_edited.png)
Who Needs Cyber Essentials? A Guide for UK Businesses
Updated: 5 hours ago
Cyber Essentials is relevant to far more organisations than those working directly with government or handling particularly sensitive information. Whether you're a small business supplying professional services, an IT company managing customer systems, a healthcare provider or an organisation looking to secure public sector contracts, Cyber Essentials can play an important role in demonstrating that appropriate cyber security measures are in place.
For some organisations, certification is a commercial requirement imposed by a customer, procurement framework or government contract. For others, it is a way to strengthen their security, demonstrate good practice and build trust with customers and suppliers.
But who actually needs Cyber Essentials? Is it a legal requirement, which industries are most likely to need it, and when is Cyber Essentials Plus necessary?
This guide explains who should consider certification, the frameworks and procurement arrangements which can require it, and how to determine which level is appropriate for your organisation.
What is Cyber Essentials?
Cyber Essentials is a UK Government-backed cyber security certification scheme, developed by the National Cyber Security Centre (NCSC) and delivered through certification bodies accredited by IASME.
It helps organisations protect themselves against common cyber attacks by assessing five key technical security controls:
Firewalls: Preventing unauthorised access to networks and devices.
Secure Configuration: Ensuring computers, servers and other devices are securely configured.
Security Update Management: Identifying and applying security updates to address known vulnerabilities.
User Access Control: Ensuring users only have access to the systems and information they need.
Malware Protection: Protecting devices against malicious software and other threats.
There are two levels of certification:
Cyber Essentials (CE) is achieved through a verified self-assessment questionnaire, which evaluates an organisation's implementation of the five technical controls.
Cyber Essentials Plus (CE+) includes the same underlying requirements but adds an independent technical audit. This involves testing a sample of devices and systems to verify that the controls are working effectively in practice.
Both certifications are valid for 12 months and require annual renewal.
Who needs Cyber Essentials?
There is no general legal requirement for every UK business to hold Cyber Essentials. However, certification is mandatory for certain government contracts and may be required by customers, procurement frameworks, industry specific arrangements and contractual obligations.
The organisations most likely to need Cyber Essentials include:
Businesses bidding for central government contracts.
Suppliers working with the NHS and wider healthcare sector.
Organisations supplying products or services to the Ministry of Defence.
IT service providers and managed service providers (MSPs).
Businesses handling personal or confidential customer information.
Technology companies supplying software, cloud services or IT infrastructure.
Organisations working within regulated or security-conscious supply chains.
Businesses seeking to demonstrate their cyber security credentials during procurement.
Importantly, you do not need to work directly with the Government or hold particularly sensitive information to benefit from certification. A requirement can be passed down through a supply chain, meaning smaller businesses and subcontractors may need certification even when their immediate customer is a private sector organisation.
1. Government contractors and public sector suppliers
One of the most established reasons for obtaining Cyber Essentials is the requirement associated with UK Government procurement.
The Government introduced Cyber Essentials requirements for certain types of public sector contracts to reduce cyber security risks within its supply chains.
Under Procurement Policy Note (PPN) 014, central government departments, their executive agencies, non-departmental public bodies and NHS bodies should consider requiring suppliers to hold Cyber Essentials or Cyber Essentials Plus for contracts involving relevant cyber security risks.
This includes contracts where suppliers:
Handle personal information belonging to government employees, ministers or special advisers.
Supply ICT systems or services designed to store or process information classified as OFFICIAL.
Handle information relating to government operations, public service delivery or public finances.
Where the requirement applies, suppliers must demonstrate they hold Cyber Essentials, Cyber Essentials Plus or have equivalent controls in place before the contract is awarded.
Certification must also be maintained throughout the contract, where required.
Example:
A company providing payroll services to a government department may need Cyber Essentials because it handles personal information belonging to government employees.
Similarly, an IT consultancy supplying infrastructure or support services to a government organisation may be required to demonstrate certification as part of the procurement process.
It is worth noting that PPN 014 does not impose a blanket Cyber Essentials requirement on every public sector contract. Requirements should be relevant and proportionate to the risks associated with the particular procurement.
