By Rob Atkins, Founder & Principal Consultant
On 13 October 2025, senior ministers and the heads of the National Cyber Security Centre and the National Crime Agency wrote to the chief executives and chairs of every FTSE 100 and FTSE 250 company, and a number of other leading UK firms, with three requests. The third was to require Cyber Essentials in their supply chains. If you supply one of those companies, or supply someone who does, that request could reach you as a condition of doing business, even if you never bid for public work. It's a request and not a law, and every customer will move at its own speed. But it's better to be ready before they ask than to find out when they do. Here's what the letter says and what I'd do about it.
Use the government's Cyber Governance Code of Practice, and complete the free training that goes with it. The letter also asks boards to plan and rehearse how they'd keep operating and rebuild after a destructive attack.
This free service tells you about potential cyber attacks on your network. The letter strongly advises companies and their suppliers to register, so this one is meant for you too.
The letter calls Cyber Essentials the minimum standard businesses should seek. It says government already requires most of its suppliers to meet it, and asks the country's largest businesses to embed the same requirements in their own supply chains.
Liz Kendall, Rachel Reeves, Peter Kyle and Dan Jarvis signed for the government, alongside Dr Richard Horne, CEO of the National Cyber Security Centre, and Graeme Biggar, Director General of the National Crime Agency. Read the letter on GOV.UK
The letter says just 14% of UK businesses assess the cyber risks posed by their immediate suppliers. The government's voluntary Cyber Resilience Pledge now asks signatories to take a risk-based approach to requiring Cyber Essentials, which may include requiring it from all suppliers.
You don't have to bid for public work to feel this. A large customer can make Cyber Essentials part of its supplier checks or contract terms, and that can pass down from one tier to the next. Do I need Cyber Essentials?
The letter says organisations with Cyber Essentials are 92% less likely to make a claim on their cyber insurance. For a manufacturer, that's a good reason to look at it, even before a customer asks.
It doesn't make Cyber Essentials a legal requirement, it doesn't set a deadline for suppliers, and it doesn't mention Cyber Essentials Plus. Some buyers ask for Plus anyway, so check what yours expects.
A customer's supplier review won't necessarily fit around your diary. Getting a manufacturer ready for Cyber Essentials typically takes four to eight weeks, because of the work on patching, logins, admin rights and firewalls before you apply.
If a request lands with a short deadline, or a contract renewal is close, that's a tough position to be in with a customer you can't afford to lose.
Sign up to NCSC Early Warning, because it's free. Ask your biggest customers whether they plan to require Cyber Essentials from suppliers. Then find out where you stand with the free Bid & Tender Readiness Screening.
If there are gaps, I'll bring in a vetted cyber specialist from the Cure Alliance. YBSL is a CyberSmart Registered Partner for Cyber Essentials and Cyber Essentials Plus. One relationship. Every specialist. Ready before the question arrives.
No. It's a request from government to the boards of leading companies. It becomes binding on you if a customer writes it into its supplier terms or contract, or if a tender makes it a condition.
It can, if you supply a company that acts on the letter or supply someone who does. Whether it reaches you, and when, depends on what your customers decide to do.
A government-backed scheme that certifies you have key protections in place against common cyber attacks. It covers firewalls, secure configuration, security update management, user access control and malware protection.
A voluntary government pledge for major organisations. Signatories commit to board responsibility for cyber risk, signing up to Early Warning and a risk-based approach to requiring Cyber Essentials across their supply chains.
Sources: Ministerial letter on cyber security to leading UK companies (GOV.UK) · Cyber Resilience Pledge information pack (GOV.UK) · Cyber Essentials requirements for IT infrastructure v3.3 (NCSC)
Written by Rob Atkins, Founder & Principal Consultant, Your Best Solution Limited. Last updated .