Do I Need Cyber Essentials for Government Contracts?

For many government and public sector contracts, Cyber Essentials is mandatory. Here is when you need it, and whether Cyber Essentials or Cyber Essentials Plus.

The rule for government contracts

Since 2014, central government has required suppliers who handle certain personal or sensitive information to hold Cyber Essentials. Where it applies, it is written into the contract or the tender, and you cannot be awarded the work without it.

Cyber Essentials or Cyber Essentials Plus?

Some contracts require the standard Cyber Essentials, others specify the hands-on, independently tested Cyber Essentials Plus. Always check the tender wording, and if you are not sure, we can help you work out which level you need.

MoD and defence supply chain

Defence work brings extra requirements. Suppliers in the MoD supply chain are increasingly asked to reach DCC Level 0, with Cyber Essentials as the prerequisite, alongside standards such as Def Stan 05-138.

Wider public sector

Beyond central government, the NHS, local government, education and many other public bodies commonly require Cyber Essentials from their suppliers.

How to be ready

The safest approach is to certify before you bid, so the certificate is in hand when the tender asks for it. If a deadline is already looming, we can fast-track your certification.

Common questions

Is Cyber Essentials always required for government contracts?

Not always, but it is required whenever the contract involves handling certain personal or sensitive information, which covers a large share of public sector work.

Do I need Cyber Essentials Plus for government work?

Sometimes. The contract or framework will state whether the hands-on Cyber Essentials Plus is required rather than the standard certification.

Can I get certified in time for a tender?

Usually yes. If your deadline is tight, we prioritise your application and can fast-track it.

Do I need Cyber Essentials for government contracts?