Cyber Essentials for government contracts (PPN 014)

Cyber Essentials is not mandatory for every government contract. PPN 014 says central government departments, their executive agencies, non-departmental public bodies and NHS bodies should require it where a contract carries certain risks, mainly personal data and ICT handling government information. Evidence is needed before award. Other buyers, councils included, may choose to follow the same approach, so always read the pack.

Cyber Essentials and Cyber Essentials Plus in one minute

Cyber Essentials assesses five technical controls. It is a self-assessment questionnaire, verified by an independent certification body (PPN 014, Annex B). Cyber Essentials Plus covers the same five controls and adds remote and on-site vulnerability testing. It is more rigorous and is intended for higher-risk situations.

Which contracts need it (PPN 014)

Which buyers

PPN 014 is mandatory for what it calls in-scope organisations: central government departments, executive agencies, non-departmental public bodies and NHS bodies (para 3). Other public sector bodies may choose to apply it (para 6).

Which contracts

It applies where a contract involves (para 12):

• citizens’ personal information, such as home addresses, bank details or payment information;
• the personal information of government employees, ministers or special advisers;
• ICT systems or services designed to store or process data at the OFFICIAL level;
• information about the day-to-day business of government, service delivery or public finances.

The PPN’s annex gives examples, and the list is not exhaustive.

Not every contract

PPN 014 says the scheme should not be applied to all contracts as a matter of course (para 20), and that over-burdening suppliers or deterring SMEs and voluntary and community organisations should be avoided (para 21). If a buyer’s tender demands it for a low-risk contract, a clarification question is reasonable.

A quick self-check

Ask yourself whether the work would involve any of these:

1. Holding or processing citizens’ personal information, such as addresses or bank details, on the buyer’s behalf.
2. Handling staff, payroll or expenses data for a government body.
3. Running or supporting ICT systems that hold data at the OFFICIAL level.
4. Working with information about government service delivery or public finances.

If the answer is no to all four, a tender that nevertheless demands Cyber Essentials may be worth a clarification question. If yes, expect it to be asked for, particularly from central government and NHS buyers.

What it doesn’t cover

PPN 014 is explicit that Cyber Essentials does not assure specific products or services (para 17) and is not designed for advanced, targeted attacks (para 19). A buyer may therefore ask for more than Cyber Essentials on a sensitive contract.

When you need to show it

Under the PPN, certification is required before contract award (Q5). That is stricter than contract insurance, which the Procurement Act 2023 says can’t be required to be in place before award (s.22(3)(b)).

Two other timing points from the PPN:

• Certificates must be renewed every 12 months for the life of the contract (para 14; Q7).
• In exceptional cases a risk-based decision can let a contract start while certification is being renewed, but you must hold valid certification when data is passed to you (Q5).

A lapsed certificate means you count as uncertified (Q7), so diary your renewal date. The PPN also says a buyer may set shorter intervals on a risk basis, case by case (Q7).

The PPN is about what the contract involves, not what sector you’re in. A recruitment, care or marketing firm that handles citizens’ personal information for a central government body could be asked for Cyber Essentials as readily as an IT supplier.

How many notices name a certification? In the week to 10 Oct 2026, 29 of 470 live notices (about 6%) named one in the notice itself (as of 10 Oct 2026; how we count). Where there is a requirement it may be in the tender documents; for in-scope buyers, PPN 014 (Annex C, Q3) says any applicable requirement must be specified in the tender notice for any competitive tendering procedure.

Not certified yet? Your options

Get certified before award. If you win a contract needing it, you’ll need the certificate before the buyer awards. Cost and time vary by certification body and by the size of your business, so get current quotes and ask how long assessment takes. Don’t leave it until you’ve won. Certification is provided through government-approved certification bodies accredited by IASME (PPN 014, Annex C, Q4). For a rough scale, PPN 014 (February 2025) said basic certification for smaller companies was then expected to cost £300 to £500 plus VAT (Annex C, Q6). Prices may have changed.

Show equivalent controls. PPN 014 says suppliers without Cyber Essentials can show equivalent controls by other means (para 15) and that in-scope organisations must accept equivalents under section 56 of the Act (Annex C, Q10). You must satisfy the buyer you meet the requirements, normally through a technically competent, independent third party (Q10). Cyber Essentials Plus requirements must always be verified by one. The Act also says a buyer cannot require particular qualifications without allowing for equivalents (s.22(4)(c)). Check how the pack asks for equivalent evidence.

Bid with a certified partner. A supplier is treated as meeting a condition to the extent an associated supplier does. Associated suppliers include those who tender together, or where the buyer is satisfied one will subcontract to the other or guarantee the other’s performance (s.22(8)-(9)). Whether that works for a security requirement depends on who handles the data, so check the pack.

Check the buyer is in scope. Ask whether PPN 014 applies at all. If it’s a council, for example, it may only apply the approach by choice, and the pack should say what it requires.

Older procurements

PPN 014 replaced PPN 09/14 and PPN 09/23 (para 4). Procurements commenced and contracts awarded before 24 February 2025 fall outside the Act, and for those the PPN refers you to PPN 09/23 (para 8). You may still see older write-ups citing “PPN 09/14”; PPN 014 is the latest Cyber Essentials PPN in the collection as of 11 Oct 2026.

A short checklist

• Does the notice or pack mention Cyber Essentials, Cyber Essentials Plus or an equivalent?
• Is the buyer a central government body, agency, non-departmental public body or NHS body?
• Would you handle personal data or OFFICIAL-level information for the contract?
• When does the pack want evidence, and what form must it take?
• If you’re not certified, can you be before award, or do you have a route via equivalent controls or a partner?

Where this fits with other certifications

Cyber Essentials is one of several things buyers ask for. For quality management, see ISO 9001. If you work in IT, our IT services page lists live notices, and our guide to NHS tenders for suppliers covers one of the in-scope buyer groups.

Our tender eligibility checker is coming soon. Until then, tell us your trade and postcode to join the free weekly list of live tenders, starting soon.