The UK government is to back a 75% discount for the National Cyber Security Centre’s (NCSC’s) Cyber Essentials certification scheme for small and medium sized enterprises (SMEs), with many set to benefit from free certification.
The offer, which is to be provided through the NCSC’s Cyber Essentials delivery partner IASME, reflects the increasing average costs of cyber incidents – government figures put this as high as £195,000 – which ultimately suck money out of the pockets of businesses, preventing them from investing and growing the wider economy.
Qualifying businesses could end up paying as little as £80 to achieve Cyber Essentials certification, with the NCSC pledging they would pay no more than £125 – plus VAT. At the same time, organisations that have signed up to the government’s Cyber Resilience pledge will be able to refer SMEs operating within their supply chains to undertake Cyber Essentials certification for free. These businesses may also receive access to free cyber security advisors to support them through the process.
Cyber minister Liz Lloyd said the enhanced support package should make it easier for smaller businesses to take practical action while safeguarding the supply chains of the UK’s biggest brands and multinational enterprises at the same time.
“Small and medium-sized businesses employ millions of people across our nation, but are particularly vulnerable in the age of rising cyber threats. We are not going to sit back and let malicious actors take advantage – we will back our SMEs and make them match-fit,” she said.
Speaking at the launch of the NCSC’s Annual Review, Lloyd added: “We are making it easier and cheaper to access expert cyber support, identify and plug vulnerabilities in their digital systems, and achieve certification through our Cyber Essentials scheme.
“It doesn’t matter whether you’re sitting at the head of the table in the boardroom, or working from the kitchen counter at home – if you run a business, no matter the size, securing your digital systems must be a top priority and we’re equipping businesses for the evolving digital future.”
The so-called First Step Fund will be covered by £2.4m of public money and is to be offered on a first-come-first-served basis to businesses that have not achieved Cyber Essentials certification in the past four years. The money will be available until March 2027 or until it runs out, and Westminster expects about 6,000 businesses will be able to benefit from it.
Cyber Essentials for Suppliers, meanwhile, will be worth up to £7m through March 2029. SMEs selected to take part will be contacted by their nominating customer – which must be a signatory to the Cyber Resilience Pledge – and invited to apply, and it is hoped that about 8,000 will be able to avail themselves of the opportunity.
CyberSmart CEO and co-founder Jamie Akhtar said: “Cyber Essentials has been part of the UK’s cyber security landscape for more than 12 years. Around 300,000 certificates have now been issued under the scheme, including more than 30,000 by CyberSmart. That represents real progress, but adoption remains uneven, particularly among smaller businesses.
“The government’s commitment of up to £9.4 million, with the potential to help around 14,000 SMEs, is welcome because it tackles a practical barrier. Every organisation should be expected to meet and maintain a recognised baseline of cyber security. That baseline is Cyber Essentials.
But, added Akhtar: “Certification is a starting point, not a guarantee against cyber attacks. The controls need to be maintained and built on.”
Push for secure software
At the same time, 14 new organisations have signed up to become Software Security Ambassadors – committing to championing secure software development and encouraging their supply chain partners to adopt the Software Security Code of Practice.
The new cohort of recruits to the programme includes the likes of CapGemini, Fortinet, QinetiQ, Risk Ledger, the Sans Institute, Thales and Zscaler, who join suppliers such as Cisco, Palo Alto Networks and Sage, consultancies such as Accenture and NCC Group, and cyber associations such as Isaca and ISC2.
The announcements come hot on the heels of several cyber-centric initiatives announced in the Autumn Budget, including money for a new National Exposure and Real-Time Vulnerability (NERV) Centre within the NCSC, the enhancement of the agentic Cyber Shield initiative, an AI Cyber Security of Excellence at the NCSC’s Manchester hub, a National Agentic Security Unit, and the deployment of AI technology to protect public sector bodies.
