Is Cyber Essentials Mandatory? Government Contracts and Procurement Rules

Is Cyber Essentials mandatory? Not by law: no UK legislation requires organisations in general to hold it. It becomes mandatory through contracts: under Procurement Policy Note (PPN) 014, UK central government and NHS buyers must require Cyber Essentials, Cyber Essentials Plus or equivalent controls for contracts that handle personal information or official government information. Local authorities, prime contractors and private companies can set the same condition for their suppliers. If a contract requires it, you need a current certificate before award and must renew it every 12 months for the life of the contract.

Sovereign Secure is an IASME-licensed Cyber Essentials certification body. This guide reflects PPN 014 as published on GOV.UK, last checked on 13 October 2026.

Is Cyber Essentials a legal requirement?

No. No UK law requires organisations in general to hold Cyber Essentials, and no regulator fines you for not having it. What UK GDPR does require is appropriate technical and organisational measures to protect personal data. Cyber Essentials is one way to show the technical baseline, but it does not make you compliant on its own.

In practice, Cyber Essentials is mandatory whenever a customer makes it a condition of contract. This is where the requirement comes from:

Will Cyber Essentials become mandatory?

Not by law, on anything published so far. When we checked GOV.UK and the MOD’s published guidance on 13 October 2026, we found no plan to make Cyber Essentials a legal requirement for every organisation; the government is instead asking large organisations to require it from their suppliers. What keeps growing is the number of contracts that require it:

In practice, if you sell to the public sector, defence or large companies, plan as if Cyber Essentials is mandatory, because the contract usually makes it so. If you already hold it, keep it current: our Cyber Essentials renewal guide explains the timing.

Which procurement policy note requires Cyber Essentials?

PPN 014, “Cyber Essentials Scheme”. It was published on 17 February 2025, and in-scope organisations apply it from 24 February 2025, the date from which the Procurement Act 2023 and the Procurement Regulations 2024 apply to new procurements. It replaced PPN 09/14, the original 2014 note, and PPN 09/23, the September 2023 update.

Three details matter when you bid:

• Older procurements still follow PPN 09/23. Where a procurement commenced, or a contract was awarded, before 24 February 2025, PPN 09/23 applies instead.
• The policy itself has not changed. The government has required Cyber Essentials for certain contracts since 2014; PPN 014 updates the terminology for the new Act.
• A fuller update is expected. PPN 014 says a more comprehensive update will follow the NCSC’s redevelopment of the scheme, so check the current version on GOV.UK when you bid.

Is Cyber Essentials mandatory for government contracts?

Yes, for in-scope contracts: those with one of the characteristics listed in paragraph 12 of PPN 014. Most government Cyber Essentials requirements come from PPN 014; defence contracts add their own under DEFCON 658. Buyers in scope (central government departments, their executive agencies, non-departmental public bodies and NHS bodies) must make sure suppliers meet the Cyber Essentials technical requirements where the contract involves:

Annex A of the PPN gives examples. In scope: CV writing services and contact centres holding citizens’ names, addresses, dates of birth and National Insurance numbers, and car hire for staff holding home addresses and driving licence numbers. Not in scope: communications planning with no access to personal data, or a sole-trader driving instructor whose use of IT is limited and incidental.

PPN 014 is also clear that buyers must not take a blanket approach. Cyber Essentials should only be required where it is relevant and proportionate to the contract, so it does not deter small businesses and voluntary organisations from bidding. Any requirement must be stated in the tender notice, which means you will normally know from the start of a competition.

When is Cyber Essentials Plus required?

When the buyer asks for it. PPN 014 lets in-scope organisations require either level, and says Plus “should be used when there is a higher risk of cyber security threats”. It describes Plus as the same technical controls with remote and on-site vulnerability testing added.

Read the tender wording carefully. “Cyber Essentials” and “Cyber Essentials Plus” are different requirements, and a basic certificate does not meet a requirement for Plus. Plus also takes longer: you pass the basic assessment first, then complete the Cyber Essentials Plus audit within three months of that certificate, so start early if the tender names Plus.

Can ISO 27001 or another standard be used instead?

