When is Cyber Essentials required for public sector contracts?

If you've found Cyber Essentials in a public sector tender document, or framework application, and you don't have it, you're likely weighing up whether to spend the money before you bid for anything at all.

This article covers what the rules say, which contracts trigger the requirement, when basic certification is enough and when you'll be asked for Cyber Essentials Plus, what happens if you don't hold it, and the G-Cloud exception that surprises most suppliers.

The rule that governs it is PPN 014

Procurement Policy Notes are how the Cabinet Office tells public buyers what to build into their procurements. The one that matters here is PPN 014: Cyber essentials scheme, published on 17 February 2025 and applying to procurements commenced on or after 24 February 2025.

Two things are worth knowing straight away.

PPN 014 replaced both PPN 09/14, the original 2014 note, and PPN 09/23. If you're reading advice that cites either of those as the current rule, it's out of date. For procurements that commenced before 24 February 2025, PPN 09/23 still governs, which matters if you're working on a long-running call-off.

And it applies to a defined list: central government departments, their executive agencies, non-departmental public bodies, and NHS bodies. These are the "in-scope organisations". Other public sector bodies may choose to apply the same approach, and many do, but they aren't told to.

The four characteristics that trigger the requirement

PPN 014 tells in-scope organisations they must ensure suppliers meet certain technical requirements for contracts or services with any of these characteristics:

• Citizens' personal information is handled by the supplier. Home addresses, bank details, payment information.

• Personal information about government employees, ministers or special advisers is handled. Payroll, travel booking, expenses.

• ICT systems and services are supplied that are designed to store or process data at OFFICIAL under the Government Security Classifications Policy.

• The contract deals with information relating to the day-to-day business of government, service delivery and public finances, including criminal justice and enforcement, many aspects of defence, security and resilience, and commercial interests such as information provided in confidence, intellectual property and the contract itself.

Read that list again, because the common misreading is that this is an IT supplier rule. It isn't. PPN 014's own examples of contracts that meet the characteristics include CV writing services, car hire for staff and contact centre services. If you handle citizens' or civil servants' personal data to deliver the work, you're in scope whatever you sell.

When Cyber Essentials is not required

PPN 014 is explicit that the Cyber Essentials Scheme should not be applied to all contracts as a matter of course, and that in-scope organisations must not take a blanket approach. Controls have to be relevant and proportionate to what's being bought. The note tells buyers to take care only to require certification where it's relevant to the subject matter of the contract, proportionate and necessary, and warns them specifically not to over-burden suppliers or deter SMEs and VCSEs from bidding.

The note even gives examples of where it wouldn't apply: communications and marketing planning for a departmental product that doesn't need access to personal data, or driving instructor services for ten individuals delivered by a sole trader whose IT use is incidental to the work.

So, if you're looking at a tender where a Cyber Essentials requirement feels disproportionate to what's being asked for, that's a legitimate clarification question, not a complaint. Buyers are also required to record their decisions on cyber controls in the audit trail, including where they've assessed the risk as very low.

G-Cloud is the exception most suppliers get wrong

If you sell through G-Cloud, this one is worth knowing.

PPN 014 states that suppliers on the G-Cloud agreements are required to demonstrate compliance with the government's Cloud Security Principles. On Cyber Essentials, it says suppliers are encouraged to state whether they hold Cyber Essentials or Cyber Essentials Plus as part of their service offer, but that it is not a requirement of the commercial agreement for suppliers to hold the certification.

Then it adds the sentence that actually matters: when awarding call-off contracts via G-Cloud, buyers should assure themselves that suppliers are managing relevant cyber risks effectively before making an award.

In other words, Cyber Essentials won't stop you getting listed on G-Cloud. It may well decide whether a buyer picks your listing over the one next to it. Getting onto a framework and getting bought from it are two different problems, and this is one of the places the gap shows.

If your G-Cloud listings aren't generating the enquiries you expected, the cause is usually a handful of things buyers scan for and don't find. Our G-Cloud Buyability™ Reviews look at your listings the way a buyer searching the Digital Marketplace does.

Cyber Essentials or Cyber Essentials Plus?

Both assess the same five technical controls: boundary firewalls and internet gateways, secure configuration, access control, malware protection and security update management.

Cyber Essentials is a self-assessment. You complete a questionnaire, and an independent certification body verifies it and awards the certificate. PPN 014 describes this as a basic level of assurance.

Cyber Essentials Plus covers the same controls but adds remote and on-site vulnerability testing, checking that the controls you've described are genuinely in place. The verified self-assessment is a prerequisite, so you can't go straight to Plus. PPN 014 says Plus should be used where there's a higher risk of cyber security threat, and in practice individual buyers specify it freely for data-heavy or network-access work.

What happens if you don't hold it

You aren't automatically out. Under section 56 of the Procurement Act 2023, which deals with technical specifications, buyers must accept equivalents. PPN 014 confirms this: a supplier that doesn't hold Cyber Essentials or Cyber Essentials Plus must be able to demonstrate that equivalent controls are in place through other means, normally verified by a technically competent and independent third party. For Cyber Essentials Plus equivalence, that independent verification is required in all cases.

Arguing equivalence is a bit like proving your identity without a passport. It's allowed, people do it, and it takes a bundle of documents and someone on the other side of the desk willing to work through them. Holding the certificate is the version where you just hand over the passport.