2. NHS suppliers and healthcare organisations
Healthcare is another sector where Cyber Essentials can be particularly important.
NHS organisations manage significant volumes of sensitive personal information, including confidential patient records, clinical information and operational data. As a result, organisations supplying services to the NHS are often subject to specific information security and data protection requirements.
One of the key frameworks is the Data Security and Protection Toolkit (DSPT).
NHS Data Security and Protection Toolkit (DSPT)
The DSPT is an online assessment used by organisations across the health and care sector to demonstrate that they are handling personal information securely and meeting the relevant data security standards.
It is relevant to NHS organisations, healthcare providers and organisations commissioned to deliver services on behalf of the NHS.
Cyber Essentials and Cyber Essentials Plus are recognised within NHS data security guidance as frameworks that can help organisations demonstrate their security arrangements.
In particular, Cyber Essentials Plus can provide evidence against certain DSPT requirements and may reduce the need to provide separate responses to some assessment questions.
However, it is important to understand the distinction: Cyber Essentials Plus is not a blanket requirement for completing the DSPT.
External reference: The NHS provides further guidance on frameworks that can help organisations meet DSPT requirements.
Whether a supplier needs Cyber Essentials, Cyber Essentials Plus or another form of assurance will depend on the services being provided, the information being accessed and the contractual requirements imposed by the relevant NHS organisation.
NHS suppliers should also familiarise themselves with the NHS Cyber Security Supply Chain Charter and the NHS's cyber security expectations for suppliers, which outline the importance of maintaining appropriate security controls throughout the healthcare supply chain.
Who in healthcare might need Cyber Essentials?
Examples include:
IT support companies providing services to GP surgeries.
Software developers supplying applications to NHS organisations.
Healthcare technology companies managing patient information.
Managed service providers supporting NHS infrastructure.
Recruitment and payroll providers handling healthcare employee information.
Organisations providing outsourced administrative services to healthcare providers.
Example:
A software company supplying a patient management platform to an NHS Trust may be asked to demonstrate its cyber security credentials as part of the procurement process.
The organisation may be required to hold Cyber Essentials Plus, particularly where the service involves access to sensitive information or critical IT systems.
3. Defence suppliers and Ministry of Defence contractors
Organisations working with the Ministry of Defence (MoD), defence contractors or businesses operating within the wider defence supply chain may also need Cyber Essentials.
The defence sector has specific cyber security expectations because suppliers can have access to commercially sensitive information, operational data and information relating to defence projects.
One important development is the introduction of Defence Cyber Certification (DCC).
DCC is designed to provide a structured approach to assessing and demonstrating the cyber security maturity of organisations supplying the UK defence sector.
The scheme includes different certification levels, with requirements depending on the nature of the work and the sensitivity of the information being handled.
· Cyber Essentials is a prerequisite for Defence Cyber Certification Level 0 - 1.
· Cyber Essentials Plus is a prerequisite for Defence Cyber Certification Level 2-3.
This means organisations looking to achieve DCC should consider their Cyber Essentials certification early in the process.
Who might need Cyber Essentials in the defence supply chain?
Manufacturers supplying components to defence contractors.
Engineering companies working on defence projects.
IT and technology providers supporting defence organisations.
Professional services firms handling sensitive defence-related information.
Subcontractors providing services to prime contractors.
Businesses bidding for MoD contracts.
Example:
A manufacturing company supplying specialist components to a defence contractor may be asked to achieve Defence Cyber Certification as part of its contractual obligations.
Before progressing with DCC, the business will need to have the required Cyber Essentials certification in place.
Importantly, requirements can vary between contracts and prime contractors. Businesses should establish which DCC level and associated security requirements apply to their particular work.
4. IT companies and Managed Service Providers (MSPs)
IT companies and Managed Service Providers are particularly important within the cyber security supply chain.
These organisations often have privileged access to customer networks, endpoints, cloud environments and business-critical systems.
A compromise of an IT provider can therefore have consequences for multiple customers.
