Cyber Essentials Public Sector Tender: 5 Steps and Costs
Cyber Essentials is not needed for every public sector tender. Under PPN 014, central government departments, their agencies and NHS bodies require it only when a contract involves citizens' or staff personal data, ICT that stores or processes OFFICIAL information, or day-to-day government business information. If a tender you want asks for it, basic certification starts at £320 + VAT for micro organisations (NCSC, as of October 2026). It can take a few days if your IT is already in order, or several weeks if you have gaps, so check the requirement as soon as you find the opportunity.
Which option is right for you?
Most SMEs and VCSEs should start with basic Cyber Essentials and move to Plus only when a specific tender asks for it.
| Your situation | What to pick first | First page to open |
|---|---|---|
| First tender, no certification, unsure if it is needed | Read the tender's conditions of participation before buying anything | The notice on Find a Tender or Contracts Finder |
| Tender needs Cyber Essentials, you have a small, simple IT setup | Self-led basic Cyber Essentials | NCSC Cyber Essentials overview |
| You use staff laptops and cloud email every day but nobody "does IT" | Supported route through an IASME-licensed certification body | NCSC overview (supported route) |
| Tender explicitly asks for Cyber Essentials Plus | Basic CE first, then a booked Plus audit within 3 months | Your chosen certification body's Plus quote page |
| Tight budget, charity or social enterprise | Free Core Membership of your regional Cyber Resilience Centre, then self-led CE | Police CRC list |
| You hold ISO 27001 already | Ask the buyer whether it is accepted as an equivalent | PPN 014 equivalence section |
Why: the self-led route is the cheapest path. The supported route costs more, but you get help finding gaps before you submit. Plus is quote-based and only worth paying for when a buyer requires it.
Which public sector contracts actually require Cyber Essentials?
Under PPN 014, a contract needs Cyber Essentials when it involves certain personal data, OFFICIAL-level ICT or government business information. It does not depend on the contract's value.
PPN 014 came into effect on , the same day the Procurement Act 2023 regime started. It replaced PPN 09/14 and PPN 09/23 (GOV.UK). The policy itself is the same one that has applied since 2014. The update changed the wording to match the new Act (RightCyber summary of PPN 014).
Who must apply it
PPN 014 "applies to all central government departments, their executive agencies and non-departmental public bodies, and NHS bodies" (PPN 014). Local councils, housing associations, schools and universities are not bound by it, but many choose to follow the same approach. When a council tender asks for Cyber Essentials, it is the council's own choice, so read its documents carefully.
The four triggers
A contract is in scope if it involves any of these (PPN 014):
| Trigger in PPN 014 | What it looks like in practice (examples) |
|---|---|
| Personal information of citizens, "such as home addresses, bank details, or payment information" | Contact centres, benefits advice, debt support, mailing services |
| Personal information of government employees, ministers and special advisers | HR and payroll services, staff travel, CV writing for staff |
| ICT systems and services designed to store or process data at OFFICIAL level | Software, hosting, managed IT, cloud tools |
| Information about the day-to-day business of government, service delivery and public finances | Finance support, consultancy with access to internal systems |
The earlier version, PPN 09/23, gave named examples. CV writing services, car hire for staff and contact centre services should require Cyber Essentials. Marketing planning without access to personal data, driving instruction by sole traders with minimal IT use, and legacy IT support where systems cannot meet the standard would not (PPN 09/23). PPN 09/23 also told buyers not to take "a blanket approach" that could "over-burden suppliers or deter Small and Medium-Sized Enterprises" (same source).
For example, say you are a two-person charity bidding to run a community befriending service for an NHS trust and you will keep clients' names and home addresses. That is citizen personal data, so expect the requirement. A sole-trader photographer bidding for a one-off event shoot for a council, with no personal data handed over, would usually not be in scope.
Which CPV codes commonly flag the Cyber Essentials requirement?
No official list links CPV codes to Cyber Essentials. Buyers decide based on the data and systems involved, so a CPV code can only tell you how likely the requirement is.
