Skip to main content
RFP QuestSign inJoin betaBook a Demo

UK supplier guide

ISO 27001 Tender Requirements:
When UK Buyers Ask, What to Show

ISO 27001 is not a blanket requirement for UK public tenders. If the buyer asks for it, check the certificate’s scope, issuer and validity against the actual contract.

Find a notice and check its evidence requirements →

Checked against primary sources9 sources linked below

  1. Find the exact requirement

    This guide’s primary sources

  2. Match the delivery scope

    This guide’s primary sources

  3. Verify the certificate

    This guide’s primary sources

  4. Resolve gaps before making claims

    This guide’s primary sources

  1. The buyer sets the condition

    Do not infer it from contract size or sector.

    This guide’s primary sources

  2. Scope must match delivery

    Keep the certificate wording beside the system description.

    This guide’s primary sources

  3. A checklist is a working aid

    It does not certify your eligibility.

    This guide’s primary sources

Is ISO 27001 mandatory for this tender?

The buyer’s documents decide whether it is required and what evidence or equivalents are accepted.

Certification is evidence of an information security management system; it does not certify every product or guarantee security.

The government security schedule includes selectable certification requirements, while PPN 014 addresses proportionate Cyber Essentials controls.

  1. Find the requirement and when it must be met.

    Security schedule

  2. Match the delivery system to the certificate scope.

    Schedule 9A

  3. Check the certification body and accepted equivalents.

    UKAS

  4. ISO 27001 does not automatically meet Cyber Essentials.

    PPN 014 · Annex C

Does ISO 27001 replace Cyber Essentials?

No; they assess different things and a buyer may require separate evidence.

QuestionISO 27001Cyber EssentialsCyber Essentials Plus
What it certifiesA management system for information security risk, across people, policies and technologyFive technical controls against common internet attacksThe same five controls, independently tested
How it is assessedAudit by a certification body; UKAS accreditation of that body is what buyers ask forSelf-assessment questionnaire, verified by a certification bodySelf-assessment plus remote and on-site vulnerability testing
Controls in scope93 Annex A controls in four themes, applied by risk assessmentFirewalls, secure configuration, security updates, user access, malware protectionAs Cyber Essentials
Government policyA buyer option in the government security schedule, not a defaultPPN 014: central government and NHS contracts handling personal or OFFICIAL dataPPN 014: where cyber risk is higher
RenewalCertification body's audit cycle; the certificate must name the 2022 editionEvery 12 months (PPN 014)Every 12 months (PPN 014)
Meets the other?Not automatically Cyber Essentials (PPN 014, Q9)No — it is a baseline, not a management systemNo — it is a baseline, not a management system
Sources: ISO, NCSC and PPN 014; verify the buyer’s current schedule rather than assuming substitution.

How do you turn an ISO 27001 request into an evidence decision?

Read the buyer's requirement, then establish whether the certificate and delivery scope meet it.

  1. Start with the source01

    Find the exact requirement

    Read whether the buyer requests certification, other assurance or a separate Cyber Essentials condition.
  2. Define the scope02

    Match the delivery scope

    Compare the certified organisation and systems with the services actually being offered.
  3. Read the evidence03

    Verify the certificate

    Check edition, validity, accreditation and the supporting evidence requested.
  4. Make the decision04

    Resolve gaps before making claims

    Ask clarifications where allowed and distinguish current evidence from work still in progress.
  5. Name the next action05

    Assign the evidence pack

    Name who owns the certificate, supporting records and any renewal or submission dates.

A supplier’s review sequence, based on the primary sources below. It is not a measured outcome or a prescribed buyer timetable.

How should a supplier review a real notice before buying certification?

Read the lot’s documents first; a framework’s value says nothing about its ISO requirement.

Northumbrian Water’s FA08-31 Commercial Services notice gives an estimated £120 million framework value excluding VAT and an expression-of-interest deadline of 3 November 2026 at noon UK.

Those facts do not establish an ISO 27001 condition.

A supplier considering its SME-labelled lots must check the relevant documents and clarification route before paying for certification.

Public example checked 12 October 2026, not an assertion that ISO certification is required; read the notice.

  1. Read the services and delivery scope.

    Official notice

  2. Look for certificate, equivalent controls and timing wording.

    Government example schedule

  3. Compare delivery systems with the scope on the certificate.

    Scope wording

  4. Use its formal clarification process when wording is unclear.

    Buyer instructions

Which evidence should you collect before citing ISO 27001?

Use this checklist to organise documents, then validate them against the buyer’s wording.

