Cyber Essentials is 75% cheaper for small businesses: how to use the discount

What happened

The government is paying for a 75% discount on Cyber Essentials, the UK's basic cyber security certificate. According to Today's Conveyancer, £2.4m of funding covers the discount, which is first come, first served for micro, small and medium businesses that have not been certified in the last four years.

With the discount, certification is expected to cost between £80 and £125 plus VAT, depending on size: micro (up to 9 staff), small (10 to 49) and medium (50 to 249). The government estimates about 6,000 businesses could benefit. Registration is open now, and businesses must register before 31 March to get the reduced price.

Why it matters to a small business

Cyber Essentials is the government's recommended minimum standard. It covers five basic controls that stop most common online attacks: a firewall, secure settings, user access control, malware protection and keeping software up to date. Government research quoted in the announcement puts the average cost of a significant cyber attack on a UK organisation at £195,000. For a small practice or local business, even a smaller incident can mean days without email, bookings or patient records.

The certificate also helps you win and keep work. Many councils, NHS bodies, insurers and larger companies ask suppliers for Cyber Essentials. And it gives clients something real to trust when you hold their personal data, which matters for therapists, clinics, solicitors and accountants in particular.

It is a self-assessment: you answer a questionnaire about how your devices, accounts and systems are set up, and an approved certification body checks your answers. The questions are published by IASME, so you can read them before you start.

Five things to do this month

1. Register before the funding runs out. The discount is first come, first served and closes for registration on 31 March. If you have not been certified in the last four years, check eligibility now rather than waiting until spring.
2. Read the questionnaire first. Download the questions from IASME and go through them with whoever looks after your IT. Most small businesses find a handful of gaps, not dozens.
3. Fix the usual weak spots. Turn on two-step login for email and key accounts, remove old staff accounts, update laptops and phones, and make sure every device has malware protection switched on.
4. Don't forget your website. Out-of-date WordPress plugins, old admin logins and missing security updates are a common way in. Your website is part of your attack surface, even if it only takes enquiries.
5. Show it once you have it. Add the Cyber Essentials badge to your website footer and mention it on your contact or privacy page. It is a quiet trust signal for anyone deciding whether to share their details with you.

The bigger picture

AI is making scams and attacks cheaper and faster for criminals, and small businesses are often the easiest targets. A low-cost route to the basic standard is worth taking. Most of the work is simple housekeeping that also makes your systems faster and easier to manage.

Want your website checked first?

We can check your website for out-of-date software, weak logins and missing security settings before you apply, and fix what we find. Get in touch and we will take a look.