Who can access the free advice?
The introductory programme has narrower conditions than the wider Cyber Advisor service.
Is every SME eligible?
IASME lists the following requirements:
* Fewer than 250 employees.
* Active consideration of Cyber Essentials certification.
* Willingness to discuss the organisation’s current security arrangements.
Its sign-up instructions also require applicants to confirm that their organisation has not previously held Cyber Essentials. Businesses seeking recertification should not assume this introductory offer applies.
Check the current application conditions before registering. The wider advisor scheme can help organisations improve controls even when they are not seeking certification, but that does not remove the free programme’s eligibility requirements.
Does free advice commit you to certification?
No. IASME describes the consultation as a no-obligation introduction, with no pressure to certify or purchase services.
Certification remains a separate process through a certification body. Further consultancy and implementation work may incur charges, and the NCSC sets no standard advisor price.
A sensible outcome could be a manageable improvement plan followed by certification later. For budget-conscious cyber security for small businesses, sequencing work correctly is more useful than rushing to buy a badge.
How should a business prepare for its 30 minutes?
A little preparation keeps the conversation focused on your operations rather than reconstructing your IT setup.
Five steps to make the session worthwhile
Describe the business impact. Explain which systems support sales, payroll, bookings or client work. Identify what would cause the greatest disruption if unavailable or compromised.
Bring a simple technology overview. List business devices, email services, important cloud applications and your IT provider. Include personal devices used for work, without sharing passwords or unnecessary sensitive information.
Identify ownership gaps. Note who manages updates, administrator accounts, security alerts and departing employees’ access. If responsibility is unclear, make that an explicit discussion point.
Ask for three priorities. Request high-impact actions, likely effort and whether existing services can deliver them. Separate immediate improvements from work requiring budget or specialist assistance.
Agree the next step. Assign each action to a named person and set a realistic deadline. Request a written scope and quotation for any follow-on services before granting system access.
For an accountancy practice, the first improvement might be individual administrator accounts rather than another software subscription. For a small manufacturer, it could be identifying unsupported office devices while separately assessing specialist production equipment.
What other free support can help?
The NCSC’s Cyber Action Toolkit provides a structured route through practical improvements. Its Early Warning service can notify organisations about potential malicious activity and vulnerabilities associated with registered assets.
These resources complement advice rather than replace implementation. Ask whether they fit your environment and who will act on any alerts. Free support delivers value when someone follows through.
FAQs
These questions address recurring concerns about consultancy costs, certification and existing IT support.
Is the Cyber Advisor consultation completely free?
The introductory consultation offered through IASME is free and lasts 30 minutes. It provides practical advice and guidance towards Cyber Essentials, without an obligation to buy services. Further consultancy, implementation and certification are separate activities. Confirm the scope and obtain a quotation before agreeing to any paid follow-on work.
Can I apply if my business has already held Cyber Essentials?
IASME’s current sign-up instructions require applicants to confirm that their organisation has not previously held Cyber Essentials. Businesses seeking renewal should therefore check eligibility rather than assume the free offer applies. The wider Cyber Advisor scheme remains available for practical support, with fees agreed directly with the provider.
Is a Cyber Advisor useful if I already have an IT provider?
Yes. An advisor can help assess gaps against Cyber Essentials controls and clarify responsibilities between your business and its IT provider. Existing support does not automatically cover every security requirement. Involve the provider where appropriate, and use the consultation to identify priorities rather than duplicate work already being delivered.
FAQ note: These FAQs are based on recurring live audience questions and discussion themes from Reddit and Quora, helping ensure each article answers what SME readers are actively asking in the real world.
Conclusion
A free consultation will not solve every security issue, but it can replace uncertainty with a practical starting point. Check eligibility, prepare a short systems overview and focus on actions your business can implement. Stronger SME cyber resilience begins with clear priorities and ownership.
Check the programme’s eligibility requirements and register for a free 30-minute Cyber Advisor consultation through IASME.