One specific trap: ISO 27001 does not automatically get you there. PPN 014 states that organisations holding ISO 27001 will not automatically conform to Cyber Essentials, because it isn't usual for all five Cyber Essentials controls to fall within an ISO 27001 scope, and unlikely that they'll have been tested. Most businesses with ISO 27001 will need Cyber Essentials as well, or will have to demonstrate equivalence.

Scope is where suppliers come unstuck

By default, Cyber Essentials applies to the legal entity providing the goods or services, not the wider corporate group. You can restrict the scope to part of the legal entity, and plenty of organisations do to keep the assessment manageable.

The catch is that buyers are advised to check the scope of your certificate. A narrowly scoped certificate can be entirely valid and still fail to cover the part of your business that would deliver the contract. PPN 014 also points out that your certificate doesn't assure the security of third parties you share data with, such as your cloud provider.

Before you put a certificate number into a bid, check that what it covers matches what you're proposing to deliver. That mismatch is an easy one to spot from the evaluator's side.

When you need to have your certificate available to present

The timing rules are clearer than most suppliers realise:

• Any Cyber Essentials requirement must be specified in the tender notice for a competitive tendering procedure, and buyers are encouraged to flag it in earlier notices, so suppliers have the longest possible time to certify.

• Evidence is required before contract award. Not at bid submission necessarily, but before award.

• It is essential at the point data is passed to you, with no flexibility on that.

• It must be renewed annually for the duration of the contract.

There's a narrow exception. In exceptional circumstances a buyer may take a risk-based decision to let a contract start where certification has expired and is being renewed, but you still have to hold valid certification by the time data changes hands.

What it costs and how long it takes

Pricing is based on the number of employees. As at October 2026 the typical published rates for Cyber Essentials are:

Cyber Essentials Plus is quoted separately based on the size and complexity of your network.

On timing, you get six months to complete the assessment once you've bought it, an assessor reviews your submission, and the certificate is valid for twelve months. The certificate itself is quick. Getting the controls genuinely in place beforehand is the part that takes real time, and it's the part suppliers underestimate when a deadline is three weeks away.

Where can I get a Cyber Essentials certificate?

While there are many providers offering Cyber Essentials certification, we recommend Pera Prometheus which specialises in supporting the defence industry.

• With some providers you get allocated to a random pool assessor with very little or no chance to contact them. With Pera, you can contact the assessor directly should you need additional clarification on any feedback given, adding the human touch to every assessment so you are not just treated like a number.

• Some suppliers have a 'Two strike' policy whereby if you are not fully compliant after two attempts at submitting then you automatically fail and need to start/pay for the process again. With Pera, your submission is not processed until we are confident you will pass. They will work with you to ensure the requirements are clear and that you have every opportunity to pass (although passes are not guaranteed).

Where the requirement goes further

Defence. MOD contracts operate under their own regime. The Cyber Security Model assigns a Cyber Risk Profile to each requirement, Def Stan 05-138 sets the controls, and DEFCON 658 makes them contractual. The MOD has also asked all industry partners to hold Defence Cyber Certification Level 0 by 31 December 2026, which has Cyber Essentials as a prerequisite. If defence is on your roadmap, read our guide to DCC Level 0 and what MOD suppliers need.

NHS. NHS bodies are in-scope organisations under PPN 014, so the same rules apply to their contracts. The Data Security and Protection Toolkit is a separate requirement. NHS guidance is clear that Cyber Essentials Plus is not required in order to complete the DSPT, although holding it means you don't have to answer some of the questions. Treat claims that Plus is universally mandatory across the NHS with caution and check the specific contract.

Large outsourcing contracts. The government's Model Services Contract, used for complex services contracts typically above £20 million, requires in its Security Management schedule that the supplier and relevant subcontractors hold Cyber Essentials or Cyber Essentials Plus, or equivalent.

Local government. Councils are not in-scope organisations under PPN 014. Many apply the same approach anyway, and plenty of local authority IT tenders ask for Plus. There is no universal mandate, so the tender documents are the only reliable answer.

What suppliers should do now

1. Work out whether your typical contracts meet the four characteristics. If you handle personal data of citizens or civil servants to deliver your service, assume you'll be asked eventually.

2. Check whether you already hold it, and what it covers. A valid certificate with the wrong scope is a problem waiting to surface at evaluation.

3. Don't wait for a tender to force it. Specifying it in the notice gives you the lead time in theory. In practice you'll be reading the notice a fortnight after it published.

4. Diarise the renewal. Annual recertification is a condition for the duration of the contract, and a lapsed certificate mid-delivery is a contract management problem, not an admin one.

5. If you're relying on equivalence, get it independently verified before you bid. Writing "we have equivalent controls" into a response without third-party verification rarely survives due diligence.

6. If a requirement looks disproportionate, ask. PPN 014 tells buyers not to apply it as a matter of course, and clarification questions are free.

Most suppliers who come to us have everything they need and lose marks on how they've evidenced it. Across listings submitted in the last two years we've averaged a 96% Quality Score, and the difference is almost always precision rather than substance. If you've got a live tender with cyber security requirements, you're unsure how to answer, our bid review services can look at it before you submit.