Is Cyber Essentials mandatory?

No law makes every business get Cyber Essentials, so for most firms Cyber Essentials is not mandatory. It becomes a requirement when you bid for certain public sector contracts, particularly central government and NHS work that involves personal data, and more and more private customers and insurers ask for it too.

So the honest answer is: not legally, but quite possibly commercially.

Where it is required

Government policy has required suppliers to hold Cyber Essentials for certain contracts since 2014. The current rule is Procurement Policy Note 014, which applies to central government departments, their agencies and arm’s length bodies, and NHS bodies. They must make sure suppliers meet the Cyber Essentials controls on contracts that include things like:

• handling citizens’ personal information, such as home addresses, bank details or payment information
• handling personal information about government staff, such as payroll, travel or expenses
• supplying IT systems that store or process government data at the OFFICIAL level

The note says the quickest way to meet this is a Cyber Essentials or Cyber Essentials Plus certificate, renewed every year for the length of the contract. A supplier without one has to show equivalent controls another way, which is usually harder work than getting the certificate. Councils and other public bodies aren’t bound by the note but may follow it, and many do.

Where it’s asked for anyway

• Supplier questionnaires. Larger customers often ask whether you hold it. A yes can replace pages of answers. Our guide to security questionnaires covers the rest.
• Insurers. Some cyber insurers ask about it on the proposal form or treat it as evidence of the basics.
• Frameworks and tenders. Public and private frameworks often list it as a minimum.

Is it worth it if nobody’s asking?

We think so. The five controls cover firewalls, secure settings, updates, user access and malware protection, which between them stop most of the everyday attacks UK businesses see. It also gives you a clear list of what to fix. Our Cyber Essentials cost guide shows what it costs, and the First Step Fund currently covers most of the certification fee for eligible businesses.

FAQ

Do I need Cyber Essentials Plus or is the basic certificate enough?

The buyer decides. Procurement Policy Note 014 allows either, and the contract or tender should say which one it wants. Plus adds an independent technical check of your devices.

Does a certificate last forever?

No. A certificate is valid for 12 months. For government contracts that require it, you must renew it every year for the length of the contract.

Is ISO 27001 an alternative?

It can be, if the buyer accepts it as showing equivalent controls, but it’s a much bigger undertaking. Our guide to Cyber Essentials or ISO 27001 compares them.

Source

• GOV.UK: Procurement Policy Note 014, Cyber Essentials scheme (updated February 2025)