Cyber Essentials in public sector tenders

When a buyer must ask for it

The rule is Procurement Policy Note 014, published in February 2025 and applying to procurements started from 24 February 2025. It replaced PPN 09/14 and PPN 09/23. It covers central government departments, their executive agencies and non-departmental public bodies, and NHS bodies. Councils and other public bodies are not bound by it but may choose to follow it, and the NCSC notes that a growing number of organisations require suppliers to be certified to bid for work.

In-scope buyers must require Cyber Essentials, or equivalent controls, where a contract involves:

• personal information about citizens, such as home addresses or payment details;
• personal information about government staff, ministers or special advisers, such as payroll or expenses data;
• ICT systems or services designed to store or process data at the OFFICIAL level; or
• information about the day-to-day business of government, service delivery or public finances.

The PPN also says buyers must not take a blanket approach: requirements must be relevant and proportionate to what is being bought, so that small firms and voluntary organisations are not put off. If you are asked for Cyber Essentials Plus on a low-risk contract with no data, a clarification question is fair.

Cyber Essentials or Cyber Essentials Plus

Both check the same five controls set by the National Cyber Security Centre: firewalls, secure configuration, security update management, user access control and malware protection. IASME is the NCSC's official delivery partner and runs the scheme through a network of certification bodies.

The self-assessment prices on IASME's site are £320 plus VAT for 0 to 9 employees, £440 for 10 to 49, £500 for 50 to 249 and £600 for 250 or more. Once you pay, you have six months to complete the assessment, and if you fail, IASME allows two working days to fix simple issues and update your answers (IASME FAQ). If you got Cyber Essentials less than three months before going for Plus, you do not have to repeat the self-assessment.

Organisations domiciled in the UK or Crown Dependencies, with turnover under £20 million, that certify their whole organisation can opt in to cyber liability insurance with £25,000 of cover, lasting 12 months alongside the certificate (IASME cyber liability insurance). The price is the same whether you opt in or not.

The current question set: Danzell

The questions and the standard behind them are updated from time to time. Assessments bought from 27 April 2026 use the question set called Danzell, which you can download free from IASME's preview page. Assessments bought before that date used the previous set, Willow. Danzell goes with version 3.3 of the Cyber Essentials Requirements for IT Infrastructure (April 2026). Points that catch small firms out:

• Cloud services are in scope. Version 3.3 states that cloud services cannot be excluded, so your email, file storage and accounting software accounts count.
• Updates within 14 days. Critical and high-risk security updates must be applied within 14 days of release.
• No unsupported software. IASME says any organisation using unsupported software within the scope of the assessment will fail.

How tenders ask for it

Look for it in the selection questions, the specification or the contract terms. Typical wording:

• "Do you hold a current Cyber Essentials certificate? Provide the certificate number and expiry date."
• "The supplier must hold Cyber Essentials Plus, or equivalent, before contract award."
• "Confirm you will maintain certification for the duration of the contract."

On timing, PPN 014 says evidence is required before contract award and is essential when data is passed to you. If your certificate has expired and you are mid-renewal, the PPN lets a buyer take a risk-based view, as long as you hold a valid certificate when data changes hands. You must recertify every 12 months for as long as the contract runs.

Evidencing it

Give the certificate number, the level, the date certified, the expiry date and the legal entity covered. Buyers can check it on the IASME certificate search, which looks up an organisation by name or certificate number and lists certificates issued in the last 12 months. Make sure the entity named matches the one bidding: PPN 014 says that by default certification covers the legal entity providing the goods or services, and a supplier can certify only part of it. It also notes that your certificate does not cover third parties you share data with, such as a cloud provider, and the government's Model Services Contract extends the requirement to relevant subcontractors.

The dates are illustrative: replace the brackets with your own details. For help with structure, see writing a tender response.

"Or equivalent"

If you do not hold either certificate, PPN 014 says you must be able to show equivalent controls are in place by other means, and that equivalence normally needs to be verified by a technically competent and independent third party. This follows the Procurement Act 2023 rule on technical specifications (section 56), which requires buyers to accept equivalent standards. In practice, for a small firm, getting the certificate is usually simpler than proving equivalence.

NHS contracts: the DSPT is separate

PPN 014 applies to NHS bodies. Separately, the Data Security and Protection Toolkit says all organisations that have access to NHS patient data and systems must use it. The toolkit is an online self-assessment against the National Data Guardian's standards. It is a different thing from Cyber Essentials, so if you will handle patient data, expect to be asked about both.

Cyber Essentials is one of the standing items in our before you bid checklist. If you are new to public work, start with how to bid for public sector contracts, and use the tender finder to see what is open now.

Need help? See specialists for Cyber Essentials and Cyber Essentials Plus.