Is Cyber Essentials mandatory?

Cyber Essentials is not a blanket legal requirement, but it is mandatory in specific situations. Here is when you actually have to have it.

The general position

For most UK businesses, Cyber Essentials is not required by law. There is no general statute that says every organisation must hold it.

When it is mandatory

Since 2014, central government has required suppliers handling certain personal and sensitive information to hold Cyber Essentials, and this is written into many contracts and tenders. It is also common across the wider public sector, the NHS, and the MoD supply chain, where defence work brings additional requirements such as DCC Level 0.

When it is effectively required

Even where it is not legally mandatory, it is often unavoidable in practice: private clients make it a condition of working with you, and cyber insurers require it for cover. In those cases, no certificate means no contract or no cover.

Why treat it as a baseline anyway

Mandatory or not, Cyber Essentials covers the five controls that stop the majority of common attacks. Most businesses are better off holding it than not, regardless of who is asking.

Common questions