To know for sure, read the conditions of participation in the tender notice or the procurement documents. Use the table below to decide which notices to check first. The likelihood ratings are this guide's reading of PPN 014's triggers. They are not official ratings.
| CPV code (example) | Description | Likelihood CE is asked for | Why |
|---|---|---|---|
| 72000000 | IT services: consulting, software development, Internet and support | High | ICT that processes OFFICIAL data |
| 48000000 | Software package and information systems | High | Same as above |
| 79512000 | Call centre | High | Citizen personal data (named in PPN 09/23) |
| 79600000 / 79630000 | Recruitment / personnel services | High | Employee personal data |
| 85300000 | Social work and related services | Medium to high | Sensitive personal data about service users |
| 79211000 / 79410000 | Accounting / business and management consultancy | Medium | Public finance and internal business information |
| 79342000 | Marketing services | Low unless personal data is shared | PPN 09/23 gives this as an out-of-scope example |
| 80411200 | Driving-school services | Low | PPN 09/23 out-of-scope example |
| 45000000 / 90910000 | Construction work / cleaning services | Low | Usually no data access, but site systems or staff data can change this |
How to check a live notice:
- Open Find a Tender or Contracts Finder and search by keyword for "Cyber Essentials". Then run the same search again filtered to your CPV codes. Our guide on Contracts Finder vs Find a Tender explains which platform covers which contract values.
- In the notice, look under conditions of participation or the selection criteria. If you can't find it there, download the procurement documents and search the PDF for "Cyber", "PPN 014" and "Plus".
- Save the codes that keep coming up with the requirement as your alert set. The guide on picking CPV codes and setting alerts walks through this.
Common mistakes:
- Assuming that a non-IT code means no requirement. A cleaning contract that gives you access to an NHS staff rota system could still be in scope. Fix: search the documents, not just the notice.
- Assuming that a 72000000 code always means Plus. Many IT tenders accept basic Cyber Essentials. Fix: check which level the buyer actually names.
Cyber Essentials vs Cyber Essentials Plus: which do I need for a tender?
You need whichever level the tender documents name. Basic Cyber Essentials covers most SME tenders. Plus is for contracts the buyer judges to carry higher cyber risk.
Both levels test the same five technical controls: firewalls, secure configuration, security update management, user access control and malware protection (NCSC). The difference is how they are checked. PPN 014 says Plus "assesses the same technical controls as Cyber Essentials, but also comprises remote and on-site vulnerability testing" (PPN 014). PPN 09/23 said Plus should apply "when there is a higher risk of cyber security threats" (PPN 09/23).
| Cyber Essentials | Cyber Essentials Plus | |
|---|---|---|
| How it's checked | Self-assessment questionnaire, signed off by a board member or equivalent, marked by an independent assessor | Same questionnaire plus hands-on technical testing by an assessor |
| Price | From £320 + VAT, set by organisation size (NCSC) | Quoted by each certification body (NCSC) |
| Prerequisite | None | A current basic CE certificate. The Plus audit is usually completed within 3 months of it (ISMS.online) |
| When tenders ask for it | Most PPN 014 contracts | Higher-risk data, larger IT contracts, some NHS and defence work |
| Who it suits | Micro and small organisations meeting a standard requirement | Suppliers whose buyer explicitly requires it |
Pitfalls:
- Buying Plus "to look stronger". Unless the scoring rewards it, a pass/fail requirement met by basic CE scores the same. Fix: only pay for Plus when the documents require it, or when you plan to bid regularly for work that does.
- Letting the 3-month window lapse. If your Plus audit misses the window after your basic certificate, you may have to recertify at basic level first (ISMS.online). Fix: book the Plus audit date when you submit the basic assessment.
How much does Cyber Essentials certification cost?
Basic Cyber Essentials costs £320 to £600 + VAT depending on staff numbers. Plus is quoted separately and usually costs over £1,000.
