Why Does My Client Require Cyber Essentials?

It's a supply-chain policy, not personal

You've almost certainly been asked because your client has adopted a supply-chain security policy. Three forces are behind it:

• The Cyber Resilience Pledge. Launched by the government at CYBERUK in April 2026, it asks major organisations to audit Cyber Essentials coverage across their supply chains and take a risk-based approach to requiring it from suppliers — using a Cyber Essentials Supplier Check Tool. Signatories are now working through their supplier lists, which is why the requests are landing.
• The NCSC Supply Chain Playbook. The NCSC is openly calling on large organisations to make Cyber Essentials a standard requirement for suppliers, because a weakness in one supplier can cascade through everyone they serve.
• Procurement rules (PPN 014). Public-sector buyers must require Cyber Essentials or CE Plus for higher-risk contracts, and that requirement flows down to subcontractors who handle personal or OFFICIAL data.

In other words: for a growing number of buyers, Cyber Essentials has moved from ‘nice to have’ to the minimum entry requirement for doing business.

What Cyber Essentials actually is

It's a Government-backed certification, run by the NCSC's partner IASME, covering five technical controls that block the majority of common attacks: firewalls, secure configuration, security update management, user access control and malware protection. Most organisations can achieve it quickly — provided someone tells you honestly what to change first.

What to do now

Send us the requirement (the questionnaire line or contract clause) and your deadline. We'll tell you which level you actually need, get your controls in order, and support you through the assessment — often within days when things are already in reasonable shape.

Common questions