Cyber Essentials provides a recognised baseline for demonstrating that an organisation has implemented fundamental technical security controls.
For MSPs, certification can also help demonstrate their commitment to protecting customer environments and managing the risks associated with privileged access.
Examples include:
Managed IT support companies.
Microsoft 365 support providers.
Cloud hosting companies.
IT infrastructure consultants.
Software development businesses.
Technology resellers with access to customer systems.
Cyber security service providers.
Example:
An MSP providing remote IT support to a law firm may be asked to demonstrate Cyber Essentials certification before being awarded a contract.
The law firm may want assurance that the MSP has appropriate controls in place because its engineers have access to business systems and potentially confidential client information.
In some cases, customers may specifically request Cyber Essentials Plus to obtain independent technical verification.
5. Professional services and businesses handling sensitive information
Cyber Essentials is also relevant to organisations outside the traditional IT and technology sectors.
Businesses that handle personal information, financial records, confidential documents or commercially sensitive information can all benefit from certification.
Examples include:
Accountancy firms.
Solicitors and legal practices.
Financial advisers.
Recruitment agencies.
HR and payroll providers.
Insurance brokers.
Management consultancies.
Marketing agencies handling customer databases.
These businesses may not operate complex IT environments, but they still rely on email, cloud applications, laptops, mobile devices and remote access to manage important information.
A cyber attack could result in the loss of confidential information, disruption to business operations, financial losses and reputational damage.
Cyber Essentials helps organisations address common technical vulnerabilities and demonstrate that basic security measures are in place.
It can also provide a useful differentiator when competing for contracts with larger organisations that expect their suppliers to demonstrate appropriate cyber security standards.
6. Organisations bidding for public sector frameworks and tenders
Cyber Essentials can also be a requirement within public sector procurement frameworks and individual tender opportunities.
It is important to distinguish between a framework's general requirements and the requirements of an individual contract awarded through that framework.
For example, an organisation may be eligible to join a procurement framework without holding Cyber Essentials, but a specific contract advertised through that framework may require certification.
Examples of procurement arrangements and contractual structures where cyber security requirements may arise include:
Crown Commercial Service (CCS)
The Crown Commercial Service (CCS) manages a wide range of public sector procurement frameworks, covering everything from IT services and cloud computing to professional services and specialist technology solutions.
Cyber Essentials requirements can vary between frameworks, individual lots and specific contracts.
CCS procurement teams determine whether suppliers must hold Cyber Essentials or Cyber Essentials Plus, depending on the nature of the services being delivered and the associated cyber security risks.
Some frameworks make certification a requirement for all participating suppliers, while others introduce additional requirements for specific lots or individual call-off contracts.
For example, the Cyber Warfare and Assurance Services 3 (CWAS3) framework requires all suppliers to hold Cyber Essentials, with Cyber Essentials Plus required for its Defence, International and Nuclear Lots.
This demonstrates why suppliers should not assume that standard Cyber Essentials will satisfy every procurement requirement.
Businesses looking to supply services through CCS frameworks should review the relevant framework documentation and tender specifications to establish which certification level is required.
Where Cyber Essentials Plus is specified, standard Cyber Essentials certification will not normally be sufficient.
G-Cloud
G-Cloud is a Crown Commercial Service procurement framework that allows public sector organisations to purchase cloud-based services, including cloud hosting, software and IT support.
Although Cyber Essentials is not a blanket requirement for suppliers joining the G-Cloud framework, individual call-off contracts can make certification a mandatory condition of appointment.
Depending on the nature of the services being procured, buyers may specify either Cyber Essentials or Cyber Essentials Plus as a requirement.
For example, a supplier providing cloud hosting, software development or IT support services involving access to government information may be required to demonstrate Cyber Essentials Plus certification before being awarded a contract.
Published G-Cloud call-off contracts demonstrate that Cyber Essentials Plus can be specified alongside other security standards, including ISO 27001.
Organisations supplying services through G-Cloud should therefore review individual tender and call-off requirements carefully. Holding certification can be essential to securing certain public sector contracts, even where it is not a general requirement of framework membership.