IASME, the scheme's delivery partner, sets the basic price by organisation size. These are the bands listed as of September 2026 (Fig Group, citing IASME's purchase page). The £320 starting point is confirmed by the NCSC.
| Organisation size | Staff | Basic Cyber Essentials (ex VAT) |
|---|---|---|
| Micro | 0–9 | £320 |
| Small | 10–49 | £440 |
| Medium | 50–249 | £500 |
| Large | 250+ | £600 |
(as of October 2026; check the official IASME page)
Other costs to budget for:
- Cyber Essentials Plus. Each certification body sets its own price. For example, one licensed body lists Plus from £1,499.99 + VAT (Fig Group). Get at least two quotes, because prices depend on how many devices and sites are tested.
- Fixing gaps. The certificate fee is often the smaller cost. Old laptops that no longer get security updates, or cloud services without MFA switched on, have to be replaced or reconfigured before you can pass.
- Supported-route fees. Certification bodies that guide you through the process charge on top of the assessment.
- Annual renewal. PPN 014 says suppliers "must recertify every 12 months" (PPN 014), so treat this as a yearly cost of bidding.
There is one offsetting benefit. UK organisations with turnover under £20m that certify their whole organisation get free cyber liability insurance with the certificate (NCSC). Check the policy terms before you rely on it as your only insurance.
For example, a sole trader running a booking app for a council might pay £320 + VAT for the certificate, plus the cost of replacing an old laptop that can no longer be updated. A 30-person social enterprise would pay £440 + VAT, and possibly a few hundred pounds more for supported-route help. These are illustrations, not quotes.
How long does Cyber Essentials certification take before a tender deadline?
Plan for 1–2 weeks if your IT already meets the controls and 4–6 weeks if it doesn't. Add 4–6 more weeks if you also need Plus.
Industry guides put basic CE at about 2–4 weeks once you are prepared, and anywhere from 3 working days to 8 weeks depending on your starting point. The Plus technical audit adds roughly 4–6 weeks (ISMS.online; Hut Six). These are typical estimates, not guaranteed turnaround times.
The 2026 rules can make the process slower. From , the "Danzell" question set (Requirements v3.3) automatically fails you if MFA is available on an in-scope cloud service and you have not turned it on. Two security update questions are also automatic fails if high-risk or critical updates aren't installed within 14 days (Fig Group on v3.3; Forensic Control).
5 steps to certify before your deadline
- Confirm the level and the timing. In the tender documents, find out whether the buyer needs basic CE or Plus, and whether proof is due with your bid or before contract award. Write down the date.
- Preview the questions and test yourself. Read IASME's Preview the Self-Assessment questions page and use the free readiness resources listed on the NCSC overview. Make a list of every device, operating system and cloud service you use for work.
- Close the auto-fail gaps first. Turn on MFA in every cloud service that offers it, such as Microsoft 365, Google Workspace, accounting software and CRM. Install all critical or high-risk updates and switch on automatic updates. Remove or isolate devices that no longer receive security updates.
- Choose your route and submit. For the self-led route, register via IASME and complete the self-assessment. A board member or equivalent must sign it off before independent marking (NCSC). For the supported route, buy through an IASME-licensed certification body and work through its review.
- Save your certificate details and set a renewal reminder. Record the certificate number, issue date and expiry date. If you need Plus, book the audit straight away so it falls within the 3-month window.
Common mistakes and fixes:
- Starting after the clarification deadline. You lose the chance to ask the buyer about equivalents or timing. Fix: start step 1 the day you find the notice.
- Scoping too narrowly. Leaving out home-working laptops or a volunteer's personal phone that accesses your email can fail you, or leave your certificate covering only part of your organisation. Fix: list every device that touches work data, including bring-your-own devices.
- Forgetting one cloud tool. Under v3.3, a single service without MFA, such as an old Mailchimp or Dropbox login, is enough to fail. Fix: check MFA settings in each admin console against your inventory.
How do I evidence Cyber Essentials in a Selection Questionnaire (SQ)?
Give your certificate number, level, issue date and expiry date in the exact field the buyer asks for, and say which legal entity it covers.
