Securing Subsidies Ahead of March 2027
Published: November 2026 | Estimated reading time: 7 minutes | Focus: Cyber Essentials funding, SME resilience and supply chain assurance
Executive summary: SMEs are a vital part of the UK economy and are often targeted by cybercriminals. Following the NCSC Annual Review, the Government has introduced a funding package to help more SMEs improve their basic cyber security. The package includes the fully funded Cyber Resilience Pledge Grant and the 75% subsidised Cyber Essentials First Step Fund. These options aim to make certification more affordable for eligible SMEs. Businesses need to check the eligibility rules and book their IASME assessment slots before the Q1 2027 deadlines to avoid missing out on funding.
Micro, small, and medium-sized businesses make up more than 99% of the UK private sector. As a result, attackers often target smaller supply chain companies to access larger businesses, the public sector, and critical national infrastructure.
At the NCSC Annual Review on 3 November 2026, the Cyber Security Minister Liz Lloyd announced a new funding programme to help smaller organisations defend against common online threats.
When announcing the initiative, the Minister stressed that protecting digital assets should be a top priority for every business, whether it is a single-director consultancy or a larger mid-market firm with multiple sites.
Small and medium-sized businesses employ millions of people across the UK and should not be left vulnerable as cyber threats increase. Malicious actors should not be able to exploit them, and SMEs will get support to stay secure. With this funding, expert cyber help is now more affordable, making it easier for businesses to fix vulnerabilities and earn Cyber Essentials certification.
The funding package has two parts designed to lower both cost and technical barriers: the Cyber Resilience Pledge Grant and the Cyber Essentials First Step Fund.
The Two Funding Streams Explained
Both funding options are offered in partnership with the IASME Consortium (the NCSC’s delivery partner for Cyber Essentials) and through licensed Certification Bodies. However, eligibility rules, funding amounts, and timelines differ for each.
Cyber Resilience Pledge Grant (100% Fully Funded)
The Cyber Resilience Pledge Grant is meant to address supply chain risks. Large companies, main contractors, and public bodies that have signed the Cyber Resilience Pledge will identify their most critical or high-risk SME suppliers who need technical support.
Selected suppliers receive:
- Fully funded Cyber Essentials certification: central funding covers the full assessment fee.
- Hands-on NCSC Assured Cyber Advisor support: a vetted Cyber Advisor will help you review your system setup, fix technical issues, and guide you through the Verified Self Assessment (VSA) portal.
Operational constraint: Organisations must nominate their suppliers directly, and IASME will guide these businesses through onboarding. Since funding is limited, being notified of an allocation does not guarantee funding. All assessments in this first round must be finished and submitted by 15 March 2027.
The Cyber Essentials First Step Fund (75% Grant Subsidy)
For independent SMEs not included in an enterprise pledge scheme, the First Step Fund offers a 75% subsidy on the standard Cyber Essentials assessment fee. The business pays the remaining 25%, which is based on its headcount. The applicant must satisfy three mandatory criteria:
- Headcount threshold: qualify as a micro, small or medium-sized company with fewer than 250 employees.
- Geographical jurisdiction: operate as a registered business entity based in the UK.
- Certification history: either apply for Cyber Essentials for the first time or not have held an active Cyber Essentials certificate in the past 4 years.
Application window: Eligible organisations must buy the discounted assessment voucher before 31 March 2027. After buying the voucher, the business has six months to complete any fixes, upload evidence, and submit the assessment for review.
Comparison: Navigating the Funding Streams
| Cyber Resilience Pledge Grant | Cyber Essentials First Step Fund | |
| Financial Subsidy | 100% funded (No assessment fee) | 75% discount (SME pays remaining 25%) |
| Consultancy Support | Direct 1-to-1 support from an NCSC-Assured Cyber Advisor | Self-directed, or paired with a chosen Certification Body |
| Target Recipient | Nominated suppliers of Cyber Resilience Pledge signatories | Independent UK SMEs, startups, and agencies |
| Eligibility Criteria | Identified and nominated by customer/pledge partner | <250 staff, UK-based, first-time applicant or lapse >4 years |
| Key Cutoff Date | Assessment submitted by 15 March 2027 | Assessment purchased by 31 March 2027 |
| Delivery Mechanism | IASME supplier nomination via Pledge partners | Direct application or via accredited Certification Bodies |
The Strategic Imperative: Beyond Checkbox Compliance
Getting Cyber Essentials with government funding offers significant commercial and risk reduction benefits that far outweigh the cost of certification.
-
Stopping Commodity Attacks at the Perimeter
NCSC data shows that using the five main Cyber Essentials controls can stop most untargeted, automated attacks. Common threats like ransomware, automated scanners, and credential stuffing tools look for basic security gaps. If your business is compliant, you make it harder for attackers, and they are likely to move on to an easier target.
-
Included Commercial Cyber Liability Insurance
For UK organisations with an annual turnover under £20m that achieve full certification, Cyber Essentials includes free cyber liability insurance (subject to underwriting terms). For micro businesses and growing SMEs, this insurance offers a quick financial safety net if they face incident response or business interruption costs.
-
Supply Chain and Public Sector Tender Eligibility
To bid for central government, Crown Commercial Service (CCS), and NHS contracts that involve sensitive personal data, suppliers must have a Cyber Essentials certificate. In the defence sector, the MoD requires Cyber Essentials before you can get Defence Cyber Certification (DCC) Level 0. Without an active certificate, you cannot bid for high-value contracts.
FAQ
What if an applicant buys the First Step Fund voucher and then fails to meet the completion date?
You must complete the technical questionnaire, upload your compliance declarations and submit the file for assessment within a strict six-month window of purchase (prior to 31 March 2027). If you don’t submit in that time, then the assessment voucher expires, and the 75% subsidy is lost.
What should large organisations that have already signed the Cyber Resilience Pledge do now?
Signatories to the Cyber Resilience Pledge must review their supplier registers to identify critical micro, small and medium suppliers handling sensitive operational data or providing critical services, then contact IASME directly (info@iasme.co.uk) to register those nominated suppliers before the 15th March 2027 submission deadline.
Does a Cyber Essentials certificate need renewing each year?
The Cyber Essentials certificate stays valid for 12 months from the date it’s issued. To keep your eligibility for procurement, meet insurer requirements, and stay in the supply chain, your organisation must complete a reassessment each year.
Strengthen your cyber resilience with trusted technical guidance.
Government funding can help you move from an informal IT setup to independently verified and accredited cyber defences at a lower cost. Don’t let funding limits or admin delays put your business security or tender opportunities at risk.
To check your funding eligibility, book an assessment, or talk to an accredited consultant:
Telephone: 0161 706 0244
Email: info@cybersecurityspecialists.co.uk
Related Pages
