Cyber Essentials for Central Government Suppliers
If you want to bid for a central government contract that involves handling personal information or delivering certain IT products or services, Cyber Essentials certification isn't optional, it's a gate you have to pass through before your bid is even considered. This rule has applied to every qualifying contract advertised since October 2014, so buyers will expect to see a valid certificate as part of your submission, not something you're still working towards. Missing it doesn't just weaken your bid, it can rule you out entirely regardless of how strong the rest of your proposal is.
Why it applies to you
If you want to bid for a central government contract that involves handling personal information or delivering certain IT products or services, Cyber Essentials certification isn't optional, it's a gate you have to pass through before your bid is even considered. This rule has applied to every qualifying contract advertised since October 2014, so buyers will expect to see a valid certificate as part of your submission, not something you're still working towards. Missing it doesn't just weaken your bid, it can rule you out entirely regardless of how strong the rest of your proposal is.
Typical Trigger / Source
Procurement Policy Note 09/14 (Cabinet Office)
Requirement levels reflect current UK government, NCSC and IASME guidance. If you're unsure which category applies to your organisation, our team can help you confirm it on a quick call before you commit to certifying.
Steps to get certified
A guided, hands-on path from scoping to certificate, no jargon, no guesswork.
Scoping
We agree the boundary of your assessment: a device, a network, or your whole organisation.
Self-Assessment
Complete a guided questionnaire against the five technical controls, with our support throughout.
Review
We check your submission and flag anything that needs addressing before it goes for formal assessment.
Certification
Your certificate is issued, backed by IASME/NCSC accreditation, valid for 12 months.
Questions from central government suppliers
Yes, in many cases. If your role in the contract involves handling personal information or the relevant ICT products or services, the buyer can reasonably expect your part of the supply chain to meet the same standard, even if you're not the prime contractor. Check the specific tender documents, as the requirement is usually spelled out contract by contract.
Read the tender wording closely instead of assuming you're exempt by default. Personal information can mean anything from staff records to citizen data processed on your systems, and buyers often interpret this broadly. If you're unsure, ask the contracting authority directly before you decide certification doesn't apply to you.
Most central government contracts ask for standard Cyber Essentials, but some specify Cyber Essentials Plus depending on the sensitivity of the work. The tender or contract documentation will state which level is required, so always check that before you start rather than assuming.
Start well before you plan to bid, ideally a few months out. The assessment itself can move quickly once you're ready, but most businesses need time beforehand to close gaps in areas like device configuration, patching and access control, and rushing this close to a deadline is where mistakes happen.
Latest from the blog
See other categories
Get certified in as little as 5 days
Tell us a little about your organisation and we'll send an itemised quote, no obligation, no sales call required to get pricing.