Cyber Security Services, 5th November 2026
Cyber Essentials First Step Fund: What UK Businesses Need to Know
Has your business been asked if they are Cyber Essentials or Cyber Essentials Plus Certified as part of a contract or tender application? Maybe you supply into key industries who are requiring vendors to by Cyber Essentials or Cyber Essentials Plus certified as part of a Secure Supplier programme? Now could be the best time to become certified and receive financial support towards Cyber Essentials certification.
The government has announced new funding to help eligible SMEs strengthen their cyber security, with a 75% discount on Cyber Essentials certification through the First Step Fund and a separate offer of fully funded certification and expert support for selected suppliers. Both schemes aim to make essential protection more accessible to smaller businesses throughout the UK.
For businesses that have been considering certification, this could be an opportunity to take that crucial next step to become certified. However, the two offers have different eligibility requirements, and understanding what they cover is important before applying.
At TwentyFour, we are an IASME Licensed and Accredited Cyber Essentials and Cyber Essentials Plus Certification Body, supporting businesses to understand the requirements, strengthen their protection and work towards receiving certification.
What is Cyber Essentials?
Cyber Essentials is a government-backed scheme designed to help businesses protect themselves against common online threats. It focuses on five key technical controls: firewalls, secure configuration, security update management, user access control and malware protection.
- In practical terms, these controls address common questions every business should be asking.
- Are your devices configured securely?
- Is your software kept up to date?
- Can employees only access the systems they need?
- Do you have appropriate protection against malicious software?
For a manufacturer, this could mean reviewing the computers used across its offices, manufacturing floors and operational teams. For an accountancy firm, it could involve ensuring that access to systems containing sensitive client information is controlled and limited to only those who need it for their roles. For a logistics business, it could mean ensuring the devices supporting daily operations are properly managed and protected.
Cyber Essentials Certification provides a structured way to assess these foundations. But, it also helps businesses demonstrate their commitment to cyber security when speaking with customers, partners and prospective clients.
The First Step Fund: A 75% Discount
The Cyber Essentials First Step Fund offers eligible micro, small and medium-sized UK businesses a 75% discount on the cost of a new Cyber Essentials certification.
The government’s announcement states that the offer is for businesses that have not been certified within the last four years. Funding is available on a first come, first served basis until the end of March 2027 (or until the allocated funding runs out). Full eligibility should be checked when applying and TwentyFour and support businesses with this application process.
The government has confirmed that the discount applies when an business chooses to certify through a Certification Body (such as TwentyFour IT Services). Businesses looking to take advantage of this can speak to TwentyFour direct or can access the discount through IASME’s First Step Fund website.
Fully Funded Support for Selected Suppliers
The second offer, the Cyber Resilience Pledge: Cyber Essentials for Suppliers Grant, provides a higher level of support for eligible SME suppliers.
Selected suppliers can receive fully funded Cyber Essentials certification alongside tailored support from an NCSC-assured Cyber Advisor. Access is through participating Cyber Resilience Pledge signatories, which identify and notify relevant suppliers and guide them through IASME’s process. This is a targeted supply-chain programme. If your business supplies an organisation that has signed the Pledge, it is worth discussing whether you could be considered for support. The scheme runs until the end of March 2029.
You can view the government’s list of Pledge signatories or speak to members of the TwentyFour team who can support you and assess if you are eligible.
Why Does Supply-Chain Cyber Security Matter?
Businesses depend on one another. Whether you provide professional services, manufacture components or support deliveries, your customers may rely on your systems, communications and ability to keep operating to allow them to do business.
A cyber incident affecting one supplier can create disruption for other businesses. We have seen this many times in the news over the past few years with the likes of M&S, Co-Op, Harrods, Jaguar Land Rover, Qantas and others. These impacted both their own critical business operations and those of their suppliers, as was seen by the impact on Peter Green Chilled and the knock on impact of the JLR supply chain. But it is not just the “big businesses” that we see in the news that are at risk, and this is why customers increasingly need to understand how their suppliers manage cyber security.
The Cyber Resilience Pledge specifically asks signatories to review Cyber Essentials coverage across their supply chains and take a risk-based approach to requiring certification. For SMEs, building stronger cyber security foundations can therefore support both resilience and readiness for customer and prospect requirements. Having those conversations before a contract renewal or tender deadline gives your business more time to prepare.
Does the Funding Cover Cyber Essentials Plus?
The announced funding offers cover for Cyber Essentials.
Cyber Essentials Plus by comparrison assesses the same five technical controls but adds independent technical testing to verify that the protections are working in practice. This provides a higher level of assurance and may be appropriate where customers or contracts require it.
As a Certification Body for both levels, TwentyFour can help you understand which certification meets your business needs for your industry and discuss the work and costs involved. It is important to remember that Cyber Essentials Plus can only be achieved within 90 days of Cyber Essentials, meaning that it is important that you certify for both.
Funding Supports the Assessment, but Preparation Still Matters
Funding does not automatically mean your business will become certified. It covers the assessment and, where that assessment is passed, certification. However, it is essential that your business still needs to meet the scheme’s technical requirements to gain that certification.
Depending on your existing systems, preparation could involve updating software and operating systems, reviewing permissions, changing device settings, improving your security tools or replacing unsupported technology. Any additional preparation or remediation costs should be clarified separately from the funded certification offer. TwentyFour can provide a comprehensive Cyber Security Audit to see if you business meets these requirements and provide remediation before certification.
Cyber Essentials should also form part of an ongoing approach to cyber security. The controls need to remain effective as your business introduces new employees, devices, software and services.
Take Your Next Step with TwentyFour
Understanding certification requirements can feel daunting when you are already focused on running your business. Having the right support helps you turn those requirements into practical actions. At TwentyFour, we can support your journey from understanding the scope and identifying gaps through to assessment and certification. As an Official IASME Licensed and Accredited Cyber Essentials and Cyber Essentials Plus Certification Body, we can help you plan the right approach for your business whilst understanding what funding is available to you.
Whether you are exploring the First Step Fund, have been nominated for supplier support or need Cyber Essentials Plus to meet a customer requirement, speak to a member of the TwentyFour team about your next steps.
The First Step Fund is available for a limited period and subject to funding availability.
Starting the conversation early gives your business time to understand eligibility, properly prepare and make the most of the support available.
Enquire Here
Recent Insights
