Partner services
Cyber Essentials and Cyber Essentials Plus for public sector suppliers
Cyber Essentials is now a condition of entry for many public sector contracts and frameworks, including every lot of G-Cloud 15. Without a valid certificate, you can't be awarded the work. We introduce you to a trusted partner with public sector experience, and make sure the level you achieve matches the contracts you're going for.
Rated 5.0 on GoogleAt a glance
Certifications covered
- Cyber Essentials
- Cyber Essentials Plus
- Renewal
- Every year, so your certificate stays valid for the life of your framework and contracts
- Delivered by
- A trusted partner with public sector experience, introduced and co-ordinated by Advice Cloud
Why it matters
Why public sector buyers ask for Cyber Essentials
Cyber Essentials is the UK government-backed scheme that shows you've put basic protection in place against the most common internet attacks. For buyers, it's a quick, comparable check that a supplier won't be the weak link in their supply chain.
Procurement Policy Note 014 (PPN 014) tells central government departments, their agencies, non-departmental public bodies and NHS bodies to require Cyber Essentials or Cyber Essentials Plus, or equivalent controls, before awarding contracts that carry cyber risk, such as those handling personal data or providing ICT services.
- Stay eligible for award on contracts and framework lots that require it
- A recognised answer to security questions, rather than a description of your controls
- The foundation for defence work, because every level of Defence Cyber Certification starts with it
Where it's required
Frameworks that ask for Cyber Essentials
Requirements are set lot by lot and change between iterations. These examples were checked on 13th November 2026.
G-Cloud 15 (RM1557.15)
Lots 1a and 1b require Cyber Essentials Plus, validated by GCA. Lots 2a, 2b and 3 require Cyber Essentials for you and for any subcontractor processing personal or OFFICIAL data, validated within 12 months of award. Suppliers without a valid certificate are suspended until they provide one.
Public Sector Software Solutions (RM6396)
At GCA's March 2026 market engagement, Cyber Essentials was expected across all lots, alongside several ISO standards. Treat this as provisional until GCA publishes the tender documents.
Digital Outcomes and Specialists 7 (RM1043.9)
DOS 7 includes a Cyber Essentials schedule that a buyer applies when their order form requires Cyber Essentials or Cyber Essentials Plus. If your buyers handle sensitive data, expect them to ask.
The requirements
Cyber Essentials or Cyber Essentials Plus?
Both levels check the same five technical controls. The difference is how they're checked, and that's what buyers are paying attention to.
| Cyber Essentials | Cyber Essentials Plus | |
|---|---|---|
| How it's assessed | A self-assessment questionnaire, signed off by a director and marked by a certification body | The same questionnaire, plus a hands-on technical audit of your systems |
| What it shows a buyer | You've declared the five controls are in place | An independent assessor has tested that they work |
| When it's needed | Most in-scope government contracts, G-Cloud 15 Lots 2a, 2b and 3, and Defence Cyber Certification Levels 0 and 1 | Higher-risk contracts, G-Cloud 15 Lots 1a and 1b, and Defence Cyber Certification Levels 2 and 3 |
| Order | Comes first | Builds on a current Cyber Essentials certificate, so you complete both |
| Renewal | Every year | Every year |
The five controls
- Firewalls
- Secure configuration
- Security update management
- User access control
- Malware protection
The question set changed in April 2026 and is stricter on cloud services, multi-factor authentication and patching. If you certified under the old rules, check before you renew.
What certification involves
- 1Set your scope. Decide which parts of the business, devices and cloud services are covered.
- 2Close the gaps. Fix anything that wouldn't meet the five controls today.
- 3Self-assessment. Complete the questionnaire, signed off by a director, and a certification body marks it.
- 4Technical audit (Plus only). An assessor tests a sample of your devices and your cloud services.
- 5Renew. Recertify every year to keep the certificate current.
Holding ISO/IEC 27001 doesn't mean you meet Cyber Essentials. Read about ISO certification
How we help
The right level, in place before your deadline
We don't certify you ourselves. We introduce you to a trusted partner who specialises in Cyber Essentials, has worked with public sector suppliers and delivers to a standard we're happy to put our name to. We stay involved, so the level you achieve matches the frameworks and contracts you're going for.
- 1
Talk to us
We check which level your target frameworks and contracts ask for, and by when.
- 2
Meet our partner
We introduce you to our partner, who agrees your scope and what needs fixing first.
- 3
Get certified
Our partner supports you through to certification, and we line it up with your applications.
Talk to us about Cyber Essentials
Tell us what you need and we'll come back to you, or book a call with one of our team.
Speak with our Cyber Essentials experts
Pick a time that suits you. We'll talk through the frameworks and contracts you're targeting, the level they ask for and how quickly you need to move.
Cyber Essentials: your questions answered
Do I need Cyber Essentials for government contracts?
For many of them, yes. Under PPN 014, central government departments, their agencies, non-departmental public bodies and NHS bodies should require Cyber Essentials or Cyber Essentials Plus, or equivalent controls, before awarding contracts that carry cyber risk. Other buyers increasingly ask for it too.
Should I get Cyber Essentials or Cyber Essentials Plus?
Get the level your target frameworks and contracts ask for. On G-Cloud 15, Lots 1a and 1b require Plus, while Lots 2a, 2b and 3 require Cyber Essentials. Plus builds on Cyber Essentials, so if you need Plus you'll complete both.
I'm applying for G-Cloud 15. When do I need the certificate?
On Lots 1a and 1b, Cyber Essentials Plus is mandatory and validated. On Lots 2a, 2b and 3, GCA validates your Cyber Essentials certificate within 12 months of award, and suspends suppliers who don't provide one. Don't leave it to the last month.
Do my subcontractors need Cyber Essentials too?
Often, yes. On G-Cloud 15 Lots 2a, 2b and 3, any subcontractor processing personal or OFFICIAL data needs its own Cyber Essentials certificate. Check your supply chain before you apply.
Does ISO 27001 count as Cyber Essentials?
No. ISO/IEC 27001 certifies a whole information security management system, but it doesn't necessarily include all five Cyber Essentials controls in its scope. Some frameworks ask for both.
How long does a Cyber Essentials certificate last?
You recertify every year. Buyers check that your certificate is current, so put the renewal date in the diary and plan around any framework or contract milestones.
How quickly can I get certified?
It depends on how much needs fixing first, and Plus adds the time for a technical audit. Our partner will give you a realistic timeline once they've seen your scope. If a deadline is close, talk to us early.
How much does Cyber Essentials cost?
Cost depends on the level, the size of your organisation and how many devices and cloud services are in scope. You'll have a proposal from our partner once your scope is agreed.
Do I need Cyber Essentials for defence work?
Yes. Every level of Defence Cyber Certification starts with Cyber Essentials, and Levels 2 and 3 need Cyber Essentials Plus.
Who will deliver the work?
One of our trusted partners, introduced by us. You'll know who they are and what they propose before you commit to anything, and we stay involved throughout.
Selling cyber services? Read our guide to Cyber Security 4