Cyber Essentials for local government suppliers
Who asks local government suppliers for the certificate, which level to choose, what to gather first, the scope problems the sector brings and the questions it commonly fails.
- Mandated by
- Cabinet Office
- Common fails
- A2.1A7.16AUTO-FAILA6.4AUTO-FAIL
- Typical scope
- Partial scope to hit a deadline, Council-issued devices and accounts, Cloud platforms used for the contract
- Cyber Essentials
- From £1,500, 1 to 2 weeks, IASME fee included
- Cyber Essentials Plus
- From £3,000, 2 to 5 weeks
PPN 014 does not bind local authorities, but it says other public bodies may wish to apply its approach, and some council tenders ask for Cyber Essentials in supplier selection. Where a council or central government buyer requires it, suppliers need evidence before contract award, and the scope must cover every device and cloud service that touches the buyer's data.
Do local government suppliers need Cyber Essentials?
Yes, where the work falls under one of these requirements. Cabinet Office requires or expects Cyber Essentials; each source is listed below with the date it was checked.
Cabinet Office
Source checkedProcurement Policy Note 014 requires central government departments, agencies, non-departmental public bodies and NHS bodies to ask for Cyber Essentials, Plus or equivalent controls on higher-risk contracts in procurements from 24 February 2025, replacing PPN 09/14 and PPN 09/23. Local authorities are not bound by it; paragraph 6 says other public sector bodies may wish to apply the same approach (checked 3 November 2026).
Whatever the source, the contract, grant or tender is what binds you. Read it for the level it names, the scope it expects and the date the certificate must be in place, and record the reason at A1.10 when you apply.
Do local government suppliers need Cyber Essentials or Cyber Essentials Plus?
The council's selection questionnaire names the level. Cyber Essentials is the usual ask; Plus appears where the supplier gets access to council systems or sensitive data.
Both levels use the same five controls and the same question set. Plus adds an independent audit of a sample of devices and cloud accounts, on the same scope as a valid Cyber Essentials certificate. Compare the two levels.
What should local government suppliers gather before starting?
Most of the self-assessment is describing your estate accurately. Have these to hand before you open the question set and the answers take hours, not weeks.
- The tender or contract reference and the buying organisation for A1.10.2.
- The legal entity that will sign the contract, so the certificate name matches it (A1.1).
- A list of the cloud platforms you will use to deliver the contract, with MFA status for every user and administrator (A2.9, A7.16, A7.17).
- Firmware versions and update dates for every firewall and router (A2.5, A6.4).
- Any devices or accounts the council will issue to your staff, and who manages them.
What scope problems do local government suppliers bring?
Scope must cover every device and cloud service that reaches organisational data, or a sub-set segregated by a firewall or VLAN that you can justify. These are the boundaries this sector tends to get wrong.
Partial scope to hit a deadline
Certifying one team to meet a bid deadline needs a genuinely segregated sub-set, and the certificate will read 'Partial Organisation', which a council may reject.
Council-issued devices and accounts
Agree in writing which devices and accounts the council manages and which you do. Accounts your organisation owns are in your scope whoever uses them.
Which questions do local government suppliers commonly fail?
Questions local government suppliers commonly fail include A2.1, A7.16AUTO-FAIL and A6.4AUTO-FAIL. This is a typical pattern from assessor experience, not a statistic, but it is worth planning around.
| Question | Why it fails | Fix |
|---|---|---|
| A2.1Is this assessment for your whole organisation or only a part of it? | Suppliers rushing to meet a tender date declare a partial scope that does not hold up under questioning. | Certify the whole organisation unless there is a real segregated sub-set; it is usually faster than justifying a partial one. |
| A7.16AUTO-FAILHas MFA been applied to all administrators of your cloud services, excluding any listed in A7.15 that do not provide it? | MFA on admin accounts in the cloud platforms used for the contract is often incomplete. | Enforce MFA for every administrator on every platform listed in A2.9. |
| A6.4AUTO-FAILAre all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release? | The 14-day rule is not evidenced for firewalls and routers. | Record firmware versions and install dates against the vendor's security advisories. |
Frequently asked questions
Read the selection questionnaire: the council's own policy sets the level, not PPN 014. Cyber Essentials is the usual ask, and Plus tends to appear where the supplier gets access to council systems or sensitive data. If the tender is unclear, ask the procurement contact before choosing a level.
Where PPN 014 applies, before contract award, and renewed every year of the contract. Councils that follow the same approach usually set the same timing in their tender. Allow at least a month before the deadline in case the first submission needs remediation.
It covers every device, network, user account and cloud service that accesses your organisation's data or services, including staff-owned phones and laptops under BYOD. You can certify part of the organisation if the excluded networks are segregated by a firewall or VLAN (A2.1, A2.2.2), but the certificate then reads 'Partial Organisation', which a buyer may question.
Twelve months from certification, and buyers under PPN 014 expect it renewed every year of the contract. Renewal is a fresh self-assessment against the question set current at the time, so a certificate first issued under an older version is reassessed against v3.3 and the Danzell question set when it renews.
Related pages
- Scope and sub-setsWhole organisation or a segregated part
- Security update managementThe 14-day rule for firmware
- Microsoft 365 and Entra ID setupMFA for every admin
- Cyber Essentials for government contractsThe deep page on this mandate.
- Who needs Cyber Essentials?Government, MoD, NHS and other mandates.
- How much does it cost?Fixed prices and IASME fee bands.
- Check your readinessFree check against the 2026 question set.
- Cyber Essentials for defence suppliers
- Cyber Essentials for software and SaaS companies
- Cyber Essentials for charities and not-for-profits
Get certified at a fixed price
Precursor is an IASME Certification Body: Cyber Essentials from £1,500 and Cyber Essentials Plus from £3,000, with the IASME fee included, a free re-test if gaps are found and a written fixed price after a 20-minute scoping call.
- IASME Certification Body
- CREST accredited
- UK offices in Leeds, Newcastle, London and Edinburgh