Model Services Contract (MSC)
The Government's Model Services Contract is used for certain complex public sector service arrangements. Its security provisions can require suppliers and relevant subcontractors to hold Cyber Essentials or Cyber Essentials Plus, or demonstrate equivalent controls.
Individual public sector tenders
Local authorities, NHS organisations, government departments and other public sector bodies may introduce Cyber Essentials requirements within their procurement documentation.
For businesses considering public sector opportunities, it is worth checking security requirements early rather than waiting until the tender submission stage.
Obtaining certification can take time, particularly where existing systems need to be reviewed or improved.
Solicitors and legal practices providing Legal Aid-funded services
Law firms and legal practices providing publicly funded legal services may also need Cyber Essentials to satisfy Legal Aid Agency (LAA) contractual requirements.
This is particularly relevant to organisations providing immigration and asylum advice, where firms routinely handle sensitive personal information, confidential case records and documentation relating to vulnerable individuals.
The Legal Aid Agency has established data security requirements for contracted providers, with Cyber Essentials forming part of its approach to protecting information held and processed by legal practices.
Specific Legal Aid Agency contracts can make Cyber Essentials a mandatory requirement, which may need to be demonstrated during the procurement process or before the commencement of contract work.
The LAA also recommends Cyber Essentials Plus as a higher level of assurance, providing independent technical verification that an organisation's security controls are operating effectively.
Who might need Cyber Essentials?
Solicitors providing Legal Aid-funded immigration and asylum advice.
Law firms delivering publicly funded civil legal services.
Legal practices providing criminal legal aid services.
Organisations contracted by the Legal Aid Agency to deliver specialist legal advice.
For legal practices, obtaining Cyber Essentials can therefore be more than a way of demonstrating good cyber security practice. It can be an important part of meeting contractual obligations and maintaining eligibility to deliver publicly funded legal services.
Firms should check the specific requirements of their Legal Aid Agency contract to establish whether standard Cyber Essentials or Cyber Essentials Plus is required.
7. Small businesses and SMEs
Cyber Essentials is not exclusively intended for large organisations.
In fact, small and medium sized businesses can benefit significantly from certification.
Smaller organisations are often part of larger supply chains, providing specialist services, products or support to organisations with more demanding security requirements.
A small business may therefore find that Cyber Essentials becomes a commercial requirement when attempting to secure a new customer or renew an existing contract.
Even where certification is not mandatory, it can help demonstrate that the business takes cyber security seriously.
It can also provide a structured way to review fundamental security controls without having to implement a large or complex information security management system.
For SMEs looking to grow, enter new markets or work with larger customers, Cyber Essentials can be a valuable starting point.
Do I need Cyber Essentials or Cyber Essentials Plus?
The appropriate certification depends on the requirements of your customer, contract or procurement arrangement.
Cyber Essentials | Cyber Essentials Plus |
Verified self-assessment questionnaire | Verified self-assessment questionnaire |
Assesses five technical security controls | Assesses the same five technical security controls |
No independent technical audit | Includes an independent technical audit |
Demonstrates that required controls have been implemented | Provides additional assurance that controls are working effectively |
Often suitable where basic certification is required | Often preferred where stronger independent assurance is required |
If a contract specifically requests Cyber Essentials Plus, holding the standard Cyber Essentials certificate will not normally satisfy that requirement.
Equally, there is little benefit in paying for Plus certification if the organisation only requires standard Cyber Essentials and has no additional reason to obtain the higher level of assurance.
It is always worth checking the exact wording of your contractual or procurement requirements before starting the certification process.
Is Cyber Essentials a legal requirement?
No. Cyber Essentials is not a universal legal requirement for UK businesses.
However, it can become a mandatory contractual or procurement requirement.
For example:
A government department may require suppliers to hold Cyber Essentials under PPN 014.
An NHS organisation may specify Cyber Essentials Plus within a supplier contract.
A defence contractor may require suppliers to achieve Defence Cyber Certification.
A private sector customer may make Cyber Essentials a condition of its supplier approval process.
