Cyber Essentials for construction and contractors
Who asks construction and contractors for the certificate, which level to choose, what to gather first, the scope problems the sector brings and the questions it commonly fails.
- Mandated by
- No formal mandate; customer and funder requirements
- Common fails
- A6.4AUTO-FAILA7.6A4.2
- Typical scope
- Site laptops and tablets, Site routers, Estimating software on old PCs, Subcontractors on your systems
- Cyber Essentials
- From £1,500, 1 to 2 weeks, IASME fee included
- Cyber Essentials Plus
- From £3,000, 2 to 5 weeks
No regulator mandates Cyber Essentials in construction. It comes in through contracts: PPN 014 for relevant central government work, and supply-chain terms that main contractors write for their subcontractors. Scope for a contractor is the office network, site laptops and tablets, site routers, and the estimating and project platforms in the cloud.
Do construction firms need Cyber Essentials?
Not formally. No sector regulator mandates it. Demand comes from public sector clients under PPN 014 and from main contractors' supply-chain terms, so read the tender and the subcontract for the level and scope they name.
Cabinet Office (public sector construction)
Source checkedPPN 014 tells central government departments, agencies, non-departmental public bodies and NHS bodies to require Cyber Essentials on relevant contracts, such as those handling personal data or supplying ICT, for procurements from 24 February 2025. It sets no general flow-down rule, so subcontractor requirements come from the main contractor's own terms (checked 3 November 2026).
Whatever the source, the contract, grant or tender is what binds you. Read it for the level it names, the scope it expects and the date the certificate must be in place, and record the reason at A1.10 when you apply.
Do construction firms need Cyber Essentials or Cyber Essentials Plus?
Cyber Essentials meets most main contractor and public sector requirements. Plus applies when the tender names it, which PPN 014 Annex B reserves for higher-risk contracts.
Both levels use the same five controls and the same question set. Plus adds an independent audit of a sample of devices and cloud accounts, on the same scope as a valid Cyber Essentials certificate. Compare the two levels.
What should construction firms gather before starting?
Most of the self-assessment is describing your estate accurately. Have these to hand before you open the question set and the answers take hours, not weeks.
- Every site with its own internet connection, including temporary site cabins, and the router or firewall at each (A2.3, A2.5).
- The make, model and firmware version of each site router or 4G hub, and confirmation the default password has been changed (A2.5, A4.2).
- A list of site laptops and tablets and their update status, since devices away from the office drift fastest (A2.6, A2.8).
- Cloud platforms used for drawings, estimating, project management and timesheets, with MFA status for each (A2.9, A7.17).
- Subcontractor and client accounts in your project platforms, with an end date for each project (A7.3).
What scope problems do construction firms bring?
Scope must cover every device and cloud service that reaches organisational data, or a sub-set segregated by a firewall or VLAN that you can justify. These are the boundaries this sector tends to get wrong.
Site laptops and tablets
Devices that spend months on site with updates paused, and local admin as the daily account.
Site routers
4G routers and ISP hubs at site cabins with default passwords are boundary firewalls in scope.
Estimating software on old PCs
Legacy estimating and CAD tools on unsupported Windows fail the supported-software rule.
Subcontractors on your systems
Third-party users with accounts in your project platform need MFA and removal at project end. Accounts you own are in scope whoever uses them.
Which questions do construction firms commonly fail?
Questions construction firms commonly fail include A6.4AUTO-FAIL, A7.6 and A4.2. This is a typical pattern from assessor experience, not a statistic, but it is worth planning around.
| Question | Why it fails | Fix |
|---|---|---|
| A6.4AUTO-FAILAre all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release? | Site laptops that were paused for a project and never caught up are a typical pattern. | Use an update policy that does not allow indefinite pausing, set an install deadline inside 14 days, and check the update report weekly so a missed device is caught inside the window. |
| A7.6How does your organisation make sure that separate accounts are used to carry out administrative tasks (such as installing software or making configuration changes)? This applies to local administrator accounts, network/domain administrator accounts, and cloud service administrator accounts. | Site staff are given local administrator rights so they can install printer drivers and survey tools. | Give them a standard account and either a separate admin account or a helpdesk route for installs. |
| A4.2When you first receive an internet router or hardware firewall device, it may have had a default password on it. Have you changed all the default passwords on your boundary firewall devices? | Site cabin routers with the ISP default password are usually discovered during scoping. | Change every router password, record the make and model in A2.5, and switch off remote management from the internet. |
Frequently asked questions
Check the current question set for your membership level. Whatever a prequalification scheme asks, the client's tender or the main contractor's subcontract decides whether the certificate is mandatory and at which level, so read those documents first.
Yes. Each site with its own internet connection has a router or firewall that is in scope, must be listed in A2.5 and must meet the firewall control. Temporary sites count while they are operational.
It covers every device, network, user account and cloud service that accesses your organisation's data or services, including staff-owned phones and laptops under BYOD. You can certify part of the organisation if the excluded networks are segregated by a firewall or VLAN (A2.1, A2.2.2), but the certificate then reads 'Partial Organisation', which a buyer may question.
Twelve months from certification, and buyers under PPN 014 expect it renewed every year of the contract. Renewal is a fresh self-assessment against the question set current at the time, so a certificate first issued under an older version is reassessed against v3.3 and the Danzell question set when it renews.
Related pages
- DrayTek Vigor setupRouter passwords and remote management
- Microsoft Intune setupUpdate rings with deadlines for site laptops
- Windows 11 setupFirewall, locking and Windows Update
- Firewall requirementsWhat every boundary device must meet
- Who needs Cyber Essentials?Government, MoD, NHS and other mandates.
- Scope: what is in and outBYOD, home working, cloud and sub-sets.
- How much does it cost?Fixed prices and IASME fee bands.
- Check your readinessFree check against the 2026 question set.
- Cyber Essentials for manufacturing
- Cyber Essentials for MSPs and IT providers
- Cyber Essentials for recruitment
Get certified at a fixed price
Precursor is an IASME Certification Body: Cyber Essentials from £1,500 and Cyber Essentials Plus from £3,000, with the IASME fee included, a free re-test if gaps are found and a written fixed price after a 20-minute scoping call.
- IASME Certification Body
- CREST accredited
- UK offices in Leeds, Newcastle, London and Edinburgh