Is Cyber Essentials Mandatory?

Cyber Essentials is not a blanket legal requirement, but it is mandatory in specific situations. Here is when you actually have to have it.

The general position

For most UK businesses, Cyber Essentials is not required by law. There is no general statute that says every organisation must hold it.

When it is mandatory

Since 2014, central government has required suppliers handling certain personal and sensitive information to hold Cyber Essentials, and this is written into many contracts and tenders. It is also common across the wider public sector, the NHS, and the MoD supply chain, where defence work brings additional requirements such as DCC Level 0.

When it is effectively required

Even where it is not legally mandatory, it is often unavoidable in practice: private clients make it a condition of working with you, and cyber insurers require it for cover. In those cases, no certificate means no contract or no cover.

Why treat it as a baseline anyway

Mandatory or not, Cyber Essentials covers the five controls that stop the majority of common attacks. Most businesses are better off holding it than not, regardless of who is asking.

Ready to buy?

Transparent, fixed pricing based on your organisation size. By default we give you access to the IASME portal to complete your Cyber Essentials assessment yourself, and once you submit it we aim to assess within one business day. You can preview the Cyber Essentials self-assessment questions to see where you stand first. There is no call or consultation as standard; we simply send you the questionnaire to complete. Your submission is reviewed by a qualified, certified assessor, never fed into AI. Need it faster? Add urgent turnaround below. Want us to review your setup against the controls before you apply? That is a gap analysis, quoted separately: ask for one using the contact button under the form.

An appointed IASME Certification Body: your certificate comes directly from us. Verify our credentials on the BlockMark registry, and find us listed on the IASME website.

Business name

Business size

Telephone

Optional add-on

Tick it if you need it.

Urgent turnaroundMoved to the front of the queue and assessed same day where your submission arrives before midday. +£100

Total: select your size + VAT

Want a gap analysis, a different way to pay, or a question answered first?

Gap analysis. We review your setup against the controls you will be assessed on before you apply and tell you exactly what needs fixing, so nothing is a surprise when you submit. It is quoted against your setup rather than sold as a fixed add-on, so ask us and we will price it.

Anything else. Paying by card here is the quickest route, not the only one. Tell us how you would rather pay and we will sort it. Same if you want a question answered before you buy, or a quote for on-site Cyber Essentials or IASME Cyber Assurance Level 1.

Common questions

Is Cyber Essentials required by law?

Not generally. It is mandatory for certain government and public sector contracts, and frequently required contractually elsewhere.

Is Cyber Essentials Plus mandatory?

For some government contracts, yes. The tender or contract will specify whether the hands-on Cyber Essentials Plus is needed.

Does GDPR require Cyber Essentials?

GDPR does not name it, but Cyber Essentials is a recognised way to demonstrate appropriate technical measures, which supports your data protection obligations.

Is Cyber Essentials mandatory?