The UK government has launched two funding routes intended to expand Cyber Essentials certification among small businesses and their suppliers. A £2.4 million First Step Fund will cover 75% of eligible firms' certification costs, while a separate supplier grant worth up to £7 million will fund certification through participating supply chains, according to the announcement dated 3 November. Government announcement

The First Step Fund is aimed at eligible UK micro, small and medium-sized businesses that have not held certification in the previous four years. Support is allocated on a first-come, first-served basis and is available until March 2027 or until the funding runs out. The government says discounted certification could cost between £80 and £125, plus VAT. Government announcement

The supplier route has different access arrangements. Eligible UK-based SME suppliers of organisations that signed the Cyber Resilience Pledge can be nominated by those organisations for fully funded first-time certification. The package includes tailored Cyber Advisor support and runs until March 2029. It is not presented as an unrestricted free offer to every small business. Government announcement

Officials estimate that about 6,000 businesses could benefit from the First Step Fund and approximately 8,000 from the supplier grant. Those are projected beneficiary numbers, rather than counts of completed certifications or grants already delivered. More than 230 organisations have signed the voluntary pledge, the release says. Government announcement

Cyber Essentials is built around five technical controls designed to address common internet-based threats. Funding a certification process does not establish that a business is protected against every attack. The announcement provides the programme's intended scope; it does not report independent results from the newly launched funding routes. Government announcement

Alongside the grants, the government named 14 additional Software Security Ambassadors to encourage adoption of its software security code. That initiative is separate from the certification funding and does not turn the announcement into a new statutory requirement for all firms. Government announcement

The immediate next step is allocation of the capped First Step funding and supplier nominations under the separate route. Actual take-up, delivery and security outcomes remain to be established. Government announcement