_edited.png)
Is Cyber Essentials Mandatory in the UK?
Short answer: no, Cyber Essentials is not currently mandatory for every business in the UK.
However, Cyber Essentials can become a requirement if your organisation works with the UK government, certain public sector organisations, or customers who make certification a condition of doing business.
For many organisations, Cyber Essentials is not optional. Like appropriate insurance coverage, it can be a requirement for securing or retaining certain contracts.
In this guide, we explain when Cyber Essentials is mandatory, who needs it, whether it is a legal requirement, and the difference between Cyber Essentials and Cyber Essentials Plus.
Is Cyber Essentials a legal requirement in the UK?
Cyber Essentials is not a universal legal requirement for UK businesses.
There is no general UK law stating that every company must obtain Cyber Essentials certification.
Instead, Cyber Essentials is a government-backed cybersecurity certification scheme designed to help organisations protect themselves against common cyber threats.
The important distinction is that while certification is not universally required by law, it can become mandatory through procurement requirements or contractual obligations.
The UK Government's Procurement Policy Note 014 (PPN 014), which applies to central government departments, their executive agencies, non-departmental public bodies and NHS bodies, sets out requirements for cybersecurity controls in certain higher-risk contracts. For contracts with particular characteristics, suppliers may be required to hold Cyber Essentials or Cyber Essentials Plus certification, or demonstrate that equivalent controls are in place.
So, the answer to "Is Cyber Essentials mandatory?" depends on your organisation, your customers and the contracts you are bidding for.
When is Cyber Essentials mandatory?
There are several circumstances where Cyber Essentials may effectively become mandatory for an organisation.
1. You are bidding for certain UK government contracts
One of the most important situations is government procurement.
The UK Government has required suppliers bidding for certain types of public sector contracts to demonstrate Cyber Essentials or Cyber Essentials Plus certification since 2014. The current PPN 014 requirements apply to relevant procurements commencing from 24 February 2025.
The requirements are particularly relevant to contracts involving areas such as:
· Personal information belonging to members of the public
· Personal information belonging to government employees
· ICT systems and services handling information classified as OFFICIAL
· Information relating to government business, public finances and service delivery
Where Cyber Essentials certification is specified, suppliers are generally required to renew it annually for the duration of the contract.
This means a business may not legally be required to hold Cyber Essentials simply because it operates in the UK, but it may need certification to qualify for a particular government contract.
2. Your customer requires it
Cyber Essentials is increasingly being used as part of supplier and third-party cybersecurity requirements.
A private organisation can choose to require its suppliers to hold Cyber Essentials certification as part of its procurement process or contractual terms.
The National Cyber Security Centre's Cyber Essentials Supply Chain Playbook specifically discusses organisations requiring suppliers to hold Cyber Essentials certification, or demonstrate that equivalent controls have been implemented, as part of procurement and supplier risk management.
For a supplier, this can make Cyber Essentials a commercial requirement even when there is no legal requirement to hold it.
For example, a customer may state:
"Suppliers must hold a current Cyber Essentials certificate."
If that requirement forms part of the procurement or contract, certification can effectively become a condition of winning or retaining the work.
Does the NHS require Cyber Essentials?
Cyber Essentials requirements can also apply to relevant NHS procurement.
PPN 014 applies to NHS bodies as well as central government departments, executive agencies and non-departmental public bodies. For contracts falling within the relevant scope, suppliers may need to demonstrate Cyber Essentials, Cyber Essentials Plus or equivalent cybersecurity controls.
However, this does not mean every company supplying goods or services to the NHS automatically needs Cyber Essentials.
The requirement depends on the nature and risk profile of the contract.
Businesses should therefore check the specific procurement documentation rather than assuming that certification is either universally required or universally unnecessary.
Do I need Cyber Essentials to work with the government?
Possibly.
If you are bidding for a UK government contract, you should check the procurement documentation carefully.
For contracts within the scope of PPN 014, the relevant technical requirements can specify Cyber Essentials or Cyber Essentials Plus certification, or allow suppliers to demonstrate equivalent controls. Evidence of certification or equivalent controls is required before relevant data is passed to the supplier.
Importantly, government procurement guidance does not require Cyber Essentials to be applied as a blanket requirement to every contract.
The requirement should be relevant and proportionate to the cybersecurity risks associated with the contract.
If you are considering bidding for government work, it is therefore worth checking the cybersecurity requirements before submitting a tender.
Leaving certification until after winning a contract can create unnecessary pressure, particularly where certification is required before you can receive customer data.
Is Cyber Essentials mandatory for all businesses?
No.
A small business, limited company, charity or other organisation does not automatically need Cyber Essentials certification simply because it operates in the UK.
However, there are good commercial reasons why an organisation may choose to become certified even when certification is not mandatory.
Cyber Essentials can help demonstrate that an organisation has implemented a defined baseline of cybersecurity controls.
It can also help with:
Customer security questionnaires
Supplier due diligence
Tender applications
Cyber insurance requirements
Demonstrating cybersecurity controls to customers
Reducing exposure to common cyber threats
Meeting contractual cybersecurity requirements
The UK Government's own evaluation of Cyber Essentials found that certification can reduce the cybersecurity due diligence burden placed on suppliers and can increase customer confidence when working with certified organisations.
Is Cyber Essentials Plus mandatory?
Cyber Essentials Plus is a higher level of assurance than standard Cyber Essentials.