For procurements under the Procurement Act 2023, the standard SQ has become the Procurement Specific Questionnaire (PSQ) (Procurement Pathway template). Buyers usually ask about Cyber Essentials as a condition of participation. Our Selection Questionnaire Procurement Act 2023 guide explains how the PSQ is structured. Buyers can check every certificate number against IASME's public register (NCSC), so the details you give must match the register exactly.
Steps:
- Find the question. Search the PSQ or ITT for "Cyber Essentials" and note whether it is a yes/no condition or a free-text answer.
- Check your entry on the IASME register. The organisation name and certificate number must match the legal name you give in your supplier details.
- Answer with the facts only. For example: "Yes. [Legal name] holds Cyber Essentials (basic), certificate number [number], issued [date], expiring [date]. Scope: whole organisation. We will recertify before expiry and keep certification valid for the contract term, as PPN 014 requires."
- Attach the certificate PDF if the portal allows uploads, even when it isn't strictly needed.
- If the buyer asks about subcontractors, list their certificates too. The government Model Services Contract requires "the supplier and relevant subcontractors" to be certified (PPN 014).
Pitfalls:
- Certificate expires during the evaluation. Certificates last 12 months. If yours expires between submission and award, renew early and tell the buyer.
- Name mismatch. "Smith Ltd" on the certificate versus "Smith Consulting Ltd" in your bid causes questions. Fix: certify under the exact legal entity that is bidding.
- Answering "equivalent" without evidence. PPN 014 lets buyers accept equivalents "verified by a technically competent and independent third party." Fix: if you rely on another standard, map it to the five controls and attach the independent evidence.
What happens if I don't have Cyber Essentials by the tender deadline?
If the tender makes certification a pass/fail condition at submission, a bid without it will normally be excluded. PPN 014 itself only requires evidence before contract award.
The difference matters. PPN 09/23 said evidence of a certificate "is required before contract award," with limited flexibility in exceptional cases such as a pending renewal (PPN 09/23). PPN 014 also says the certificate is essential "at the point when data is to be passed to the supplier" (PPN 014). Individual buyers can still ask for the certificate at bid stage, and their tender documents are what count.
What to do, based on what the documents say:
| Tender wording | What it means for you | Action |
|---|---|---|
| "Must hold Cyber Essentials at the time of submission" | No certificate means failing the condition | Certify before the deadline or don't bid |
| "Must hold by contract award / before commencement" | You can bid while certification is in progress | State your planned certification date in the SQ |
| "Cyber Essentials or equivalent" | Other independent evidence can work | Submit the evidence plus a mapping to the five controls |
| Requirement unclear | Risk of disqualification | Raise a clarification question before the clarification deadline |
For example, a tender deadline is 18 days away and the documents say "by contract award". A small consultancy that starts its assessment today can bid and declare its timeline. If the same tender said "at submission" and the consultancy has no MFA on its cloud services, it is safer to skip this one and get certified in time for the next.
If you join a framework agreement or dynamic market without CE, it can also block you from call-offs later, because buyers often check certificates at that stage.
Are there grants or free support for charities and VCSEs getting Cyber Essentials?
No national grant currently pays for Cyber Essentials for every charity. Free help comes from regional Cyber Resilience Centres, occasional funded programmes and sector discounts.
What exists, as of October 2026:
- Cyber Resilience Centres (CRCs). There is a police-led, not-for-profit CRC in every region of England and Wales (National Business Crime Centre). Core Membership is free and includes NCSC-based guidance (NEBRC). Limitation: membership doesn't pay your certification fee. Some CRCs offer paid services, so ask your regional centre what they cost.
- NCSC Funded Cyber Essentials Programme. Earlier rounds gave micro and small charities (1–49 employees) that process personal data free support towards certification (NCSC blog). The programme is currently closed, and its latest round targeted high-risk technology sectors, not charities (Innovate UK Business Connect). Who it doesn't suit: anyone who needs a certificate for a deadline this month. You can't plan around a programme that may not reopen.
- Charity discounts. IASME has run Charity Cyber Security Awareness Month offers, including a discount for registered charities that signed up during October (IASME 2024). Check whether the offer is running before you buy.