The checklist records your own ticks in this browser.

A completed ring is not certification, eligibility or a readiness verdict; scope, dates, equivalents and subcontractor obligations still require review.

0/7in your pack

What dates and certificate details should you verify?

The accepted edition, validity period and coverage required for delivery.

Certificate record

  1. Edition

    Check ISO/IEC 27001:2022 and the buyer’s accepted wording.

    ISO standard

  2. Transition

    UKAS’s transition deadline was 31 October 2025.

    UKAS transition

  1. Check ISO/IEC 27001:2022 and the buyer’s accepted wording.

    ISO standard

  2. UKAS’s transition deadline was 31 October 2025.

    UKAS transition

  3. Confirm the certification body’s accreditation.

    UKAS CertCheck

  4. Check when certification or equivalent controls must be in place.

    Schedule 9A

What will preparing the evidence pack cost your team?

Estimate staff time separately from quoted certification or audit fees.

Enter the hours needed to review and prepare this bid’s evidence; the result does not quote the cost of obtaining ISO 27001 or promise savings.

Your bid effort

Starting figures are an illustration, not a measured average or a saving promised by RFP Quest.

Preparation cost per bid£2,000

£4,000 and 80 team hours each month if you prepare every bid.

Team hours × hourly cost × bids

Use the estimate to decide how much work to authorise before drafting starts.
It excludes software fees and external costs.

£2,000one bid
  • This bid£2,000
  • Other bids this month£2,000
A planning estimate from the figures you entered, not measured savings or contract value.
Source: Your inputs · Bid effort calculation

Does the certificate cover subcontractors and delivery systems?

Do not assume it does; read the buyer’s separate system and subcontractor requirements.

Delivery scope

  1. Supplier system

    Identify the systems used to handle the contract’s data.

    Schedule 9A

  2. Wider scope

    A wider certified system must include the relevant supplier system.

    Scope requirement

  1. Identify the systems used to handle the contract’s data.

    Schedule 9A

  2. A wider certified system must include the relevant supplier system.

    Scope requirement

  3. Check separate requirements where they handle government data.

    Paragraph 4

  4. Provide it or accepted equivalent controls when required.

    PPN 014

Can you bid while working towards certification?

Only if the documents accept that position or an applicable equivalent at the required stage.

What does the buyer require?

  • Certification at a named stage

    Provide the specified evidence by that stage, or seek clarification before committing the response.

  • Equivalents accepted

    Explain the controls and evidence the buyer accepts; a plan to certify is not the same as an equivalent system.

What should the bid lead check first?

Start with the exact condition, then verify evidence and only then authorise spend.

  1. Before you start01

    Use the current documents

    Check the primary publication and later changes before using the sequence below.
  2. Check 202

    Quote the requirement

    Record its document, page and required stage.
  3. Check 303

    Check the certificate

    Edition, issuer, scope and validity.
  4. Check 404

    Check the delivery chain

    Systems, separate controls and subcontractors.
  5. Follow through05

    Resolve gaps

    Clarify accepted evidence and price any additional work.

An editorial order of work, not a buyer's fixed timetable. The current notice and documents determine participation and submission.

A certificate helps only when its scope answers the buyer’s requirement.

  1. The buyer sets the condition

    Do not infer it from contract size or sector.

  2. Scope must match delivery

    Keep the certificate wording beside the system description.

  3. A checklist is a working aid

    It does not certify your eligibility.
Find a notice and check its evidence requirements →

Read the current documents before investing in certification or preparing a response.

What else should you know about ISO 27001 tender requirements?

Check these points before committing your team’s time.

