By Rob Atkins, Founder & Principal Consultant
Often, but not on every contract. Under PPN 014, central government departments, their agencies, non-departmental public bodies and NHS bodies should ask for Cyber Essentials or Cyber Essentials Plus where a contract involves personal information about citizens or government staff, ICT that stores or processes OFFICIAL data, or information about the day-to-day business of government. A contract to supply parts that touches none of that may not trigger the rule at all. Councils can choose to follow the same approach, and your bigger customers can set their own terms, so the answer for you sits in the tender documents. Here's how I'd work it out if I were in your seat.
PPN 014 tells these buyers to require it where the contract meets one of its data or ICT triggers. They should have the certificate in hand before award, and it has to be renewed every year for the life of the contract.
PPN 014 only says they may wish to apply the same approach, so it isn't automatic. Some ask for it on everything and some don't. Check the conditions of participation on each tender rather than assuming.
Your customer can make it a condition of doing business, whether or not any government rule applies to the job. If a prime is on a government contract, expect the question to come down the chain to you too.
MOD contracts and subcontracts can carry their own cyber requirements under DEFSTAN 05-138. If you're in a defence supply chain, ask which level applies to you, and don't assume a Cyber Essentials certificate settles it.
A certificate expires after 12 months and you have to go through it again each year. Get the renewal in the diary well ahead of it, because a lapse tends to show up the week a tender closes.
You can certify the whole business or a well-defined, separately managed part of it, split off by a firewall or VLAN, with the boundary agreed before the assessment starts. If the buyer's data sits outside that boundary, your certificate doesn't answer their question.
The requirements are written for IT and don't mention production machinery. The test is whether a device can connect to or from the internet, so a connected machine could fall in scope. Settle that at the start. And remember, passing doesn't mean your machines are protected. OT and industrial cybersecurity
Under the current requirements (version 3.3), cloud services hosting your data or services can't be excluded, and logging in to them must always use multi-factor authentication. If you last looked at this a couple of years ago, go through it again.
When Jaguar Land Rover was hit by a cyber attack in 2025, vehicle production at its major UK plants stopped for around five weeks. The Cyber Monitoring Centre estimated the cost to the UK at £1.9 billion and said more than 5,000 organisations were affected. Some suppliers cut pay or laid off staff.
That same October, ministers wrote to the UK's biggest companies asking them to require Cyber Essentials across their supply chains. The government's voluntary Cyber Resilience Pledge now asks signatories to take a risk-based approach to this, which may include requiring it from all suppliers. So if you supply a large company, or supply someone who does, expect the question to reach you, even if you never bid for public work. Some buyers will want Cyber Essentials Plus, so check what yours expects before you choose.
JLR isn't a client of ours, and I'm not suggesting Cyber Essentials would have prevented the attack.
Most manufacturers look at this when a tender asks for it. The form itself isn't what holds you up: IASME says it can take about an hour if your answers are ready, and its assessors aim to come back in about three days.
What takes the time is getting the answers right: patching, admin rights, firewalls and logins. Allow four to eight weeks for that, and two to three months for Cyber Essentials Plus. A tender window can easily be shorter.
Work out which of your target buyers need it, set the scope around the data they care about, fix the gaps and then keep it renewed. YBSL is a CyberSmart Registered Partner for Cyber Essentials and Cyber Essentials Plus, and I bring in a cyber specialist from the Cure Alliance who knows what a factory looks like. Cyber Essentials support
One relationship. Every specialist. You get the certificate in place before the tender lands, and you keep it there.
No. It's a government-backed certification scheme, and no law makes every business hold it. It becomes a requirement when a buyer writes it into a tender or contract, and then it can decide whether you're allowed to bid.
If your answers are ready, the self-assessment might take about an hour and results usually come back in about three days. If you fail, you get two working days to fix the issues and resubmit. For a manufacturer starting from scratch, I'd allow four to eight weeks, because of the work needed before you apply.
Follow the tender. Cyber Essentials is a verified self-assessment, and Plus adds independent technical testing. PPN 014 covers both, and the buyer decides what it needs based on risk. If the documents aren't clear, ask the buyer through the tender's clarification process.
PPN 014 lets suppliers show equivalent controls another way, normally verified by a technically competent, independent third party. Evidence equivalent to Plus must always be independently verified. It's usually simpler to hold the certificate than to argue the point in the middle of a bid.
It depends on the contract. The government's Model Services Contract requires relevant subcontractors to hold it or an equivalent. Your own certificate doesn't cover third parties such as your cloud providers, so check what the buyer expects of them.
Sources: PPN 014: Cyber Essentials Scheme (GOV.UK) · Cyber Essentials requirements for IT infrastructure v3.3 (NCSC) · Cyber Essentials FAQs (IASME) · Industry Security Notice 2026/02: DEFCON 658 (GOV.UK) · HMG cyber letter to FTSE 350 (GOV.UK) · Cyber Resilience Pledge information pack (GOV.UK) · Jaguar Land Rover cyber attack financial impact (IT Pro)
Written by Rob Atkins, Founder & Principal Consultant, Your Best Solution Limited. Last updated .