Free cybersecurity help in the UK and France: Cyber Essentials, NCSC, 17Cyber, MonAideCyber

You can get a surprising amount of free cyber security help as a small-team business, and almost all of it comes from public bodies: guides written for teams without an IT department, a self-assessment tool, practice exercises, threat alerts, a free diagnostic in France and someone to call while an attack is under way. What you pay for is certification and the hands-on repair work.

This guide lists what is free in the UK, where most of it comes from the National Cyber Security Centre (NCSC), explains why Cyber Essentials is not on that list, and sums up the French services (17Cyber, Cybermalveillance.gouv.fr and MonAideCyber) for teams working on both sides of the Channel. Everything was checked on 19 October 2026. It is part of my cybersecurity guide for small teams.

When a client calls me with a problem, part of my job is telling them honestly whether they need me or someone else. For much of what follows, that someone else is a free public service.

What free cyber security help covers, and what it doesn’t

Public help comes in four kinds, and knowing which one you need saves an afternoon of clicking around government websites.

• Guidance: what to do, in plain language, written for organisations without IT staff.
• Tools and practice: a self-assessment that turns the guidance into a to-do list, and exercises to rehearse an incident with your team.
• A person who looks at your set-up: in France, MonAideCyber pairs you with a trained volunteer for a free diagnostic; in the UK, the closest equivalent was funded Cyber Essentials support, which the NCSC said in 2025 was in its final year.
• Help during an attack: somewhere to report the crime and get advice, at any hour.

None of them fixes your systems, certifies you, gives legal advice or insures you: those parts are paid, and I come back to them at the end.

The UK: what the NCSC and the police give you for free

Most of the free help comes from the NCSC, which is part of GCHQ, and none of it comes with a sales call.

The guide and the Cyber Action Toolkit

The guide for small organisations is the April 2026 edition of what used to be the NCSC’s Small Business Guide, and the old address still leads to it. Read it first: it is written for people who do not work in IT.

If you would rather work from a checklist, the Cyber Action Toolkit breaks the same advice into small steps tailored to your organisation. It points you towards Cyber Essentials, so nothing you do there is wasted if a client later asks for the certificate.

Exercise in a Box and Early Warning

Exercise in a Box gives you realistic incident scenarios to rehearse with your team. Run one as a round-table discussion with the people who would be on the phone during a real incident: you find out who has the admin passwords, who calls the bank and who talks to clients before it matters.

Early Warning is open to any UK organisation with a domain name or a fixed IP address, so a team with its own website or email domain qualifies. You sign up through a MyNCSC account and register your domains and IP addresses; the service then sends threat alerts daily and vulnerability alerts weekly to the contacts you nominate.

Report Fraud, the 24/7 line and Cyber Resilience Centres

Report Fraud replaced Action Fraud on 4 December 2025. It takes reports of fraud and cyber crime from individuals and businesses in England, Wales and Northern Ireland, online or on 0300 123 2040; in Scotland, call Police Scotland on 101. If an attack is still in progress, call the same number at any hour: it is also the 24/7 line for organisations under attack. For a significant attack, start by reporting it to the NCSC.

You may also have a regional Cyber Resilience Centre nearby. These police-led, not-for-profit centres have offered small organisations free core membership, with guidance, threat updates and a named contact. The terms differ from one centre to the next and I found no 2026 update, so check the one for your area before counting on it.

Cyber Essentials is not free: what it costs and what you get

Cyber Essentials is the government-backed certification, run by the NCSC with its delivery partner IASME. It checks five controls: firewalls, secure configuration, security update management, user access control and malware protection. You answer a self-assessment, a director signs it off and an independent assessor marks it.

The certificate itself is paid. At the time of writing (October 2026), IASME charges £320 plus VAT (about $425) for an organisation with up to nine employees and £440 plus VAT (about $585) for 10 to 49. Cyber Essentials Plus, the audited version, is quoted by the certification body. The NCSC’s Cyber Essentials page has the current requirements and fees.

What is free around it:

• The preparation. The requirements, the NCSC’s guidance and the Cyber Essentials Readiness Tool (built by IASME for the NCSC, it turns your answers into an action plan) cost nothing, and the Cyber Action Toolkit leads into the same five controls.
• Insurance. Organisations based in the UK or the Crown Dependencies, with a turnover under £20 million, that certify their whole organisation can opt in to cyber liability insurance arranged by IASME, with £25,000 of cover (about $33,000), at no extra cost. My guide to cyber insurance explains what a policy covers and where a free one stops.
• Funded support, probably over. The NCSC’s Funded Cyber Essentials Programme paid for about 20 hours of an assessor’s help for eligible micro and small organisations, such as legal-aid firms and some small charities. The NCSC’s 2025 annual review described it as being in its third and final year, so check IASME’s website before you count on it.

Pay for the certificate when a client asks for it or when you want the insurance. The NCSC encourages large organisations to set Cyber Essentials as a minimum for some suppliers, so the question often arrives inside a security questionnaire, and EU clients covered by NIS2 must also manage the security of their supply chain (Article 21 of the directive). If nobody has asked yet, spend the first month on the free tools: they work towards the same controls, and the certificate can follow when someone needs to see it.

France: 17Cyber, Cybermalveillance.gouv.fr and MonAideCyber

If you have staff or an office in France, the French state’s free help is more hands-on than the UK’s: it includes a diagnostic with a person and regional teams that respond to incidents.

If you run a French office from the UK, save the 17Cyber address next to the UK numbers, so whoever is on site in France knows where to start.

Where to start: a free plan for a small team

1. Today: save the numbers. Put your bank’s fraud line and 0300 123 2040 in your phone, plus 17cyber.gouv.fr if you have a French office. My first-hour plan after a cyber attack explains what to do with them.
2. This week: read the NCSC guide or start the Cyber Action Toolkit. The first actions take minutes each: two-factor authentication on email and banking, backups that run on their own, updates on every laptop and phone (my guide to device security basics has the checklist).
3. This month: sign up for Early Warning and register your domain names, so the NCSC can warn you about threats it sees against them.
4. This quarter: run one Exercise in a Box scenario with the people who would handle an incident, then fix the gaps it shows.
5. When a client asks for proof, certify with Cyber Essentials and reuse the same evidence in their questionnaire.
6. For a French office, request a MonAideCyber diagnostic and put the six measures in the diary.

What free help won’t do, and when to pay someone

Public services advise, diagnose, alert and refer. None of them will sign in to your systems to clean them, rebuild a hacked website or fill in a client’s questionnaire for you.

Pay for hands-on help when:

• ransomware has reached several computers, or an attacker still controls a mailbox or an admin account;
• your website has been hacked and you cannot get back in;
• a client contract asks you to prove more than Cyber Essentials covers.

In the UK, companies assured under the NCSC’s Cyber Incident Response scheme handle serious incidents, and its Standard level covers most of them; in France, look for a provider labelled ExpertCyber, and 17Cyber can point you to one. If you have cyber insurance, call its helpline first, as the insurer may want its own responders.

This article is not legal advice: for a contract clause, a personal data breach or the question of whether NIS2 applies to you, a lawyer or a data protection officer is worth paying for.

Hacked websites and lost access are the IT rescue work I do, with a response the same day or within 24 hours. For the rest, start with the free services above: I would rather send you there than sell you something you can get for nothing.