Cyber Essentials: when you need it to bid, and when you do not

Cyber Essentials is a government-backed certification covering a short list of basic security controls. For some public contracts you cannot win the work without it. For most, nobody will ask.

The rule in force is PPN 014, which has applied since 24 February 2025 and replaced the two earlier notes most online advice still quotes.

Who it applies to

Central government departments, their executive agencies and non-departmental public bodies , and NHS bodies. That last one is newer than a lot of guidance suggests and catches people out.

Councils are not in scope. Many ask for it anyway, as their own requirement, and when they do it will be in the tender documents rather than implied by policy.

Which contracts

Broadly, anything where you will touch data that matters:

• Personal information about citizens: home addresses, bank details, payment details.
• Personal information about government employees, ministers or special advisers: payroll, travel booking, expenses.
• ICT systems handling information at OFFICIAL level.
• Government business information that needs protecting.

The examples in the policy are deliberately mundane (CV writing services, car hire for staff, contact centres), because the test is the data rather than the technology. A contract to provide staff training is in scope the moment you hold a list of who attended.

The four answers people actually need

• Do I need it to submit a bid? Not necessarily. What the policy requires is evidence before contract award, and at the point data is to be passed to you. Plenty of buyers ask at bid stage anyway, so read the documents.
• Is there a way round it? Yes, formally. Where you do not hold Cyber Essentials or Cyber Essentials Plus, you must be able to demonstrate equivalent controls are in place through other means. That is a real route, and it is more work than getting certified.
• Plus, or basic? Basic is a self-assessment questionnaire verified by an accredited certification body. Plus adds hands-on technical testing. The policy does not mandate Plus for particular contract types. It is recommended where the risk is higher, and each buyer decides. If a bid needs Plus, the documents will say so.
• How long does it last? Twelve months. You must recertify annually or you are simply uncertified, and a lapsed certificate during a live contract is a contractual problem, not an administrative one.

If you are deciding whether to get it

Look at what you are actually bidding for over the next year. If there is any central government or NHS work in it that involves personal data, get certified before you need it, it takes days to weeks depending on what you have to fix, and every bid that asks for it asks on a deadline.

If your market is councils and you have never been asked, the honest answer is that it is a marketing asset rather than a requirement. It is not expensive, and it does get mentioned in scored questions about information security, but it is not the thing standing between you and the work.