A procurement tender may specify Cyber Essentials as a minimum security requirement.
Where certification is required, failing to obtain it could prevent an organisation from progressing with a tender, securing a contract or continuing to supply a particular customer.
Businesses should therefore review their existing contracts, customer requirements and future procurement opportunities to establish whether certification is necessary.
Why choose Delta Cyber Security for Cyber Essentials certification?
Delta Cyber Security provides Cyber Essentials and Cyber Essentials Plus certification to organisations across the UK.
As an IASME-registered Certification Body, we work with businesses of different sizes and across a range of industries, helping them understand the requirements, complete their assessments and achieve certification.
Our experience includes:
Over 600 Cyber Essentials certificates issued.
Over 300 Cyber Essentials Plus certificates issued.
Assessors with a minimum of seven years' experience delivering certification.
Support for organisations working towards contractual and procurement deadlines.
We understand that certification can sometimes feel like an administrative exercise, particularly for businesses approaching it for the first time.
Our approach is straightforward. We help organisations understand what is required, identify any areas that need attention and navigate the certification process.
For organisations pursuing Cyber Essentials Plus, we also provide a scoping discussion ahead of the technical audit to establish the systems and devices that will need to be assessed.
Whether you need certification to satisfy a customer requirement, prepare for a government tender, support an NHS contract or progress towards Defence Cyber Certification, our team can help.
Speak to Delta Cyber Security
If you're unsure whether your organisation needs Cyber Essentials or Cyber Essentials Plus, speak to our team.
We can help establish which certification is appropriate for your organisation and explain what is involved in achieving it.
Visit our Cyber Essentials and Cyber Essentials Plus pages or contact us to arrange a free initial scoping discussion.
Frequently Asked Questions
Does every UK business need Cyber Essentials?
No. Cyber Essentials is not a legal requirement for every UK business. However, it is required for certain government contracts and may be specified by customers, procurement frameworks and supply chain partners.
Do NHS suppliers need Cyber Essentials?
Not all NHS suppliers need Cyber Essentials. Requirements depend on the services provided, the information accessed and the contractual arrangements. The NHS Data Security and Protection Toolkit recognises Cyber Essentials and Cyber Essentials Plus as useful security assurance frameworks. Cyber Essentials Plus is not a blanket requirement for completing the DSPT.
Do government contractors need Cyber Essentials?
Suppliers bidding for certain public sector contracts must hold Cyber Essentials, Cyber Essentials Plus or demonstrate equivalent controls. PPN 014 identifies the types of government procurement where these requirements should be considered.
Do subcontractors need Cyber Essentials?
Yes, potentially. A prime contractor or customer may pass cyber security requirements down to subcontractors. This is particularly relevant in government, defence and technology supply chains.
Do IT companies need Cyber Essentials?
IT companies and MSPs can be required to hold Cyber Essentials by customers, procurement arrangements or contractual obligations. Certification also helps demonstrate that appropriate technical security controls are in place.
Do solicitors and accountancy firms need Cyber Essentials?
There is no universal requirement for solicitors or accountancy firms to hold Cyber Essentials. However, individual clients, contracts and procurement arrangements may require it. Certification can also help demonstrate a commitment to protecting confidential customer information.
Is Cyber Essentials Plus mandatory?
No, not universally. However, some contracts and customers specifically require Cyber Essentials Plus rather than standard Cyber Essentials. It provides additional assurance through independent technical testing.
How long does Cyber Essentials certification last?
Both Cyber Essentials and Cyber Essentials Plus certificates are valid for 12 months. Organisations must renew annually to maintain their certification.
Can a small business obtain Cyber Essentials?
Yes. Cyber Essentials is designed for organisations of all sizes, including sole traders and small businesses. The certification requirements apply according to the organisation's IT environment and scope.
Can Cyber Essentials help my business win contracts?
Yes. Certification can help organisations meet supplier security requirements, qualify for procurement opportunities and demonstrate their approach to cyber security. It is particularly relevant when working with government, healthcare, defence and larger corporate customers.