Cyber Essentials Plus is not universally mandatory either. Where a contract requires Cyber Essentials, the basic certification may be sufficient. However, some contracts or customers may specifically require Cyber Essentials Plus because it provides additional assurance through independent technical testing.
The key difference is the way the certification is assessed.
Cyber Essentials
Cyber Essentials involves an organisation completing a self-assessment against the scheme's technical requirements, with the assessment reviewed and certified through an approved certification body.
Cyber Essentials Plus
Cyber Essentials Plus includes the Cyber Essentials assessment as well as an independent technical assessment of the organisation's IT environment.
This provides a higher level of assurance that the controls described in the assessment are actually implemented.
Therefore, if a tender specifically states "Cyber Essentials Plus", standard Cyber Essentials certification should not be assumed to be sufficient.
What does Cyber Essentials cover?
Cyber Essentials focuses on five key technical areas designed to protect organisations against common cyber threats:
Firewalls
Secure configuration
Security update management
User access control
Malware protection
The requirements are reviewed and updated regularly.
The current Cyber Essentials technical requirements are version 3.3, which came into effect on 27 April 2026.
This is important because Cyber Essentials is not a certification that an organisation obtains once and keeps indefinitely. Certification needs to be renewed annually, and organisations need to ensure their IT environment continues to meet the applicable requirements.
How long does Cyber Essentials certification last?
Cyber Essentials certification lasts for 12 months.
If certification is being used to meet a contractual requirement, it is particularly important to maintain certification without a gap.
For relevant government contracts, PPN 014 states that where Cyber Essentials certification is required, it must be renewed annually for the duration of the contract.
Businesses should therefore consider Cyber Essentials as an ongoing cybersecurity process rather than a one-off compliance exercise.
Should my business get Cyber Essentials if it isn't mandatory?
For many organisations, certification can still be worthwhile even when it is not compulsory.
The decision should come down to your customers, contracts, risk profile and commercial requirements.
Cyber Essentials can be particularly useful if you:
Supply larger organisations
Work with government or public sector organisations
Handle sensitive or personal information
Regularly complete customer security questionnaires
Are planning to bid for tenders
Want to demonstrate a recognised baseline of cybersecurity
Need to satisfy a customer's supplier security requirements
It can also prevent a situation where an organisation discovers that certification is required only after a potentially valuable contract has been identified.
What happens if a customer asks for Cyber Essentials?
First, establish exactly what they require. There is an important difference between:
"Cyber Essentials is preferred" and "Cyber Essentials certification is mandatory."
You should also establish whether they require:
Cyber Essentials
Cyber Essentials Plus
Equivalent cybersecurity controls
If certification is a contractual requirement, check when the certificate needs to be in place. For government procurement, the relevant guidance states that evidence of certification or equivalent controls is required before the relevant data is passed to the supplier.
How Delta Cyber Security can help
Delta Cyber Security is an IASME-registered certification body providing Cyber Essentials and Cyber Essentials Plus certification to UK organisations.
We can help organisations understand whether Cyber Essentials is required, identify potential issues before assessment and complete the certification process.
For organisations working towards a tender deadline or contractual requirement, Delta also offers Priority Scoring to help reduce the time between completing the assessment and receiving feedback.
If you are unsure whether your organisation needs Cyber Essentials, the first step is to check your customer or tender requirements and understand which level of certification is actually required.
Frequently asked questions
Is Cyber Essentials legally required in the UK?
No. Cyber Essentials is not a universal legal requirement for all UK businesses. However, certification can become a contractual or procurement requirement, particularly for certain government and public sector contracts.
Is Cyber Essentials mandatory for government contracts?
It can be. Certain government contracts require suppliers to hold Cyber Essentials or Cyber Essentials Plus certification, or demonstrate equivalent cybersecurity controls. The exact requirement depends on the contract.
Does every NHS supplier need Cyber Essentials?
No. Cyber Essentials requirements depend on the nature and risk of the contract. PPN 014 applies to NHS bodies for relevant procurements, but it does not mean every NHS supplier automatically requires certification.
Is Cyber Essentials Plus compulsory?
No. Cyber Essentials Plus is not universally compulsory. However, a customer or contract may specifically require Cyber Essentials Plus rather than standard Cyber Essentials.
How often does Cyber Essentials need to be renewed?
Cyber Essentials certification is valid for 12 months and needs to be renewed annually.
Can a business use equivalent controls instead of Cyber Essentials?
For relevant government procurement under PPN 014, suppliers may be able to demonstrate equivalent controls instead of holding Cyber Essentials certification. The specific procurement requirements should always be checked.
Is Cyber Essentials worth getting if it isn't mandatory?
It can be. Certification can demonstrate a recognised baseline of cybersecurity controls and may make it easier to satisfy customer due diligence, tender and supplier security requirements.
The bottom line
Cyber Essentials is not mandatory for every UK business.
However, that does not mean it is optional in every situation.
If you work with government organisations, NHS bodies or larger businesses, Cyber Essentials may be a requirement of the contract or procurement process. Even where certification is not mandatory, customers may use it as part of their supplier security requirements.
The safest approach is to check your contractual and procurement requirements before you need the certification.
If a tender says Cyber Essentials is required, do not assume that you can obtain it after winning the contract. Check the deadline, the required certification level and whether Cyber Essentials Plus is specifically required.
For UK organisations looking for Cyber Essentials certification or guidance on the requirements, Delta Cyber Security's Cyber Essentials service provides certification and support from an IASME-registered certification body.
