We link to the original sources below. Sections labelled “Sandycroft analysis” contain our interpretation and practical suggestions. Product and service links are commercial suggestions from Sandycroft, separate from the source reporting.
SOURCED NEWS SUMMARY
The news
The Department for Digital, Culture, Media and Sport announced on 3 November that the Cyber Essentials First Step Fund will give eligible UK micro, small and medium-sized businesses a 75% discount on a new Cyber Essentials certification. The Government says the resulting price will be between £80 and £125 plus VAT, depending on organisation size.
The £2.4 million fund is first come, first served and is expected to support about 6,000 businesses. Eligibility is limited to micro, small and medium-sized UK businesses that have not been Cyber Essentials certified in the last four years. The offer is available until March 2027 or until the allocated funding runs out. The official application route is firststep.iasme.co.uk.
SANDYCROFT ANALYSIS
Do not confuse the two offers
A separate Cyber Essentials for Suppliers grant is intended for eligible UK SME suppliers nominated by organisations that have signed the Cyber Resilience Pledge. That route can provide fully funded first-time certification and tailored Cyber Advisor support. Suppliers will be contacted by the pledge-signatory organisation and guided through the process; the announcement does not say that every SME can self-nominate for the fully funded route.
The 75% First Step discount is for a new basic Cyber Essentials certification. It should not be described as free certification, Cyber Essentials Plus testing, unlimited consultancy or payment for any hardware, software or remediation that may be needed. Read the live offer terms before paying because funding availability can change.
SANDYCROFT ANALYSIS
Map the assessment scope before starting
List the organisation’s laptops, desktops, phones, tablets, servers, routers, cloud services, business email, remote access and user accounts. Include devices used for website administration, customer artwork, embroidery files, print queues, order CSVs and supplier portals. Confirm which legal entity and systems the certification will cover so the answer set matches the real operating environment.
Cyber Essentials is aligned to five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Use the official readiness materials to identify unsupported software, default settings, unnecessary administrator rights, missing updates and unmanaged devices before beginning the verified self-assessment.
SANDYCROFT ANALYSIS
Protect the order and artwork workflow
For a workwear, embroidery or printing business, separate shared production needs from uncontrolled access. Give each worker their own account where practical, remove access promptly when roles change and limit administrator privileges. Protect email and cloud accounts with strong authentication, keep operating systems and applications supported, and document who is responsible for updates on production and office devices.
Review how customer logos, photos, address data and order exports move between email, cloud storage, control systems and printing workstations. Cyber Essentials does not replace backups, privacy compliance, staff training or an incident plan. Keep those controls alongside the certification work so passing an assessment is not mistaken for complete protection.
SANDYCROFT ANALYSIS
Apply with an evidence file
Keep the eligibility check, organisation size, system scope, device list, account review, update evidence and any corrective actions in one file. Use the IASME readiness tool and current question set, and take the free support that is actually included. If a technical answer is unclear, obtain qualified advice rather than guessing.
Certification can support customer confidence and some supply-chain requirements, but it should be represented accurately. Record the certification date, covered organisation and renewal date, and never imply that an unrelated website, client or supplier is certified.
CHECK THE ORIGINAL REPORTING
Sources & dates
- GOV.UK — New Government-backed cyber security protections could save UK businesses thousands Published 3 November 2026
- GOV.UK — Cyber Essentials scheme: overview Published 13 March 2026