PPN 014 (Procurement Policy Note 014)
PPN 014 is the Cabinet Office procurement policy note that tells central government bodies to require Cyber Essentials from suppliers in relevant contracts. It covers departments, agencies, non-departmental public bodies and NHS bodies for procurements commenced from 24 February 2025, replacing PPN 09/14 and PPN 09/23. Suppliers show evidence before award and renew annually for the contract.
- Term
- PPN 014
- Also known as
- Procurement Policy Note 014, PPN 09/14, PPN 09/23
- Category
- Scheme and certification
- Requirement area
- Scheme vocabulary
- Reviewed against
- Requirements v3.3
What does the term PPN 014 mean in Cyber Essentials?
PPN 014 is the Cabinet Office procurement policy note that tells central government bodies to require Cyber Essentials from suppliers in relevant contracts.
How does PPN 014 apply to Cyber Essentials?
In plain terms. It is a rule for buyers, not for suppliers. A procurement policy note tells public bodies how to buy. PPN 014 tells the bodies it covers to put Cyber Essentials into relevant contracts, so suppliers who want that work need the certificate.
How it relates to Cyber Essentials. PPN 014, published on 17 February 2025, replaced PPN 09/14 and PPN 09/23 and restated the policy in Procurement Act 2023 terminology; the note says it is not a change in policy. It targets four kinds of contract: those where the supplier handles citizens' personal information, handles personal information of government staff, supplies ICT systems or services for OFFICIAL data, or deals with the day-to-day business of government. Buyers must accept equivalent controls and must not apply it to every contract as a matter of course. The PPN sets no general flow-down rule, though its FAQ notes that the Model Services Contract requires relevant subcontractors to hold Cyber Essentials. Bodies outside that list, such as local authorities, are not bound by it, though the note says "Other public sector bodies may wish to apply the approach".
The question set picks this up at A1.10, which asks for your two main reasons for applying. "Required for government contract" is one option, and A1.10.2 then asks for the contracting organisation and contract number.
Plus or basic? Annex B describes Cyber Essentials Plus as "a more rigorous assessment" that "should be used when there is a higher risk of cyber security threats", so read the tender to see which level the buyer asks for.
Common mistakes. Waiting for the tender to arrive. Certification takes time, and the PPN 014 FAQ says evidence is required before contract award. Another is certifying a partial scope that leaves out the systems the contract will use. Checked against the GOV.UK text on 3 November 2026.
See Cyber Essentials for UK government contracts, who needs Cyber Essentials and DSPT.
Related terms
- DSPT (Data Security and Protection Toolkit)The DSPT, or Data Security and Protection Toolkit, is the NHS's annual online self-assessment for organisations that have access to NHS patient data and systems.
- Question set versionsQuestion set versions are the named releases of the Cyber Essentials question set, which IASME updates when the NCSC revises the requirements.
- Re-markA re-mark is a second marking of a failed Cyber Essentials self-assessment after the applicant has corrected the answers.
- RecertificationRecertification is the yearly renewal of Cyber Essentials, done by completing a full new self-assessment before the current certificate expires.
- RemediationRemediation is the work of fixing security gaps, such as replacing unsupported software or turning on MFA, so a control meets the standard.
- Requirements for IT InfrastructureCyber Essentials: Requirements for IT Infrastructure is the NCSC document that sets out exactly what an organisation must do to meet Cyber Essentials.
Frequently asked questions
PPN 014 is the Cabinet Office procurement policy note that tells central government bodies to require Cyber Essentials from suppliers in relevant contracts.
In the 2026 Danzell question set, PPN 014 comes up at A1.10, A1.10.2. Read those questions against the definition above so your answers use the term the way the assessor will.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.