Cyber Essentials 75% discount: should your business apply?
New Cyber Essentials certificates are 75% off for UK micro, small and medium businesses until March 2027 or until the £2.4m fund runs out. What it covers, what it costs, why it is not the same as PCI DSS for card payments, and a 15-minute check before you apply.
Small UK businesses can now get a new Cyber Essentials certificate for 75% off, which the Government says brings the cost down to between £80 and £125 plus VAT. The offer is first come, first served, runs until March 2027 or until the £2.4m fund is used up, and is open to micro, small and medium-sized businesses that have not been certified in the last four years.
Photo: Open lock on laptop (49919519837).jpg) by Yuri Samoilov, CC BY 2.0, via Wikimedia Commons
The Government announced the "Cyber Essentials First Step Fund" on 3 November 2026, alongside the National Cyber Security Centre's annual review. The Government expects around 6,000 businesses to use it. Applications go through IASME, the NCSC's delivery partner for Cyber Essentials, at firststep.iasme.co.uk.
What is Cyber Essentials?
Cyber Essentials is a government-backed certificate that shows your business has the basic protections in place against the most common online attacks. You answer an online self-assessment about your devices and set-up, and an assessor checks your answers. It covers five controls:
- Firewalls – a barrier between your devices and the internet, including your router.
- Secure configuration – removing default passwords and switching off what you don't use.
- Security updates – keeping software and devices patched.
- User access control – each person only has the access they need, with strong passwords.
- Malware protection – antivirus or equivalent on the devices that need it.
There is also Cyber Essentials Plus, where an assessor tests your systems in person or remotely. The 75% discount applies to the standard certificate, not Plus.
How much does Cyber Essentials cost with the discount?
IASME's standard prices, before the discount, are set by the number of employees (all plus VAT):
- 0–9 employees: £320
- 10–49 employees: £440
- 50–249 employees: £500
The Government says the discount brings a new certification down to "as little as £80 and no more than £125 (plus VAT)". Check the exact price for your size on the IASME application site before you start, as funding is limited.
What this means for your business
For a café, salon, shop or takeaway, this is a cheap way to get a structured check of the devices that run your business: the tablet or till that runs your point of sale, the laptop you do the accounts on, your Wi-Fi router and staff phones that open business email.
There are three practical benefits:
- A clear checklist. The self-assessment makes you look at every device and account. It often turns up an old laptop, a shared password or a router still on its factory login.
- Insurance. According to the Government's announcement, certified organisations with turnover under £20m that certify their whole organisation can get cyber liability insurance of up to £25,000 arranged through IASME. Read the cover terms before relying on it.
- Trust with bigger customers. Some councils, larger firms and public-sector buyers ask suppliers for Cyber Essentials. If you sell to them, the certificate may be required, not just useful.
The condition to keep in mind: a certificate is a snapshot. It lasts 12 months and only helps if you keep doing the basics after the assessor has signed it off.
Is Cyber Essentials the same as PCI DSS for card payments?
No, and the two are easy to mix up. If you take card payments, the card schemes require you to protect card data under a separate standard, PCI DSS. Your card payment provider usually asks you to confirm this each year, often through a short questionnaire, and some providers charge a fee if you don't.
Cyber Essentials does not replace that. The two overlap (both want updated devices, strong passwords and a secure network), so doing one makes the other easier, but you still need to complete whatever your card provider asks for. Our guide to card payment security for UK SMEs explains the day-to-day routine.
How to check a card-taking business before it applies
When we look at a client's card set-up in a card fee review, we start at the counter before any paperwork. This is the order we suggest, and it lines up with the five controls:
- List every device that touches a sale or the money. Card machine, POS tablet, back-office laptop, router, staff phones with business email or banking apps.
- Check who logs in to what. Is the POS on one shared staff login? Does a former employee still have access to the back office or email?
- Look at the router. Is it still on the password printed on the sticker? Is the guest Wi-Fi separate from the network the till uses?
- Check updates. When did the POS app, the tablet and the laptop last update? Is anything too old to get updates at all?
- Find the card statement. Is there a monthly PCI or "non-compliance" fee on it? That usually means the provider's own security questionnaire is outstanding.
None of this needs technical knowledge, and for a small counter set-up it can take as little as 15 minutes. If you can answer all five, you are well placed to apply for the discounted certificate.
What should you do next?
- Check you qualify: a micro, small or medium-sized business not certified in the last four years.
- Run through the five checks above and fix the easy wins first (default passwords, missing updates, shared logins).
- Apply through firststep.iasme.co.uk while funding lasts.
- Separately, look at your card statement for PCI or non-compliance charges and complete your provider's questionnaire if it is outstanding.
Frequently asked questions
Who can get the 75% Cyber Essentials discount?
UK micro, small and medium-sized businesses that have not held Cyber Essentials in the last four years. It is first come, first served until March 2027 or until the £2.4m fund runs out.
Does Cyber Essentials make my card payments PCI compliant?
No. PCI DSS is a separate requirement from the card schemes, usually managed through your card payment provider. Cyber Essentials covers similar basics, so it helps, but you still need to complete your provider's PCI process.
How long does a Cyber Essentials certificate last?
Twelve months. You need to renew each year to keep the certificate and any insurance that comes with it.
Not sure what your card provider is charging you?
PCI fees, monthly minimums and terminal rental often sit unnoticed on a card statement. We will go through yours with you and explain every line in a free card fee review. If you are choosing new kit, see our card machines and Square POS setup pages.
Call or WhatsApp 07777 175890.
Jos Finserv Ltd (company no. 14560046) is an independent broker. For business finance we are a credit broker, not a lender, and we may receive commission from providers. Approval and terms depend on your trading history. No obligation.
Sources
Want us to look at your own numbers?
Tell us how to reach you and we will come back with what is actually available for a business like yours. We are paid by the provider, not by you, so this costs you nothing either way.
- We read your current statement and explain it in plain terms
- No obligation, and no pressure to move if you are already well placed
- One conversation, not a sequence of calls
Prefer to work it out yourself first? Use the card fee calculator, or check whether finance is worth exploring.
