Cyber Essentials Discount Cuts Certification to as Little as £80 for 6,000 Small Firms

The government is backing a new cyber essentials discount worth 75%, aimed at helping around 6,000 small and micro businesses get certified against the most common online attacks. The scheme is funded with £2.4 million and was announced on 3 November after a run of high-profile hacks.

What the cyber essentials discount offers

Cyber Essentials was developed by the National Cyber Security Centre. The government describes it as the minimum security standard it recommends, and it is designed to help organisations of any size guard against the most widespread internet-based attacks. Under the new funding, small and medium-sized enterprises (SMEs) and micro businesses can obtain the certification for between £80 and £125, plus VAT.

Those figures imply a standard price of roughly £320 to £500 before the reduction, though the sources do not state this directly. Spread across the expected 6,000 firms, the £2.4 million works out at about £400 of public money per business.

Who qualifies, and for how long

The offer is not open-ended. It runs on a first come, first served basis and is limited to businesses that have not been certified in the past four years. It will be available until March, or until the ring-fenced money runs out, whichever comes first. With funding for a finite number of firms, owners who want to take part may be better off applying early than waiting for the deadline.

Why the government is acting now

Cyber security minister Liz Lloyd said SMEs are “particularly vulnerable in the age of rising cyber threats”. She added: “We are not going to sit back and let malicious actors take advantage – we will back our SMEs and make them match-fit.”

The announcement follows several widely reported incidents. Last week, according to the exchange itself, around $6.3 billion (£4.7 billion) was stolen from Binance wallets, which it described as the largest cryptocurrency theft in history. Blockchain intelligence firms and other organisations have accused a North Korean hacking unit of carrying out the attack. Those are accusations rather than established findings.

In October, fashion marketplace Asos said an “unauthorised party” had accessed an employee’s account. Customers received a phone alert saying the retailer had been hacked, and Asos said the attacker obtained some personal data, including customers’ names and contact details. Last year, a cyber attack on Jaguar Land Rover forced the carmaker to halt production at its factories for several weeks, which weighed heavily on its sales and overall financial performance.

A big problem and a modest fix

The incidents named in the announcement involve a global crypto exchange, a well-known retailer and a major manufacturer. They are far larger than the typical small business. The reasoning appears to be that if even large organisations can be breached, smaller firms with fewer resources face real risk too. The Jaguar Land Rover episode shows how one successful attack can disrupt operations for weeks.

The basic certification is no guarantee against sophisticated, state-linked attackers. Its stated purpose is narrower: to help firms defend against the most common internet-based attacks. By lowering the cost, the government is betting that more small firms will cross that basic threshold. The cyber essentials discount will only matter, though, if owners hear about it and apply before the funding or the March cut-off runs out.

Explore more on this topic with Vexel Search.