UK supplier guide
Cyber Essentials for tenders:
scope, evidence and renewal
Cyber Essentials is not a blanket condition for every public contract. Read the buyer’s requirement, check the certification level and scope, and have the required evidence ready at the stated stage. Cabinet Office · PPN 014 explains when the policy applies.
Find a tender and inspect its requirements →Checked against primary sources3 sources linked below
- Read the requirement
- Match entity and systems
- Check level and validity
- Resolve the remaining gap
Certification is contract-specific
Start with the buyer’s actual request.Scope matters alongside validity
A current certificate must cover the relevant delivery.Renewal is ongoing work
Give the evidence an owner throughout the contract.
Does every public tender require Cyber Essentials?
No. PPN 014 calls for a relevant, proportionate requirement, rather than certification on every contract.
The certificate supports a specific procurement requirement; it does not establish that the supplier can deliver the whole contract.
- The policy covers central departments, executive agencies, non-departmental public bodies and NHS bodies; other bodies may adopt it.
- Consider the information and systems the contract involves, including personal data and OFFICIAL-level systems.
- Read whether the buyer asks for Cyber Essentials, Plus or equivalent controls.
- The policy distinguishes evidence before award and evidence when data passes to the supplier.
What changes between Cyber Essentials and Plus?
Both assess the same five controls; Plus adds independent technical testing.
| Evidence route | What to check |
|---|---|
| Cyber Essentials | Verified self-assessment against the technical controls |
| Cyber Essentials Plus | Independent technical testing of those controls |
| Equivalent controls | Evidence the buyer accepts; Plus equivalence requires competent, independent verification |
| ISO 27001 | A separate management-system standard; it does not automatically satisfy Cyber Essentials |
How do you prepare the evidence before committing to a bid?
Establish the requirement, certified scope and actual evidence dates before making a claim.
- Start with the source01
Read the requirement
Keep the current notice and the exact security condition. - Define the scope02
Match entity and systems
Check what the certificate covers against the proposed delivery. - Read the evidence03
Check level and validity
Read the requested level, expiry and buyer evidence date. - Make the decision04
Resolve the remaining gap
Plan renewal or seek a permitted clarification about equivalent evidence. - Name the next action05
Assign ongoing ownership
Name who maintains controls and renewal throughout delivery.
A supplier’s review sequence, based on the primary sources below. It is not a measured outcome or a prescribed buyer timetable.
Which controls does the evidence need to cover?
NCSC names five technical controls, covering configuration, access, updates, malware and the network boundary.
Use the current assessment questions and requirements linked by NCSC. Check the legal entity and delivery systems covered by the certificate, including any restricted scope.
- Protect the network boundary.
- Reduce avoidable exposure through secure configuration.
- Manage security updates for systems and software.
- Control users and their permissions.
- Maintain malware protection.
Will your certificate still be current when the buyer needs it?
Compare the actual expiry with the buyer’s evidence date, then check scope and renewal separately.
PPN 014 requires annual recertification. A positive date gap alone does not establish compliance or remove ongoing security obligations. Cabinet Office · PPN 014.
Check your evidence dates
Use the certificate’s stated expiry and the buyer’s actual date. Repeat for award and data handover if they differ.
This computes the calendar-day gap. It does not check certificate scope or decide whether the buyer accepts the evidence.
How does the check work for a contact-centre bid?
The Cabinet Office lists contact-centre services handling citizens’ personal information as an example where the controls are relevant.
This is a worked reading of PPN 014’s published example, not a customer result or a claim about a named company’s certification.
- Establish which personal information the service will handle.
- Match the supplier legal entity and delivery scope to the evidence.
- Use the level and evidence route the buyer specifies.
- Keep certification or equivalent evidence current when the information passes to the supplier.
What belongs in the bid’s security evidence pack?
Keep the requirement, current evidence, scope and any remaining gap together.
- Before you start01
Use the current documents
Check the primary publication and later changes before using the sequence below. - Check 202
Capture the actual request
Keep the notice and document reference beside the requested level and evidence date. - Check 303
Check identity and scope
Match the certificate to the bidding entity and the services, systems and sites in delivery. - Check 404
Resolve the evidence route
Confirm the certificate or equivalent evidence that will be supplied, and clarify uncertainty through the buyer’s route. - Follow through05
Own the renewal
Give validity, delivery changes and ongoing security obligations a named owner.
An editorial order of work, not a buyer's fixed timetable. The current notice and documents determine participation and submission.
What happens after the certificate is issued?
Certification needs renewal every twelve months; continued operation of the controls also matters.
NCSC currently lists basic certification from £320 plus VAT, with organisation-size pricing; Plus is quoted for network size and complexity. Confirm the current price with the certification provider. NCSC certification costs.
- Check the certificate’s current validity and stated scope.
- Continue patching, configuration and access controls between assessments.
- Review changes to the delivery systems and information sharing.
- Plan annual recertification and follow the contract’s additional requirements.
Security evidence needs to cover the company and systems doing the work.
Certification is contract-specific
Start with the buyer’s actual request.Scope matters alongside validity
A current certificate must cover the relevant delivery.Renewal is ongoing work
Give the evidence an owner throughout the contract.
Use the current notice and buyer documents to establish the evidence needed.
What else should you know about Cyber Essentials for tenders?
Check these points before committing your team’s time.
Does ISO 27001 replace Cyber Essentials?
Can equivalent evidence be accepted?
Is the certificate needed when bidding or before delivery?
Where can you check the evidence?
Read the primary publication and the buyer’s current documents before acting.
| Source | What it supports |
|---|---|
| Cabinet Office: PPN 014 ↗ | Applicability, proportionate requirements, equivalents, scope, timing and annual renewal. |
| NCSC: Cyber Essentials ↗ | Five controls, assessment levels, current starting price and preparation resources. |
| IASME: scheme delivery ↗ | Certification delivery and preparation route. |
Which guide answers your next question?
Follow the part of the bid you need to work on next.