Sometimes, but it is harder than holding the certificate. To comply with section 56 of the Procurement Act 2023 (technical specifications), in-scope buyers must accept equivalents, and you need only show them, to their satisfaction, that you meet the Cyber Essentials requirements. PPN 014 says this should normally be verified by a technically competent and independent third party, and that independent verification is required in all cases where the requirement is Plus.

ISO 27001 does not count automatically. PPN 014 explains that the five Cyber Essentials controls are often not all within an ISO 27001 scope and are unlikely to be tested, so most ISO 27001 businesses will need Cyber Essentials as well or must demonstrate equivalent controls. The PPN itself calls a certification requirement the quickest and most effective way for buyers to manage the risk. Our comparison of Cyber Essentials vs ISO 27001 sets out where the two overlap.

Do the NHS, the MOD and local authorities require Cyber Essentials?

• NHS: PPN 014 applies to NHS bodies’ contracts. Separately, organisations with access to NHS patient data and systems complete the Data Security and Protection Toolkit; see our NHS DSPT guide.
• Ministry of Defence: defence contracts that include DEFCON 658 set a Cyber Risk Profile from Level 0 to Level 3. Cyber Essentials is required at every level and Plus at Levels 2 and 3, alongside further controls that suppliers can evidence through Defence Cyber Certification. The MOD has asked all industry partners to reach Level 0 by 31 December 2026. We certify Defence Cyber Certification Levels 0 and 1 for MOD suppliers, as well as Cyber Essentials and Cyber Essentials Plus.
• Local authorities and other public bodies: PPN 014 does not bind them, but it says other public sector bodies may apply the same approach, so check each tender. Schools are not legally required to certify, but colleges must hold Cyber Essentials under their funding agreement; see Cyber Essentials for schools.
• Legal Aid Agency: the 2025 Standard Crime Contract, which began on 1 October 2025, requires criminal legal aid firms to hold at least basic Cyber Essentials; see Cyber Essentials for law firms.
• Charities: no law requires Cyber Essentials, but the Charity Commission’s cyber crime guidance lists it as a step for medium and large charities, and some funders and public-sector contracts ask for it; see Cyber Essentials for charities.
• Prime contractors and subcontractors: the government’s Model Services Contract, used for complex services contracts (particularly ICT and business process outsourcing worth more than £20 million), requires the supplier and relevant subcontractors to hold Cyber Essentials or Cyber Essentials Plus, or equivalent. If you subcontract on such a contract, expect the requirement to be passed down.

Do private companies require Cyber Essentials from suppliers?

Increasingly, yes. On 23 October 2024 Barclays, Lloyds Banking Group, Nationwide, NatWest, Santander UK and TSB published a Cyber Essentials supply chain commitment, supported by DSIT and the NCSC, to promote the scheme and build it into their supplier requirements. Many other companies ask for it in supplier onboarding. It is a contract condition rather than a law, but the effect for a supplier is the same: no certificate, no contract. For the commercial case beyond tenders, see our guide to the benefits of Cyber Essentials.

How do you evidence Cyber Essentials in a tender?

Give the buyer what they need to verify it themselves, and make sure it lines up with the contract.

Our guide on how to check a Cyber Essentials certificate shows exactly what a buyer sees when they search for you.

What if your certificate expires just before the contract starts? PPN 014 lets a buyer, in exceptional circumstances, make a risk-based decision to let a contract start while a renewal is in progress, but you must hold the certificate, or equivalent, by the time data is passed to you. Do not rely on that: renew before your expiry date.

Why get certified with Sovereign Secure?

• We are the certification body. As an IASME-licensed certification body, we assess your submission and issue your certificate, which appears on the official certificate search.
• Fast enough for tender deadlines. Gold submissions are assessed within one working day, Silver within two and Bronze in three to five, from £320 + VAT.
• Plus when the contract asks for it. We deliver Cyber Essentials Plus audits too, so both stages sit with one provider.
• An established company. Sovereign Secure Ltd was incorporated in 2012 (Companies House 08334453), is ISO 27001 certified and is a PCI SSC Qualified Security Assessor (QSA) company.

Bidding for a contract that requires Cyber Essentials?

Start your Cyber Essentials certification with us, or send an enquiry through the form below with your tender deadline and the level it asks for, and we will recommend the package that meets it. For quick answers on cost, scope and renewal, see our Cyber Essentials FAQs, or call +44 161 523 5276.