Do you need Cyber Essentials for government contracts?

Often, yes. Since 2014 the government has required it for certain contracts, and it's become a standard question in public sector tenders.

The rule in brief

• The policy is set out in a Procurement Policy Note. PPN 014 applies to procurements that started on or after 24 February 2025. It replaced PPN 09/23, which had replaced the original PPN 09/14.
• It applies to central government departments, their agencies, non-departmental public bodies and NHS bodies.
• Buyers should require Cyber Essentials, or Cyber Essentials Plus for higher-risk work, where a contract involves handling personal information (such as citizens' home addresses) or providing certain IT systems and services.
• Suppliers may be able to show equivalent controls instead, but a certificate is by far the simplest proof.

Local councils and others

PPN 014 doesn't formally bind local authorities, housing associations or universities, but many follow the same approach and ask for Cyber Essentials in their tenders.

Sector-specific rules

Some areas go further: see our guides for defence suppliers, NHS suppliers and legal aid firms.

Timing matters

• Tenders usually ask for a certificate that's valid at contract award, and you may need to keep it valid for the life of the contract.
• A certificate lasts 12 months. Set a reminder to renew a month or two early.
• Cyber Essentials can be done in days if you're ready, but allow time to fix any gaps first.
• For Plus, the audit has to be done within three months of passing the basic certificate.

Check each tender carefully: it should say whether it needs Cyber Essentials or Plus, and when.