Cyber Essentials is a government-backed scheme that certifies an organisation has five basic technical security controls in place. Public buyers ask for it more and more, especially for IT, data, research and any work that handles personal information. If you're a small firm thinking about public contracts, it's often the first certificate worth getting.
What it is
Cyber Essentials checks five technical areas: boundary firewalls and internet gateways, secure configuration, access control, malware protection and security update management. It's a self-assessment: you complete a questionnaire, and an independent certification body (accredited through IASME, the scheme's delivery partner) verifies it before certifying you. It gives a basic level of assurance.
Cyber Essentials Plus covers the same controls but adds remote and on-site vulnerability testing, which checks that your controls really stop basic hacking and phishing attacks. It's the more rigorous option, used where the risk is higher.
GOV.UK's overview says the scheme suits organisations of any size, and that Cyber Essentials comes with free cyber insurance for businesses with a turnover under £20 million. Holding a current certificate lets you bid for government contracts that involve handling financial or personal data.
When buyers must ask for it
Procurement Policy Note 014 (February 2025, which replaced PPN 09/23 for procurements under the Procurement Act) applies to central government departments, their executive agencies, non-departmental public bodies and NHS bodies. It tells them to require Cyber Essentials or Cyber Essentials Plus (or proof of equivalent controls) for contracts that:
- involve the supplier handling citizens' personal information, such as addresses or bank details;
- involve personal information of government staff, ministers or special advisers (payroll, travel or expenses, for example);
- supply ICT systems and services designed to store or process data at the OFFICIAL level; or
- deal with information related to the day-to-day business of government, service delivery and public finances.
The PPN's own examples include CV-writing services that hold citizens' personal data and contact centre services. Where certification is required, the supplier must renew it every year for the life of the contract, and evidence of the certificate is essential at the point data is passed to the supplier.
Councils and other bodies outside the PPN often follow the same approach. If a notice asks for Cyber Essentials, Bidlark lists it in the card's checklist and the verdict says whether you hold it.
When it shouldn't be asked for
The PPN is clear that Cyber Essentials shouldn't be applied to every contract as a matter of course, and that buyers must not take a blanket approach: requirements must be relevant and proportionate, so as not to deter SMEs and VCSEs from bidding. Its examples of contracts where the scheme wouldn't be relevant include communications and marketing planning that needs no access to personal data, and driving instruction by a sole trader whose use of IT is incidental. If a requirement looks out of proportion, the clarification question stage is the place to ask about it politely.
How long it takes, and timing a bid
Because Cyber Essentials is a questionnaire verified by a certification body, a small, tidy setup can often be certified within a few weeks; Plus takes longer because of the testing. The PPN encourages buyers to flag Cyber Essentials requirements in the notice so bidders have "the longest possible time to seek certification". That's why Bidlark treats a missing Cyber Essentials certificate as "A stretch" when there's time before the deadline, and tells you when time looks short.
For a one or two person firm
- Check the five controls against your laptops, phones, router and cloud accounts before you apply. The free readiness toolkit linked from the NCSC pages helps.
- If you use a managed service or cloud tools, note which of them you control; the assessment covers the devices and services your business uses.
- Put the renewal date in your diary: a lapsed certificate can stop a contract mid-way.
- Add the certificate to your Bidlark profile once you have it, so every verdict counts it.