Government offers small businesses 75% off Cyber Essentials certification

Micro, small and medium-sized UK businesses can get a 75% discount on Cyber Essentials certification from 3 November, the government said, with firms paying "as little as £80 and no more than £125 (plus VAT)". Cyber Security Minister Baroness Lloyd was due to announce the scheme in a speech at the National Cyber Security Centre's annual review on 3 November.

The certification is linked to insurance. UK-domiciled organisations with turnover under £20m that certify their whole organisation can opt in to cyber liability cover with a £25,000 total limit, underwritten by American International Group UK Limited and administered by Sutcliffe & Co Insurance Brokers, according to IASME, which licenses Cyber Essentials certification bodies.

IASME lists standard prices of £320 plus VAT for organisations with up to nine employees, £440 for 10 to 49 and £500 for 50 to 249, so the discount brings them to between £80 and £125.

The Cyber Essentials First Step Fund has £2.4m of government funding. It is first come, first served, open to businesses that have not been certified in the past four years, and runs until March 2027 or until the money runs out. The government estimates about 6,000 businesses could benefit. IASME says firms must register and buy their assessment by 31 March 2027 to get the discount.

A separate grant of up to £7m, running until March 2029, will pay for first-time certification and Cyber Advisor support for small and medium-sized suppliers nominated by signatories of the government's Cyber Resilience Pledge. The government estimates about 8,000 businesses could benefit. More than 230 organisations have signed the pledge.

IASME lists the policy as covering liability claims, incident response costs, extortion, defence costs and insurable fines from regulatory investigations, and business and network interruption. Money stolen electronically or through cyber fraud is excluded. IASME says the £25,000 limit "might be sufficient for a small breach or incident but inadequate for a serious problem or more than one incident", and that higher limits may be available on request.

The government cited an estimate that a significant cyber attack on a UK business or organisation could cost £195,000 on average. It said the estimate draws mainly on US disclosures and that, for medium and large firms, it rests on a sample of 18 and is indicative only.

Related coverage: Binance says it will cover $6.3bn hot-wallet theft from its own funds and Coalition found 1,506 exposed fridge panels before French store attack.

Sources

• GOV.UK: New Government-backed cyber security protections could save UK businesses thousands (3 November 2026)
• IASME: Cyber Essentials (opened 3 November 2026)
• IASME: Cyber Liability Insurance (opened 3 November 2026)

CoverWire is a news and information service. Nothing here is investment advice.