Cyber Essentials for Public Contracts: When You Need It

Last reviewed 19 October 2026. General guidance, not legal advice.

Cyber Essentials is a government-backed certification showing that your business has basic protections against common cyber attacks. Central government buyers must require it on certain contracts, mainly those that involve handling personal data or government information. Many other public buyers ask for it too. For a small firm, the basic certification is relatively cheap and can usually be done in a few weeks.

Key points

• PPN 014 sets the rules for central government departments, their agencies, non-departmental public bodies and NHS bodies from 24 February 2025. It replaced PPN 09/14 and PPN 09/23.
• It applies to contracts that involve handling citizens' or government staff's personal information, supplying ICT that stores or processes OFFICIAL data, or information about government business or finances.
• It should not be applied to every contract as a matter of course. Many trades contracts will not trigger it, but some will.
• Councils, housing associations and schools are not bound by PPN 014 but often ask for Cyber Essentials anyway.
• Certification is renewed every year.

When a public contract will ask for it

PPN 014 says suppliers must meet the Cyber Essentials technical requirements on contracts with at least one of these features:

• handling personal information of citizens, such as home addresses or payment details;
• handling personal information of government employees, ministers or special advisers;
• supplying ICT systems designed to store or process OFFICIAL-level data;
• involving information about the day-to-day business of government, service delivery or public finances.

For trades and facilities firms, the first of these is the one to watch. Examples include responsive repairs where you receive tenants' names, addresses and phone numbers; access control or CCTV maintenance; and any contract where you log in to the buyer's systems.

The PPN says buyers should ask for certification (Cyber Essentials or Cyber Essentials Plus), and that the supplier must renew it annually for the life of the contract. Suppliers who are not certified can instead show they have equivalent controls, but certification is far simpler to prove.

What Cyber Essentials checks: the five controls

The scheme covers five technical controls:

1. Firewalls: protect your internet connection and devices.
2. Secure configuration: remove default passwords and switch off what you do not need.
3. User access control: only give people the access they need, and protect admin accounts.
4. Malware protection: use anti-malware or application controls.
5. Security update management: keep software and devices patched, including phones and laptops used for work.

For a small firm, the work is usually: an inventory of the laptops, phones and cloud services you use; turning on multi-factor authentication, which since the April 2026 update (requirements v3.3) is mandatory for every cloud service that offers it; making sure updates install automatically; and replacing any unsupported devices.

Cyber Essentials vs Cyber Essentials Plus

What it costs

Certification is delivered through IASME, which runs the scheme for the National Cyber Security Centre, and its network of certification bodies. IASME publishes its fee for the basic self-assessment as £320 plus VAT for micro organisations (0 to 9 employees) and £440 plus VAT for small ones (10 to 49), with many providers selling packages that add help and support on top (IASME FAQs). Cyber Essentials Plus costs more because of the audit, and each certification body sets its own price: one provider lists it from £1,495 plus VAT for up to 9 users (example price list, September 2026). Check current fees with a certification body before you budget.

How long it takes

If your devices are already up to date and you use multi-factor authentication, the self-assessment can be completed in days. If you need to replace old equipment or change how staff log in, allow a few weeks. Do it before you need it: certification is often asked for at contract award, and you may not have time to fix problems after winning.

Is it worth it if no tender has asked yet?

For most trades firms working with councils and housing providers, yes:

• it removes a common reason for being marked down or excluded;
• it reduces your real risk of a costly attack, such as invoice fraud through a hacked email account;
• some insurers take it into account.

Next steps

• Check the next few tenders you are interested in for "Cyber Essentials" in the requirements. BidTrowel flags it on each contract's page when the notice mentions it.
• Start with the basic certification; move to Plus only when a contract requires it.
• Get a free weekly shortlist of contracts matched to your firm: get free alerts.

For the wider rules, see the Procurement Act 2023 for small suppliers.

Sources

• GOV.UK: PPN 014, Cyber Essentials scheme (checked 19 October 2026)
• NCSC: Cyber Essentials (checked 19 October 2026)
• IASME: Cyber Essentials FAQs, including fees (checked 19 October 2026)
• IASME: changes to the Cyber Essentials scheme, April 2026 (checked 19 October 2026)
• Forensic Control: Cyber Essentials Plus cost guide (checked 19 October 2026)