Cyber Security Minister Baroness Lloyd has put thousands of small and medium-sized businesses on a formal footing of cyber security obligations and support, announcing a discounted certification offer and a set of supply-chain commitments at the National Cyber Security Centre’s Annual Review. The Government frames cyber defence as a matter of policy backed by public funding rather than a burden left to individual firms.
At the centre of the package sits the Cyber Essentials certification programme, the state’s recommended minimum standard of cyber security for organisations of all sizes. Under the new Cyber Essentials First Step Fund, micro, small and medium-sized businesses that have not been certified in the last four years can claim a 75% discount on new certification. The discount, covered by £2.4m of Government funding, will operate on a first come, first served basis and remain available until March 2027 or until the money runs out. Officials estimate approximately 6,000 new businesses could benefit. With the discount applied, eligible firms could pay as little as £80 and no more than £125 plus VAT to be certified against the five technical controls, developed by NCSC experts, designed to prevent the most common internet-based threats. Organisations with a turnover of less than £20m that hold the certification also receive up to £25,000 of cyber liability insurance.
Meanwhile, the second pillar targets supply chains, where the Government is using its convening power to push standards downward through commercial relationships. More than 230 organisations have now signed the Cyber Resilience Pledge, a voluntary initiative under which participants commit to making cyber security a board-level responsibility, sign up to the NCSC Early Warning service, and take a risk-based approach to requiring Cyber Essentials across their supply chains. Under the associated Cyber Essentials for suppliers grant, worth up to £7m until March 2029, eligible UK-based SME suppliers of Pledge signatories will be offered fully Government-funded first-time certification along with tailored Cyber Advisor support. Signatory organisations will contact nominated suppliers and guide them through the application process, and the Government estimates around 8,000 businesses could benefit from this route. For select businesses with limited in-house cyber expertise, a free cyber security advisor will be available to support them through certification.
The minister argued the intervention reflects a deliberate choice about where responsibility lies. “Small and medium-sized businesses employ millions of people across our nation, and should not be left vulnerable in the age of rising cyber threats,” Liz Lloyd said. “We are not going to sit back and let malicious actors take advantage; we will back our SMEs and help them be protected and secure.” She added that the Government is making it easier and cheaper for firms to access expert cyber support, identify and plug vulnerabilities, and achieve certification, and that securing digital systems “must be a top priority” for businesses of any size.
The department’s economic case rests on cost estimates suggesting a significant cyber-attack on a UK business or organisation could cost on average £195,000. Officials note this figure draws on data from primarily US disclosures, given the lack of available UK-based cost data, and that the estimate for medium and large firms rests on a limited sample of 18 organisations and should be read as indicative only. The Government’s argument is that attack costs drain money from businesses and their employees, preventing reinvestment and growth.
Alongside the business-facing measures, the Government is extending its regulatory-style outreach to the software industry. Fourteen organisations are joining as the UK’s second cohort of Software Security Ambassadors: Fortinet, Thales, Cap Gemini, SANS, Risk Ledger, Zscaler, Acubed IT Solutions Ltd, CloudPeek, Dot On, Hippo Digital, Investec, IoT M2M Council, Nine23 and QinetiQ. They join an existing group that includes Accenture, Cisco, Lloyds Banking Group, NCC Group, Nexor, Palo Alto Networks, Sage, Santander and others. Ambassadors will work with Government to champion secure software development and encourage adoption of the Software Security Code of Practice, which sets out expectations for the security and resilience of software, across their supply chains and the wider economy.
The announcement also builds on measures set out in last week’s Budget, intended to strengthen the UK’s ability to defend itself as artificial intelligence transforms both the threat landscape and the tools available to counter it. Those include £70m for a new National Exposure and Real-Time Vulnerability Centre within the NCSC to build and maintain a national picture of vulnerabilities across critical national infrastructure and the wider economy; £60m for a national Cyber Shield using agentic AI, including a £25m Challenge Fund for UK AI and cyber security innovators; a new NCSC AI Cyber Security Centre of Excellence in Manchester to train the next generation of government cyber and AI experts; £40m for a National Agentic Security Unit to monitor and respond to uncontrolled bots; and £24m to enhance public-sector cyber defences.
Taken together, the certification discount, the supplier grant, the Pledge and the ambassador scheme form what the Government describes as a concerted drive to strengthen cyber resilience across the UK economy, with the state setting the standard, funding uptake and pressing both firms and their suppliers to comply. Businesses can begin the discounted certification process at firststep.iasme.co.uk, with the offer active from 3 November. Whether the first come, first served funding model reaches the 6,000 firms officials anticipate before the March 2027 deadline will be an early test of the scheme’s design.