The government is funding a 75% discount on a new Cyber Essentials assessment for eligible UK micro, small and medium organisations. According to GOV.UK, qualifying organisations could pay between £80 and £125 plus VAT while the First Step Fund remains available.
That makes the assessment easier to buy. It does not complete the preparation work or guarantee that the organisation will pass.
Before purchasing, the business still needs to confirm that it qualifies, decide what is inside the assessment scope and identify who owns the answers for firewalls, secure configuration, security updates, user access and malware protection.
If the unclear areas sit around the network, firewall, supported infrastructure or administrative access, 1Connect can help review that part of the environment and carry out any remedial work required. The formal assessment and certification remain with IASME and its authorised routes.
Table of Contents
What is the Cyber Essentials First Step Fund?
The Cyber Essentials First Step Fund offers a 75% discount to eligible UK micro, small and medium organisations seeking a new Cyber Essentials certificate.
The government says the £2.4 million fund could support approximately 6,000 organisations. It is offered on a first come, first served basis until the end of March 2027 or until the funding runs out.
The price after the discount depends on the size of the organisation:
| Organisation size | Discounted assessment price |
|---|---|
| Micro, 0 to 9 employees | £80 plus VAT |
| Small, 10 to 49 employees | £110 plus VAT |
| Medium, 50 to 249 employees | £125 plus VAT |
The official route to the offer is the IASME First Step Fund website. IASME says the organisation has six months to complete and submit its assessment after purchase. The government says the discount also applies when an organisation chooses to certify through an IASME-licensed Certification Body.
What the funding covers
The funding covers the Cyber Essentials assessment and, when the assessment is passed, certification.
Cyber Essentials is based on five technical controls:
- firewalls;
- secure configuration;
- security update management;
- user access control;
- malware protection.
The applicant completes a verified self-assessment, which must be signed off by a board member or equivalent and marked by an assessor.
What it does not cover
A discount on the assessment is not a guarantee of certification. It does not make missing controls compliant or replace the work needed to understand the organisation’s technology.
The funding should not be treated as a general budget for every technical change that an applicant may need. If the preparation identifies unsupported equipment, weak access controls or unclear firewall rules, those issues still need an owner and an appropriate route to remediation.
Who can use the 75% Cyber Essentials discount?
The government describes the fund as support for eligible UK micro, small and medium organisations seeking a new Cyber Essentials certificate. It also says the organisation must not have been Cyber Essentials-certified during the previous four years.
A business should therefore establish five points before relying on the discount:
- it is a UK micro, small or medium organisation;
- it is seeking a new Cyber Essentials certificate;
- it has not held Cyber Essentials certification during the previous four years;
- it can register and purchase while funding remains available and no later than 31 March 2027;
- it meets the Minimal Financial Assistance conditions shown during the official registration process.
IASME confirms eligibility during registration by checking the organisation’s details and Cyber Essentials history. Do not assume that a business qualifies from its headcount alone. Use the official IASME First Step route to check the current conditions and access the offer.
What should the business establish before purchasing?
The lower price may encourage businesses to purchase quickly. IASME says you have six months to complete and submit the assessment after purchase. A short readiness check before starting that clock can expose questions that would otherwise appear while the assessment is under way.
Confirm the organisation and technology in scope
Start with a current view of your organisation, devices, services and networks. Depending on the environment, that could include offices, branches, routers, firewalls, servers, laptops, mobile devices, cloud services and remote-working arrangements.
If a supplier manages part of the infrastructure, that does not automatically move it outside the assessment. The applicant still needs to know what is managed, which accounts and systems remain in its scope and who can supply reliable information about them.
The existing 1Connect guide, Asked for Cyber Essentials? Five infrastructure questions before you answer, provides a fuller framework for organising scope, owners and evidence.
Name one internal owner
Providers can supply facts about what they manage, but your organisation remains responsible for the declaration.
Name one person inside the organisation to coordinate the assessment. That person does not need to perform every technical task, but should be able to identify the owner of each control, collect current evidence and flag answers that remain unresolved.
Identify who owns each of the five controls
You may find that responsibility is divided across several internal teams and providers:
| Cyber Essentials control | Ownership question to resolve |
|---|---|
| Firewalls | Who manages the boundary firewall, device firewalls and allowed inbound services? |
| Secure configuration | Who removes unnecessary accounts, software and services from each device type? |
| Security update management | Who tracks support status and applies required updates across infrastructure, endpoints and cloud services? |
| User access control | Who approves, reviews and removes user, administrator and supplier access? |
| Malware protection | Who confirms that every in-scope device has an appropriate and active protection mechanism? |
A blank in this ownership record is not necessarily a failed assessment. It is a question to resolve before the business relies on an unsupported answer.
Check the network and infrastructure elements early
The network and firewall portion of your environment can reveal practical work before the assessment is submitted. Useful checks include:
- which routers and firewalls protect the in-scope networks;
- whether any administration route or service is unnecessarily reachable from the internet;
- who approves and documents inbound firewall rules;
- whether supported infrastructure is receiving required firmware and security updates;
- how remote administration is secured;
- which accounts hold administrative privileges and whether MFA is used where supported.
These checks do not cover the whole Cyber Essentials assessment. They establish whether the managed-infrastructure part has clear ownership and whether relevant gaps need attention.
Choose the official certification route
- Self-led: register through IASME, pay for the assessment and complete the verified self-assessment.
- Supported: use an IASME-licensed Certification Body to help interpret the questions and assess whether the requirements have been met.
The NCSC also provides a free Cyber Essentials Readiness Tool and assessment resources. Organisations that need broader guidance can use an NCSC-assured Cyber Advisor.
1Connect is not a Certification Body or NCSC-assured Cyber Advisor. Its role is operational: reviewing and remediating relevant network, firewall and managed-infrastructure elements.
Where can 1Connect help with Cyber Essentials readiness?
The network and infrastructure checks above are where 1Connect can help. 1Connect can review those areas, document which responsibilities it manages and carry out any remedial work required before the applicant submits its answers.
Where the business needs ongoing ownership rather than a one-off correction, the review may also identify whether Sentinel managed infrastructure is a suitable fit. Sentinel brings networking, firewall management, supported-infrastructure updates, secure remote access and monitoring into one managed environment.
Use the discount as a preparation deadline, not a shortcut
The First Step Fund makes a Cyber Essentials assessment more affordable. The useful business decision is not simply whether to buy it, but whether the organisation can support the answers it will be asked to give. Purchasing starts a six-month submission window, so establish the owners and obvious gaps before starting that clock.
Before purchasing:
- confirm eligibility through the official IASME route;
- establish the assessment scope;
- name one internal owner;
- map each technical control to the right people and providers;
- resolve relevant network and infrastructure gaps before submission.
For eligibility, assessment and certification, use the official IASME First Step Fund route.
If the preparation exposes uncertainty around your firewall, network, supported infrastructure or administrative access, talk to 1Connect about an infrastructure-readiness review. 1Connect can review these areas and discuss any remedial work required.