- Cyber Local (DSIT/Innovate UK). This fund paid for projects of £25,000–£150,000, not individual certificates, and the 2025–26 round closed on (UKRI). Don't count on it to pay for your own certificate.
- Free NCSC/IASME resources. These include the assessment question preview, a readiness tool and a free 30-minute session with a consultant (NCSC).
Next steps
Start with the tender: check what it requires, then fix your IT before you pay for an assessment.
Things to do today:
- Open one tender you want to bid for and search its documents for "Cyber Essentials". Note the level required and whether proof is due at submission or at award.
- Write a one-page list of every work device and cloud service, then turn on MFA wherever an admin console offers it.
- Read IASME's question preview and mark each answer you can't honestly say "yes" to. That list is your fix plan.
If you'd rather not do it yourself: the supported route through an IASME-licensed certification body adds expert review to the £320–£600 + VAT assessment fee. Supported-route prices vary by provider (as of October 2026; check the official page). It suits organisations with no in-house IT, several sites or bring-your-own-device staff and volunteers. It is less useful if you have a few modern devices with automatic updates, because the self-led route will probably be enough. If a buyer requires Plus, get quotes from at least two certification bodies. Plus is priced per job, and one provider lists it from £1,499.99 + VAT. Your regional CRC is a free first conversation before you spend anything.
Related guides on this site:
- How to Win Government Contracts UK: 7 Steps for SMEs (2026)
- Selection Questionnaire Procurement Act 2023: 7 SME Steps
- CPV Codes UK: 5 Steps to Pick Codes and Set Alerts 2026
- Framework Agreement How to Get On: 6 SME Steps (2026)
FAQ
Is Cyber Essentials mandatory for all government contracts?
No. PPN 014 applies to central government departments, their agencies and NHS bodies, and only to contracts involving personal data, OFFICIAL-level ICT or government business information. Councils and other public bodies can choose to require it, so always check each tender's documents.
Does Cyber Essentials expire and how often must it be renewed?
Yes. A certificate lasts 12 months, and PPN 014 says suppliers "must recertify every 12 months" to stay valid. For an in-scope contract, you must keep it renewed for the whole contract term.
Can a subcontractor hold Cyber Essentials instead of the prime contractor?
Usually not. The government Model Services Contract requires both the supplier and relevant subcontractors to be certified, so the bidding entity needs its own certificate. A subcontractor's certificate covers only that subcontractor's systems.
What's the difference between Cyber Essentials and ISO 27001 for tenders?
Cyber Essentials checks five specific technical controls and costs from £320 + VAT. ISO 27001 is a much wider management-system standard. PPN 014 says buyers must accept equivalents verified by a competent independent third party. Whether your ISO 27001 scope counts is the buyer's decision, so raise a clarification question and map your controls to the five Cyber Essentials areas.
Sources
- GOV.UK – PPN 014: Cyber Essentials Scheme (landing page)
- GOV.UK – PPN 014: Cyber Essentials Scheme (HTML)
- GOV.UK – PPN 09/23: Updates to the Cyber Essentials Scheme (HTML)
- NCSC – Cyber Essentials overview
- NCSC – Funded Cyber Essentials helps small charities
- IASME – Preview the Self-Assessment questions
- IASME – Charity Cyber Security Awareness Month 2024
- Procurement Pathway – (PA 2023) Procurement Specific Questionnaire
- Find a Tender service
- Fig Group – Cyber Essentials Cost UK 2026
- Fig Group – Cyber Essentials April 2026 changes explained
- Forensic Control – Cyber Essentials v3. update
- RightCyber – Cyber Essentials tender requirements and PPN 014
- ISMS.online – Cyber Essentials
- ISMS.online – Cyber Essentials Plus requirements
- Hut Six – How long is Cyber Essentials valid for?
- National Business Crime Centre – Cyber Resilience Centres
- North East Business Resilience Centre
- Innovate UK Business Connect – NCSC Funded Cyber Essentials Programme
- UKRI – Cyber Local 2025–2026
Spotted something out of date or wrong? Tell us at shigoto.ai.note@gmail.com. Guides are re-checked against official sources on a rolling schedule.