Cyber Essentials for your sector
The scheme is the same for everyone. What differs is who asks you for the certificate, what your estate looks like, and which questions your sector tends to answer badly. One page per sector, written from assessment experience.
- Formal mandates
- PPN 014 (central government, agencies, NDPBs, NHS bodies); MOD contracts via Def Stan 05-138; Legal Aid Agency contracts
- Sector guides
- 13 sectors: 4 with a named mandate, 9 driven by customer and funder demand
- Requirements
- Identical for every sector: Requirements v3.3, Danzell question set
- Scheme fee
- £320 to £600 plus VAT by staff headcount, not by sector
Cyber Essentials is required of suppliers to UK central government and NHS bodies on in-scope contracts under PPN 014, and of Ministry of Defence suppliers on contracts carrying DEFCON 658, and legal aid providers need it under the Legal Aid Agency's data security requirements. In charities, schools and most other sectors no body formally mandates it; customers, funders and insurers ask for it instead.
Which sectors need Cyber Essentials?
Each guide leads with who requires the certificate and the source, then the scope problems and the questions that sector commonly fails.
Sectors with a named mandate
4 pages- Mandated
Law firms
Cyber Essentials is not an SRA rule, but the Legal Aid Agency makes it a mandatory data security requirement for legal aid providers, and the Law Society suggests it to firms.
Read the guide - Mandated
Healthcare and care providers
Organisations with access to NHS patient data complete the Data Security and Protection Toolkit, which does not require Cyber Essentials but exempts some evidence items for holders of Cyber Essentials Plus.
Read the guide - Mandated
Local government suppliers
PPN 014 does not bind local authorities, but it says other public bodies may wish to apply its approach, and some council tenders ask for Cyber Essentials in supplier selection.
Read the guide - Mandated
Defence suppliers
Contracts carrying DEFCON 658 apply Def Stan 05-138 Issue 4, which requires Cyber Essentials at every cyber risk profile level (0 to 3) and Cyber Essentials Plus at Levels 2 and 3.
Read the guide
Sectors driven by customer and funder demand
9 pagesCharities and not-for-profits
No regulator makes Cyber Essentials compulsory for charities.
Read the guideSchools, academies and multi-academy trusts
The Department for Education does not require schools in England to hold Cyber Essentials.
Read the guideAccountancy and financial advisers
No professional body or regulator mandates Cyber Essentials for accountancy practices, but clients and insurers ask for it, and HMRC now requires multi-factor authentication on agent online services.
Read the guideConstruction and contractors
No regulator mandates Cyber Essentials in construction.
Read the guideManufacturing
Manufacturers usually meet Cyber Essentials as a contract requirement from defence, public sector or large commercial customers rather than from a regulator.
Read the guideMSPs and IT providers
No law yet requires managed service providers to hold Cyber Essentials, and the Cyber Security and Resilience Bill would regulate medium and large MSPs without mandating the certificate.
Read the guideRecruitment
Recruitment agencies hold large volumes of candidate personal data.
Read the guideHousing associations
The Regulator of Social Housing does not mandate Cyber Essentials.
Read the guideSoftware and SaaS companies
G-Cloud 15 makes Cyber Essentials mandatory for software and support suppliers handling personal or OFFICIAL data, and Cyber Essentials Plus mandatory for hosting lots.
Read the guide
Frequently asked questions
Suppliers to UK central government, its agencies, non-departmental public bodies and NHS bodies, under PPN 014 for relevant procurements from 24 February 2025, and Ministry of Defence suppliers on contracts carrying DEFCON 658, where Def Stan 05-138 requires it at every cyber risk profile level. Legal aid providers must hold it under the Legal Aid Agency's data security requirements. Other sectors have no formal mandate; demand comes from customers, funders and insurers.
No. Every applicant is assessed against the same NCSC Requirements for IT Infrastructure v3.3 and the same Danzell question set. What differs by sector is who asks for the certificate, what the estate looks like, and which questions tend to be answered badly.
No. The question set asks for your organisation type and sector in section A1 so the certificate and the certificate search are accurate. The controls are marked the same way whatever you select.
The IASME scheme fee is £320 plus VAT for 0 to 9 staff, rising to £600 for 250 or more. Assessor-supported certification and Cyber Essentials Plus are priced by the Certification Body. The fee does not vary by sector.
Next steps
- NCSCNCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 · April 2026Read on ncsc.gov.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials Danzell Question Set 2026Read on iasme.co.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials frequently asked questionsRead on iasme.co.uk (opens in a new tab)
Get certified at a fixed price
Precursor is an IASME Certification Body: Cyber Essentials from £1,500 and Cyber Essentials Plus from £3,000, with the IASME fee included, a free re-test if gaps are found and a written fixed price after a 20-minute scoping call.
- IASME Certification Body
- CREST accredited
- UK offices in Leeds, Newcastle, London and Edinburgh