In short: The Funded Cyber Essentials Programme was an NCSC scheme, delivered by IASME from December 2022, that gave eligible micro and small organisations in at-risk sectors around 20 hours of free expert help to reach Cyber Essentials. In October 2026 it was not accepting applications. Free tools, guidance and an included insurance offer remain available.
What the funded programme was
The Funded Cyber Essentials Programme was launched by the NCSC in December 2022 and delivered through IASME. It was aimed at micro and small organisations in sectors that hold sensitive data or support vulnerable people, where access to specialist cyber security help is often limited.
Organisations that qualified were matched with a Cyber Essentials assessor who provided around 20 hours of remote, hands-on support to put the five technical controls in place and work through the certification. The programme covered the expert support; it did not pay for new hardware or software, so organisations still had to fund any devices or licences needed to meet the requirements.
Who it was for
Eligibility changed across the programme's rounds, and each round had its own criteria. Over its life it focused on micro and small organisations in sectors such as:
- Small charities that process personal data
- Legal aid providers
- Domestic abuse charities, added in a later round
- Emerging technology businesses, such as artificial intelligence, semiconductors and advanced robotics, the focus of the third year
- Barristers, added in February 2025
If you were helped in an earlier round, your certificate still needs renewing every 12 months to stay current. See Cyber Essentials renewal.
Where it stands in October 2026
The NCSC Annual Review 2025 described the programme's third year as its "third and final year". When we checked in October 2026 we found no open round and no announced successor programme.
We will not guess at future eligibility. If you are hoping for funded support, check the IASME and NCSC websites for any new announcement. In the meantime, the free resources below cover a lot of the same ground, and IASME's fixed self-assessment fee is at its lowest for micro organisations. See what Cyber Essentials costs.
Be cautious with offers of "free" or "government-funded" Cyber Essentials that you cannot trace back to IASME or the NCSC. Only IASME-licensed Certification Bodies issue certificates, and you can check any certificate in IASME's certificate search. A commercial offer described as free usually covers advice rather than the assessment fee, so ask exactly what is included.
Free help you can use today
| Resource | From | What it gives you |
|---|---|---|
| Question set booklet | IASME | The full current question set as a free download, so you can read every question before paying |
| Cyber Essentials Readiness Tool | IASME | A guided questionnaire at getreadyforcyberessentials.iasme.co.uk that produces a personalised action plan |
| Cyber Essentials Knowledge Hub | IASME | Guidance and explanations of the requirements and questions |
| Cyber Action Toolkit | NCSC | A free NCSC tool for sole traders and small organisations new to cyber security, which breaks protection down into simple steps and tracks your progress |
| Free Cyber Advisor consultation | NCSC Cyber Advisor scheme, booked through IASME | A free, no-obligation 30-minute consultation for small and medium-sized organisations with an NCSC-assured Cyber Advisor, focused on the Cyber Essentials controls |
| Included cyber insurance | IASME | Cyber liability insurance with 24/7 incident response for eligible organisations that certify their whole organisation |
Our own Cyber Essentials checklist and question set guide are free too. To understand the Cyber Advisor scheme, see the NCSC Cyber Advisor scheme explained.
Other ways to keep the cost down
- Use the self-led route through IASME if you are confident you meet every control; the fee is fixed and banded by size.
- Switch on what you already have. Microsoft 365 and Google Workspace include MFA, and many Microsoft 365 plans include device management and anti-malware features that are often left off.
- Prioritise the automatic fails: MFA on every cloud service, 14-day updates and removing unsupported software such as unenrolled Windows 10 devices.
- Plan device replacements into normal budgets rather than rushing them before an assessment.
Sector guides for small businesses, charities and law firms cover the gaps we see most in organisations that used to qualify for funding.
How we help small organisations
We work with small teams that have no in-house IT. A short gap analysis tells you exactly what needs to change, we help you make the changes in the most economical way, and we support you through assessment alongside an IASME-licensed Certification Body. For training, our sister site covers security awareness training for small businesses.
Pricing depends on your size and starting point, so ask us for a quote. Contact us to talk it through.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is the Funded Cyber Essentials Programme still open?
Not as far as we could find in October 2026. The NCSC Annual Review 2025 described its third year as the final one, and we found no open round or announced successor. Check the IASME and NCSC websites for any future round.
Can I get Cyber Essentials for free?
The assessment itself carries a fee, which IASME bands by organisation size. Free help is available to prepare, including IASME's question set booklet and Readiness Tool, the NCSC Cyber Action Toolkit and a free consultation with a Cyber Advisor for small and medium-sized organisations.
Who was eligible for funded Cyber Essentials?
Eligibility changed between rounds. Over the life of the programme it supported micro and small organisations in at-risk sectors, including small charities, legal aid providers, domestic abuse charities, emerging technology firms and barristers.
Did the funded programme pay for new hardware or software?
No. It provided around 20 hours of expert support from an assessor. Any new devices, software or licences needed to meet the controls had to be paid for by the organisation.
What is the Cyber Essentials Readiness Tool?
It is a free online questionnaire from IASME that asks about your IT and produces a personalised action plan showing what to fix before you apply for Cyber Essentials.