Thousands of small businesses across the UK can now strengthen their cyber security at a significantly reduced cost following the launch of a new Government initiative aimed at improving cyber resilience.
Launched on 3rd November 2026, the scheme offers eligible businesses a 75% discount on Cyber Essentials certification costs, helping make essential cyber security protections more accessible.
The announcement comes at a time when cyber threats continue to dominate headlines. From software vulnerabilities and cloud service outages to ransomware and supply chain attacks, organisations across every sector are being reminded that a cyber attack can have consequences far beyond the IT department, affecting operations, customer trust and revenue.
For businesses here in Devon and the wider South West, the message is clear: cyber resilience has become a commercial necessity.
What has the Government announced?
The UK Government has introduced the Cyber Essentials First Step Fund to encourage greater adoption of Cyber Essentials, its government-backed cyber security certification scheme.
Eligible micro, small and medium-sized businesses in the UK can receive a 75% discount on assessment and certification costs, reducing the price to:
- Micro businesses (0-9 employees): £80 plus VAT
- Small businesses (10-49 employees): £110 plus VAT
- Medium businesses (50-249 employees): £125 plus VAT
To qualify, businesses must not have held Cyber Essentials certification within the past four years. Funding is available on a first come, first served basis until March 2027 or until funds run out.
The funding covers the assessment and certification where the assessment is passed. It does not guarantee certification or cover additional technical work that may be needed to meet the requirements.
Eligible businesses can check their criteria and apply through the IASME First Step Fund portal.
A separate Government initiative also offers fully funded certification and cyber security advice to selected SME suppliers within the supply chains of organisations signed up to the Cyber Resilience Pledge. Suppliers must be selected and notified through a Pledge signatory. Being part of a signatory’s supply chain does not automatically secure funding.
For further details, visit the official Government announcement.
What is Cyber Essentials?
Cyber Essentials is the UK’s official Government-backed cyber security certification scheme.
It focuses on five fundamental technical controls:
- Firewalls
- Secure configuration
- User access control
- Malware protection
- Security updates and patch management
These controls form the foundation of effective cyber security and help reduce exposure to common cyber threats.
One of the biggest misconceptions we encounter is that antivirus software alone provides sufficient protection. In reality, effective cyber security requires a much broader approach.
Our recent article, PHP Vulnerability Explained: What It Means for Business Cyber Security, explored how a single vulnerability can create significant risk when organisations are not proactively managing their security posture.
The fundamentals still matter. In fact, with AI helping attackers work faster and more efficiently, they matter more than ever.
Why should Devon businesses pay attention?
Many organisations still assume they are too small, too local or too niche to attract cyber criminals.
That simply isn’t true.
Whether you are an accountancy practice in Exeter, a construction company in Barnstaple, a property management company in Plymouth, a legal firm in Torquay or a manufacturing business supporting national supply chains, you almost certainly hold sensitive information that criminals could find valuable.
You may not consider yourself a technology company, but your organisation still relies on:
- Email systems
- Cloud applications
- Customer and employee data
- Financial systems
- Supplier portals
- Online collaboration tools
Any of these can become entry points for cyber criminals.
Phishing emails, ransomware, stolen passwords and compromised business data affect organisations across every industry. Businesses handling financial records, personal information and commercial contracts can be particularly attractive targets.
What does this mean for larger organisations?
Although the funding focuses on SMEs, larger businesses should take particular interest in one aspect of the announcement: supply chain security.
Many cyber incidents no longer begin with the primary target. Attackers increasingly exploit weaknesses within suppliers, contractors and third-party service providers.
Key Question: How confident are you that your suppliers meet the same cyber security standards you expect internally?
Many larger organisations already encourage suppliers to achieve Cyber Essentials certification as part of procurement and risk management requirements. The Government’s latest initiative could accelerate this trend.
Is Cyber Essentials certification worth it?
For many organisations, the answer is yes.
Benefits can include:
- Reduced exposure to common cyber attacks
- Increased trust from customers and partners
- Stronger supply chain credentials
- Eligibility for certain government contracts and tenders
- Potential cyber insurance benefits
- Reduced risk of costly downtime and data breaches
Historically, many businesses have struggled to see a clear return on investment from cyber security spending. It’s difficult to put a value on preventing a problem that may never happen.
Yet when systems go down, data is compromised or operations grind to a halt, the costs become very real, very quickly.
Key Question: Would your business be able to continue operating if your IT systems were compromised tomorrow?
Cyber Essentials provides a cost-effective way to reduce that risk and demonstrate that your organisation takes cyber security seriously before an incident occurs, not afterwards.
Going Beyond the Basics
Cyber Essentials establishes a strong foundation, but it should not be the end goal.
Our Vulnerability Scanning Service can help identify security gaps before beginning the certification process.
For organisations seeking independent verification, Cyber Essentials Plus provides additional assurance through externally validated testing.
Many businesses also combine certification with our wider Managed Cyber Security Services and Managed Security Operations Centre (MSOC), providing continuous monitoring, threat detection and incident response.
Related reading: What is a Managed SOC? | Nexus
Proven Results for South West Organisations
At Nexus Open Systems, we’ve helped organisations across a wide range of sectors strengthen their security posture and achieve Cyber Essentials certification.
You can read more about our work with Greendale Group, a Devon-based family business operating across farming, fishing, property and other sectors.
We carried out vulnerability scanning across Greendale Group’s IT environment, helping identify and address security risks as part of their Cyber Essentials certification journey.
As an award-winning, ISO 27001-accredited business with over 26 years’ experience and more than 1,000 successful customer engagements, we understand that cyber security is not about ticking boxes. It is about protecting your people, your reputation and your ability to operate.
Cyber Essentials Has Never Been More Essential
The Government’s latest funding announcement is a welcome step towards making cyber security more accessible for thousands of UK businesses.
With the Cyber Essentials First Step Fund now available, eligible organisations have an opportunity to reduce certification costs and strengthen their cyber resilience.
However, Cyber Essentials is the foundation, not the finish line. As cyber threats continue to evolve, organisations that invest in strong cyber security today will be better positioned to respond to tomorrow’s challenges.
To discuss whether your business is eligible for funding, how ready your systems are for assessment and what work may be needed to achieve certification, contact the Nexus team.