Is ISO 27001 mandatory for UK public sector tenders?
There is no blanket ISO 27001 requirement for every UK public tender. Read the buyer’s conditions and security schedule for the specified certificate, accepted equivalents and required stage. PPN 014 concerns proportionate Cyber Essentials controls for its in-scope organisations; it does not make ISO 27001 universal. Read PPN 014 and Schedule 9A.
Does ISO 27001 replace Cyber Essentials in a tender?
Not automatically. PPN 014 says companies with ISO 27001 "will not automatically conform to Cyber Essentials", because the five Cyber Essentials controls are not usually all in the ISO 27001 scope and are unlikely to be tested in the audit — so most will need Cyber Essentials as well, or evidence of equivalent controls (PPN 014, Annex C, Q9). Where a notice names both, answer both.
What does “UKAS-accredited” mean on an ISO 27001 certificate?
That the certification body which audited you has itself been assessed by UKAS, the UK's accreditation body. ISO says a certificate from an accredited body adds "an additional layer of confidence" (iso.org). Government's security schedule defines an acceptable issuer as a body accredited by UKAS, or by an equivalent body under a mutual recognition agreement (Call-Off Schedule 9A). A buyer can check an accredited certificate on UKAS CertCheck.
What should the ISO 27001 certificate scope cover for a tender?
The system you will use to deliver the contract. The government schedule accepts a certificate "in respect of the Supplier System, or in respect of a wider system of which the Supplier System forms part" (Call-Off Schedule 9A). A certificate that covers only your head office, or another product line, does not answer that question — quote the scope statement word for word in the bid.
Is an ISO 27001:2013 certificate still valid for a bid?
No. UKAS set 31 October 2025 as the date by which certification bodies had to move every client to ISO/IEC 27001:2022 (UKAS technical bulletin). A certificate that still names the 2013 edition should be treated as out of date; check yours says 2022.
Can I bid if I am working towards ISO 27001?
Only if the buyer’s documents accept that position at the relevant stage, or an applicable equivalent that you can demonstrate. A plan to obtain certification is not a certificate or proof of equivalent controls. Ask through the formal clarification route if the wording is unclear. The security schedule gives a government example of how requirements are stated.
Do public bodies tender for ISO 27001 certification audits?
Yes. Some public bodies run their own procurements for an ISO 27001 certification or recertification audit, a gap analysis, internal audits or ISMS software, and publish them as notices like any other contract.
Do my subcontractors need ISO 27001?
Only if the buyer asks. The government short-form schedule has a separate tick-box for subcontractors that handle government data, with the same options — ISO 27001:2022 from a UKAS-recognised body, Cyber Essentials Plus or Cyber Essentials — and, where the buyer names none, requires Cyber Essentials (or equivalent) of the supplier and those subcontractors (Call-Off Schedule 9A, paragraph 4).

Where can you check the evidence?

Read the primary publication and the buyer’s current documents before acting.

SourceWhat it supports
Northumbrian Water official notice ↗Worked example of reviewing a notice before inferring any certification requirement; checked 12 October 2026.
ISO, ISO/IEC 27001:2022 ↗edition 3, published October 2022, with a 2024 amendment; what certification means and the value of an accredited certificate, read 29 Sep 2026.
UKAS, transition arrangements for ISO/IEC 27001:2022 ↗93 Annex A controls in four themes (11 new, 24 merged, 58 updated) and the 31 October 2025 transition date, read 29 Sep 2026.
UKAS CertCheck ↗the search for accredited management system certificates, opened 29 Sep 2026.
Cabinet Office, PPN 014: Cyber Essentials scheme ↗who must ask for Cyber Essentials, and Annex C Q9 on why ISO 27001 does not automatically meet it, read 29 Sep 2026.
Government Security, Call-Off Schedule 9A (Security: Short Form) ↗the certification options a buyer can require, the scope wording, the definition of a UKAS-recognised body, and the default of Cyber Essentials, read 29 Sep 2026.
Government Security, Contracting securely ↗the five modular security schedules and how buyers choose between them (last updated 25 June 2026), read 29 Sep 2026.
NCSC, Cyber Essentials ↗the five technical controls, the two levels and the starting price, read 29 Sep 2026.
assets.publishing.service.gov.uk · Call Off_Schedule_9A__Security_ _Short_Form__v1.0_PA.pdf ↗Primary publication or provider reference retained from the previous page. Check current wording before acting.
certcheck.ukas.com · Primary service ↗Primary publication or provider reference retained from the previous page. Check current wording before acting.
gov.uk · ppn 014 cyber essentials scheme html ↗Primary publication or provider reference retained from the previous page. Check current wording before acting.
iso.org · 27001 ↗Primary publication or provider reference retained from the previous page. Check current wording before acting.
ncsc.gov.uk · overview ↗Primary publication or provider reference retained from the previous page. Check current wording before acting.
security.gov.uk · contracting securely ↗Primary publication or provider reference retained from the previous page. Check current wording before acting.
ukas.com · about ↗Primary publication or provider reference retained from the previous page. Check current wording before acting.
ukas.com · transition arrangements for iso iec 270012022 ↗Primary publication or provider reference retained from the previous page. Check current wording before acting.
Follow the current primary publication for its scope and any later changes. Calculators use your inputs, not measured savings.

Follow the part of the bid you need to work on next.

RFP Quest logo — RFP software, RFP platform and RFP tools

Built on published notices from Find a Tender and Contracts Finder.

15 minutes · RFP Quest

Book a Demo