Cyber Essentials certification costs from £320 plus VAT. From 3 November 2026 a £2.4m government fund cuts the price by 75%, to between £80 and £125 plus VAT, for UK micro, small and medium businesses not certified in the last four years, first come first served until March 2027.
TL;DR · LAST REVIEWED 4 NOVEMBER 2026
- Cyber Essentials is the government-backed baseline cyber security certificate, built on five technical controls.
- The standard price starts at £320 plus VAT; the First Step Fund cuts it by 75% to £80 to £125 plus VAT.
- The £2.4m fund runs until March 2027 or until it runs out, and the government estimates it will help about 6,000 businesses.
- Certified businesses with turnover under £20m get cyber liability insurance of up to £25,000.
- 43% of UK businesses reported a breach or attack in the last 12 months, but only 17% had heard of Cyber Essentials.
Cyber Essentials at a glance
| Item | Detail |
| Standard price | From £320 plus VAT |
| Discounted price | £80 to £125 plus VAT |
| Discount | 75% |
| Fund | £2.4m, until March 2027 |
| Insurance included | Up to £25,000, turnover under £20m |
Source: GOV.UK and NCSC
KEY FACTS
- Standard price: from £320 plus VAT (NCSC).
- Discounted price: £80 to £125 plus VAT, a 75% discount (GOV.UK, 3 November 2026).
- First Step Fund: £2.4m, until March 2027 or until it runs out.
- Businesses reporting a breach or attack in the last 12 months: 43% (Cyber Security Breaches Survey 2025/2026).
- Businesses holding Cyber Essentials: 5%, up from 3% a year earlier.
What Cyber Essentials is
Cyber Essentials is a certification scheme developed by the National Cyber Security Centre (NCSC). The NCSC describes it as the government's minimum standard of cyber security for organisations of all sizes. The scheme is built on five technical controls: firewalls, secure configuration, security update management, user access control and malware protection.
IASME is the NCSC's official Cyber Essentials Delivery Partner and manages a network of more than 400 cyber security organisations across the UK. Businesses can certify through a self-led route, registered and assessed through IASME, or a supported route through a licensed Certification Body.
The NCSC says a growing number of organisations require suppliers to be certified before they can bid for work.
| Control | What it covers |
|---|---|
| Firewalls | Boundary protection between the business network and the internet |
| Secure configuration | Devices and software set up to reduce weak points |
| Security update management | Software and devices kept patched |
| User access control | Accounts and admin rights limited to those who need them |
| Malware protection | Defences against viruses and other malicious software |
Source: NCSC: Cyber Essentials overview
How much Cyber Essentials costs
The NCSC says Cyber Essentials is priced by organisation size, starting at £320 plus VAT. On 3 November 2026 the government announced a 75% discount for micro, small and medium-sized businesses, so certification costs as little as £80 and no more than £125 plus VAT.
The discount comes from the Cyber Essentials First Step Fund, £2.4m of government funding available from 3 November 2026 at firststep.iasme.co.uk. It is open to UK micro, small and medium-sized businesses that have not been certified in the last four years.
Funding is first come, first served and runs until March 2027 or until the money runs out. The government estimates about 6,000 businesses will benefit.
| Item | Detail |
|---|---|
| Standard price | From £320 plus VAT, set by organisation size |
| With the 75% First Step discount | £80 to £125 plus VAT |
| Fund | £2.4m, first come first served, until March 2027 or until it runs out |
| Who qualifies | UK micro, small and medium businesses not certified in the last four years |
| Businesses covered (government estimate) | About 6,000 |
| Where to apply | firststep.iasme.co.uk |
Source: GOV.UK (DCMS), 3 November 2026; NCSC
Cyber Essentials Plus and the insurance included
Cyber Essentials Plus covers the same five controls as Cyber Essentials, checked through independent technical testing rather than self-assessment. The National Cyber Security Centre (NCSC) states that Cyber Essentials Plus is priced by the size and complexity of the network.
UK organisations with turnover under £20m that certify their whole organisation are entitled to cyber liability insurance arranged by IASME, including 24-hour incident response support. The government release puts that insurance at up to £25,000.
| Cyber Essentials | Cyber Essentials Plus | |
|---|---|---|
| Controls | The five controls | The same five controls |
| How it is checked | Self-assessment with independent audit | Independent technical testing |
| Price | From £320 plus VAT by size | Set by network size and complexity |
| Cyber insurance included | Yes, for whole-organisation certification with turnover under £20m | Yes, on the same basis |
Source: NCSC: Cyber Essentials overview
Free certification for suppliers
A separate Cyber Essentials for suppliers grant of up to £7m runs until March 2029. The grant is for UK-based small and medium-sized suppliers to organisations that have signed the government's Cyber Resilience Pledge, of which there are more than 230.
The grant covers fully funded first-time certification and Cyber Advisor support. Businesses are nominated by the pledge signatory they supply. The government estimates about 8,000 businesses will benefit.
How common cyber attacks are
The government's Cyber Security Breaches Survey 2025/2026, published on 30 April 2026, found that 43% of UK businesses had a breach or attack in the previous 12 months, about 612,000 businesses. The figure was 42% for micro businesses, 46% for small, 65% for medium and 69% for large businesses.
Phishing was the most common form, reported by 38% of businesses.
Only 17% of businesses were aware of Cyber Essentials, and 5% held the certificate, up from 3% the year before.
| Business size | Breach or attack in last 12 months | Aware of Cyber Essentials |
|---|---|---|
| Micro (1 to 9 staff) | 42% | 14% |
| Small (10 to 49) | 46% | 25% |
| Medium (50 to 249) | 65% | 56% |
| Large (250 or more) | 69% | 64% |
| All businesses | 43% | 17% |
Source: GOV.UK: Cyber Security Breaches Survey 2025/2026
DISCLAIMER
This article is editorial information, not financial advice. Kael Tripton Ltd is not authorised or regulated by the Financial Conduct Authority. Figures were correct at the last review date shown above; verify current rates and rules with the primary sources listed below before acting.
Frequently asked questions
How much does Cyber Essentials cost?
Cyber Essentials costs from £320 plus VAT, priced by organisation size. With the 75% First Step discount, UK micro, small and medium businesses pay £80 to £125 plus VAT, until March 2027 or until the fund runs out.
Who can get the 75% Cyber Essentials discount?
UK micro, small and medium-sized businesses that have not been certified in the last four years can get the 75% discount. Funding is first come, first served from firststep.iasme.co.uk.
What are the five Cyber Essentials controls?
The five Cyber Essentials controls are firewalls, secure configuration, security update management, user access control and malware protection.
Does Cyber Essentials include insurance?
Yes. UK organisations with turnover under £20m that certify their whole organisation get cyber liability insurance arranged by IASME, up to £25,000, with incident response support.
What is the difference between Cyber Essentials and Cyber Essentials Plus?
Both cover the same five controls. Cyber Essentials is a self-assessment with independent audit; Cyber Essentials Plus adds independent technical testing and is priced by network size and complexity.
SOURCES
- GOV.UK: New government-backed cyber security protections could save UK businesses thousands, 3 November 2026, accessed 4 November 2026
- NCSC: Cyber Essentials overview, accessed 4 November 2026
- GOV.UK: Cyber Security Breaches Survey 2025/2026, 30 April 2026, accessed 4 November 2026
- IASME: Cyber Essentials First Step Fund, accessed 4 November 2026
