Cyber Essentials for government and public sector contracts

Last reviewed 2 November 2026 against the Cyber Essentials requirements v3.3 (Danzell question set).

1. What Procurement Policy Note 014 (PPN 014) says

On 17 February 2025, the Cabinet Office published Procurement Policy Note 014 (PPN 014): Cyber Essentials Scheme (GOV.UK), replacing the older PPN 09/23 and PPN 09/14 notes for procurements commenced on or after 24 February 2025 under the Procurement Act 2023.

In plain English, PPN 014 sets out three rules for public sector buyers (central government departments, executive agencies, non-departmental public bodies and NHS bodies):

• When it is required: Buyers must require Cyber Essentials (or Cyber Essentials Plus) where a contract involves handling personal information of citizens or government employees, delivering certain ICT products or services, or where the buyer assesses a heightened cyber risk.
• When you must hold it: Suppliers must demonstrate a valid certificate prior to contract award (and renew it annually for the life of the contract). Some Invitation to Tender (ITT) documents ask for the certificate number at submission; others allow you to bid while mid-assessment provided you are certified before award. Always check the exact wording in the tender pack.
• Scope requirement: The certificate scope must cover the whole organisation or, at minimum, the entire business unit and IT infrastructure delivering the public contract.

2. Welsh public sector buyers, Sell2Wales and local councils

Across Wales and the wider UK public sector, local authorities, housing associations, universities and Welsh Government tenders published on Sell2Wales routinely adopt the same baseline: Basic Cyber Essentials for standard professional, construction and consultancy frameworks, and Cyber Essentials Plus for higher-sensitivity IT, healthcare or large personal-data contracts.

3. Basic or Plus: how to tell which the tender needs

• Cyber Essentials (Basic): The verified self-assessment. Usually required where your firm handles standard business or personal data as part of a service contract.
• Cyber Essentials Plus: Adds the hands-on independent technical audit within 90 days (3 months) of passing Basic. Required where the tender explicitly states “Cyber Essentials Plus” due to higher data volumes or direct integration with government systems.

4. A realistic tender-deadline plan: 2, 4 and 8 weeks

• 2 weeks to deadline (urgent): Possible for Basic Cyber Essentials if your PCs are already on Windows 11 / supported macOS and you use Microsoft 365. You must fix cloud MFA, admin accounts and 14-day update policies immediately and submit within days so the assessor has 2–5 working days to mark.
• 4 weeks to deadline: Comfortable for Basic Cyber Essentials, or tight-but-achievable for Plus if you start technical remediation on Day 1.
• 8 weeks to deadline: Ideal window to complete Basic, remediate any third-party app vulnerabilities found by Microsoft Defender, and complete the hands-on Cyber Essentials Plus audit without rushing.