The new cyber support offer needs a clear purpose in care

The Cyber Essentials First Step Fund offers eligible SMEs a 75% discount on a new certificate. It runs until the end of March 2027 or until funding runs out. The government directs applicants to IASME, its delivery partner, including where they use a Certification Body. ^[1]

The launch notice adds that this is first-come, first-served support for eligible UK micro, small and medium-sized businesses that have not been certified in the previous four years. Check the organisation’s details, certification history and current application conditions through the linked IASME route before relying on the discount. ^[2]

The separate Cyber Resilience Pledge grant supports eligible SME suppliers nominated through participating signatories. Selected suppliers can receive a free Cyber Essentials voucher and tailored support from an NCSC-assured Cyber Advisor. That scheme runs until the end of March 2029. Assessment funding leads to certification only where the assessment is passed. ^[1]

For an owner reviewing the budget, the distinction matters. A provider should establish which route is available to its legal organisation, rather than assume that supplying care makes it eligible for either offer. Keep the eligibility answer with the proposed cost and the work still to be funded. An advertised discount should help the decision become clearer.

Cyber Essentials addresses five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. NCSC describes a verified self-assessment route, with answers signed off by a board member or equivalent and marked by an assessor. Cyber Essentials Plus adds independent technical testing of the same controls. ^[3]

The certificate’s scope therefore belongs in the discussion. Which organisation, locations, equipment and services does the assessment cover? Ask the responsible technical team to explain the boundary in language managers can use. Neither the name of a familiar product nor a certificate displayed by another organisation answers the provider’s own implementation questions.

Digital Care Hub describes the DSPT as the official care-sector self-assessment for adult social care providers in England, completed at least annually. It provides a distinct route for examining how people’s information is protected, with care-specific guidance and Better Security, Better Care support. Cyber Essentials funding does not replace that process. ^[4]

Keep the relevant NHS-data access, commissioning and regulatory requirements visible rather than inferring them from an SME funding offer. Establish the obligations that apply to the provider and identify where the same evidence can support more than one review. Reusing sound evidence can reduce duplication without pretending the schemes ask identical questions.

IASME makes the assessment questions available before purchase. Its guidance distinguishes the basic verified self-assessment from the additional technical testing in Cyber Essentials Plus. It also states that certificates expire after 12 months. Preparation and continuing management therefore deserve a place in the plan alongside the initial assessment fee. ^[5]

Begin with the gap the provider needs to resolve. That might be an incomplete device record, uncertainty about who manages updates or access that no longer matches staff roles. Ask existing support teams what they can establish and which changes they can carry out. A defined question produces a more useful commission than a broad request to get the organisation certified.

Bring the resource consequences into the same conversation. Who gathers the information, authorises a change, communicates with staff and checks the result? Ask whether equipment, software, configuration work or staff training carries an additional cost. Record what the proposed support includes and where the provider will need another source of expertise.

Implementation also needs a workable timetable. Technical changes should be coordinated with the people responsible for care delivery, including any approved continuity arrangements. Agree how difficulties will be escalated and who can decide whether work proceeds. The manager should understand the service consequence without being expected to make a technical judgement outside their competence.

Choose an important working function and use it to examine the proposed improvement. For homecare, that may involve the coordinator and workers accessing visit information. In a care home, it may involve the authorised records used through a shift. These are examples for local review, rather than an instruction to change care procedures or copy sensitive information into a general project file.

Ask what the work established, what changed and how the provider checked it. A clearer account of devices, permissions or update responsibilities can be valuable even before a financial benefit can be measured. Keep unresolved exceptions with a named owner and review date. The record should distinguish a completed technical action from an assumption that the whole service is now protected.

Then return to the original purpose. Can staff use the approved arrangement? Does the manager know who provides support? Can the owner explain the remaining work and its resource implications? Care professionals remain responsible for care decisions and approved continuity procedures. A certification result cannot, by itself, establish clinical safety or demonstrate that every disruption has been rehearsed.

The positive outcome is a provider that understands its options and can put available support to a specific use. Confirm eligibility, agree the scope, resource the implementation and review the evidence afterwards. The funding opportunity earns its place when it helps make that improvement possible and leaves the provider better able to manage the service it relies on.