Fast Cyber Essentials for a client contract
What a supplier security clause actually obliges you to do, how much flexibility you really have on timing, and how to certify without stalling the signature.
Ready to buy?
Transparent, fixed pricing based on your organisation size. By default we give you access to the IASME portal to complete your Cyber Essentials assessment yourself, and once you submit it we aim to assess within one business day. You can preview the Cyber Essentials self-assessment questions to see where you stand first. Unless you add a gap analysis, there is no call or consultation; we simply send you the questionnaire to complete. Your submission is reviewed by a qualified, certified assessor, never fed into AI. Want us to check your setup first, or need it faster? Add a gap analysis or urgent turnaround below. Buy now to get started, or contact us if you have any questions first.
An appointed IASME Certification Body: your certificate comes directly from us. Verify our credentials on the BlockMark registry, and find us listed on the IASME website.
A client contract requiring Cyber Essentials is usually the most negotiable of all certification deadlines, because the other side wants the contract signed as much as you do. Before you rush, read the clause: most supplier security clauses require you to hold and maintain certification during the term, not to produce a certificate on the day of signature.
What the clause usually says, and what it means
| Clause wording | What it obliges | Room to negotiate |
|---|---|---|
| "The Supplier shall hold and maintain Cyber Essentials" | Certified for the term, renewed annually | Good: agree a date within the first 30 to 60 days |
| "The Supplier shall provide evidence of Cyber Essentials on execution" | Certificate at signature | Limited, but an interim letter often works |
| "...or an equivalent standard acceptable to the Customer" | ISO 27001 or IASME Cyber Assurance may satisfy it | Good, if you already hold one |
| "...shall flow down to sub-contractors" | Your suppliers need it too | Check before signing: this one bites later |
The flow-down clause is the one people miss. If you subcontract any part of delivery, you may be signing up to a requirement you then have to impose on your own suppliers, on your own timescale and at your own commercial risk.
How to keep the signature moving
Where the clause requires certification at execution and you are not certified, the usual resolution is a short side letter or an agreed condition subsequent: you sign, and you commit to certification within a defined window, typically 30 or 60 days. Most commercial clients accept this when you can name an appointed certification body and a date. It is far more persuasive than asking for the requirement to be waived.
Give them something verifiable: our listing on the IASME certification body directory and the BlockMark registry. A client's procurement team can confirm in a minute that you are dealing with a real certification body.
Maintaining it, which is the part contracts actually enforce
"Hold and maintain" means annual recertification for the life of the contract. The failure mode is not the first certificate, it is month thirteen, when the certificate has lapsed and a client audit picks it up. Diarise recertification at ten months, not twelve, so you are never renewing under pressure. We will remind you, but the contractual obligation is yours.
If the contract also requires independent testing, see penetration testing for client contracts: the two requirements often appear in the same schedule and are frequently confused with one another.
Price
| Organisation size | Certification | + urgent | + gap analysis |
|---|---|---|---|
| Micro, 1 to 9 staff | £320 | £420 | £720 |
| Small, 10 to 49 staff | £440 | £540 | £840 |
| Medium, 50 to 249 staff | £500 | £600 | £900 |
| Large, 250+ staff | £600 | £700 | £1,000 |
Urgent turnaround, £100, gets your assessment done within one business day of submission. Gap analysis, £300, tells you what needs fixing before you commit to a date in a contract.
Common questions
Can we sign before we are certified?
Often yes. Where the clause says hold and maintain rather than produce on execution, the usual resolution is a condition subsequent: sign now, certify within an agreed window of 30 or 60 days. Name your certification body when you propose it. Clients accept a concrete commitment far more readily than a request to drop the clause.
Our client will accept ISO 27001 instead. Should we do that?
Not to solve a deadline. ISO 27001 is a management system taking months and costing considerably more. If you already hold it, offer it. If you do not, Cyber Essentials is the fast route, and IASME Cyber Assurance is the sensible middle step if you want something closer to ISO without the overhead.
Does the requirement flow down to our subcontractors?
Read the clause. Flow-down obligations are common and easy to miss, and they make you responsible for your suppliers' certification. If it is there, raise it before signature: renegotiating it afterwards is much harder, and discovering it when a client audits you is worse.
What happens if our certificate lapses mid-contract?
You are in breach of the clause, and it is usually discovered at an audit or a renewal. Certification lasts twelve months. Set your own reminder at ten so recertification is never the thing holding up a client relationship.
How quickly can you certify us?
Assessment within one business day of submission as standard, or the same day with the urgent option. The variable is your remediation. If you are about to commit to a date in a contract, take the gap analysis first so the date you promise is one you can actually hit.
Related
Solusec
Typically replies within one business day
Had an incident, or need a penetration test or Cyber Essentials at short notice?
Tell us what you're dealing with and we'll come back to you.
+44 (0)1902 288763 ✉️ Email us
info@solusec.co.uk 📝 Leave a message
We'll reply within one business day
Deadline looming? Let's get you certified.
A quick call, an honest answer on what is achievable, a fixed price, and an assessor who moves fast.