | £110 + VAT | £330 |
| Medium | 50 to 249 | £500 + VAT | £125 + VAT | £375 |
Prices exclude VAT. The saving refers to the assessment fee before VAT. Large organisations with 250 or more employees are not eligible for this First Step Fund.
The fee covers the formal Cyber Essentials assessment process and certification if successful. It does not include technical remediation, an IT support package or an independent Cyber Essentials Plus audit.
How do I apply for the funding through Malwise?
Use the official IASME referral route for Malwise below. This is the most direct way to begin the funding application and keep the certification enquiry associated with Malwise.
Step 1: Open the Malwise funding application link
Start your Cyber Essentials funding application
This is an IASME-hosted link supplied by Malwise Cyber Ltd, not a third-party voucher website.
Step 2: Register and complete the eligibility questions
Follow IASME’s instructions to create or access your Supplier Assurance Tool account and enter accurate organisation details, including the relevant UK registration, organisation size and prior Cyber Essentials certification history.
IASME will check the information against the funding conditions. Do not assume that reaching the application page means you have been approved.
Step 3: Purchase the discounted Cyber Essentials assessment through IASME
If eligible and funding remains available, proceed with the purchase in IASME’s platform at the discounted price for your organisation size. This is the purchase that secures the discounted assessment, subject to IASME’s rules.
Step 4: Complete the Cyber Essentials questionnaire
Answer the assessment based on your actual systems, users, devices, cloud services and security controls. Your authorised board member or equivalent must approve the declaration. Malwise, as a licensed Certification Body, can assess the submission and explain any issues raised through the assessment process.
Step 5: Receive your result
If the submitted assessment meets the scheme requirements, the organisation can be awarded Cyber Essentials certification. If it does not, you will need to follow the applicable assessment and correction process; purchasing a funded assessment is not a promise of certification.
If you need help with scope or preparation before submitting, contact Malwise about a separately quoted support service.
When is the deadline for Cyber Essentials funding?
The fund is available until 31 March 2027, or until the available funding runs out, whichever comes first. To use the offer, IASME states that eligible organisations must register and purchase the assessment by 31 March 2027.
After purchase, an organisation has six months to complete and submit its Cyber Essentials assessment. The deadline to purchase and the deadline to submit are therefore different.
The discount is distributed subject to remaining allocation. Starting an application without completing the required steps does not reserve a place.
Can the funding be used for Cyber Essentials Plus?
The 75% discount applies to Cyber Essentials, not the separate Cyber Essentials Plus audit. However, you can arrange both levels of certification with Malwise. A successful Cyber Essentials assessment must be in place first, and the Cyber Essentials Plus audit must be completed within three months of the date of Cyber Essentials certification.
For organisations planning both certifications, the potential combined price can be lower when the basic Cyber Essentials fee is funded:
| Organisation size | Funded assessment | Plus audit | Combined total |
|---|---|---|---|
| Micro | £80 | £1,095 | £1,175 + VAT |
| Small | £110 | £1,395 | £1,505 + VAT |
| Medium | £125 | From £1,750 | From £1,875 + VAT |
All component figures above exclude VAT. These are indicative combined costs using Malwise’s published Cyber Essentials Plus audit prices, not a bundled government-funded Cyber Essentials Plus offer. The Cyber Essentials Plus audit must be scoped and quoted; additional requirements or travel may affect the price.
If you already hold a recent valid Cyber Essentials certificate, you may only need the Plus audit. See Malwise Cyber Essentials Plus pricing.
What should you check before applying?
Funding can make certification more affordable, but an application still depends on the organisation’s real security controls. Before submitting, pay particular attention to:
- Scope: include the relevant users, supported devices, cloud services, remote work and other in-scope systems.
- Multi-factor authentication: verify multi-factor authentication for in-scope cloud services wherever the scheme requires it.
- Security updates: make sure operating systems and applications are supported and updates are installed within the required period.
- Administrator accounts: control privileged access and keep normal user activity separate where required.
- Firewalls: review inbound access rules, host firewalls and any office network gateways.
- Malware protection and secure configuration: make sure each device uses a compliant protection approach and unnecessary exposure is reduced.
Do not leave a known technical gap unaddressed just because the assessment fee is discounted. Read Malwise’s guide to Cyber Essentials scope if you are uncertain which parts of your environment must be included.
Is the First Step Fund the same as the Cyber Resilience Pledge supplier grant?
No. The Government also announced a separate Cyber Resilience Pledge: Cyber Essentials for Suppliers Grant. That programme is designed for selected SME suppliers nominated by participating pledge organisations, and can provide fully funded Cyber Essentials and Cyber Advisor assistance.
It is not the same as the open First Step Fund application process. If your customer has nominated you for supplier funding, follow the instructions for that specific programme.
Frequently asked questions
Can a sole trader or small limited company apply?
Potentially, yes, provided the business meets IASME’s organisation, UK registration, size, prior-certification and subsidy conditions. Eligibility is decided through the formal process, not by the trading structure alone.
Does the 75% discount cover the cost of fixing security issues?
No. It is a discount on the eligible Cyber Essentials assessment. Preparation, consultancy, managed IT support and technical remediation are separate services.
Can my MSP complete the questionnaire for me?
Your IT provider can help gather information and prepare answers. The applicant organisation remains accountable for what is submitted, and the declaration must be approved by an appropriate board member or equivalent.
Is Cyber Essentials Plus included in the grant?
No. The technical Plus audit is separately priced. Malwise can quote for both assessments, taking the funded Cyber Essentials price into account where eligibility is confirmed.
Can I still apply when the funding runs out?
You can still purchase a standard Cyber Essentials assessment, but you should not expect the 75% discount once the allocation is exhausted or the scheme has closed.
Apply for Cyber Essentials funding with Malwise
Malwise Cyber Ltd is an IASME-licensed Certification Body delivering Cyber Essentials and Cyber Essentials Plus assessments for organisations throughout the UK. We can also provide separately scoped security consultancy, penetration testing and vulnerability management when needed.
If the First Step Fund is relevant to your organisation, start with the official Malwise referral link and complete the eligibility and purchase steps through IASME:
Apply for 75% off Cyber Essentials
Start on IASME's platform through the Malwise referral link. If you would rather talk the scope through first, or arrange Cyber Essentials Plus at the same time, get in touch and we will walk you through it.