Check your readiness

Cyber Essentials for recruitment

Sector guide · no formal mandate

Who asks recruitment for the certificate, which level to choose, what to gather first, the scope problems the sector brings and the questions it commonly fails.

Get a fixed-price quoteCheck your readiness
Updated 4 November 2026
Key facts
Mandated by
No formal mandate; customer and funder requirements
Common fails
A7.3A7.17AUTO-FAILA5.9
Typical scope
Consultants working from home, Candidate data in many cloud services, High staff turnover, Personal phones for candidate contact
Cyber Essentials
From £1,500, 1 to 2 weeks, IASME fee included
Cyber Essentials Plus
From £3,000, 2 to 5 weeks
Short answer

Recruitment agencies hold large volumes of candidate personal data. No regulator mandates Cyber Essentials, but central government and NHS buyers must ask for it on contracts that handle personal information under PPN 014, and corporate clients ask in supplier due diligence. Scope centres on the CRM, email, job boards and consultants' devices.

Requirements

Do recruitment agencies need Cyber Essentials?

Not formally. No regulator mandates it. PPN 014 applies when an agency supplies central government or NHS bodies, and private clients set their own requirement in onboarding questionnaires.

  • Central government and NHS buyers

    Source checked

    PPN 014 tells central government departments, agencies, non-departmental public bodies and NHS bodies to require Cyber Essentials, Plus or equivalent controls where the supplier handles citizens' or government employees' personal information, in procurements from 24 February 2025. Candidate and worker records are personal information (checked 3 November 2026).

    Source: Cabinet Office, Procurement Policy Note 014

Whatever the source, the contract, grant or tender is what binds you. Read it for the level it names, the scope it expects and the date the certificate must be in place, and record the reason at A1.10 when you apply.

Level

Do recruitment agencies need Cyber Essentials or Cyber Essentials Plus?

Cyber Essentials meets most framework and client requirements. Plus applies when the buyer names it for higher-risk work, as PPN 014 Annex B describes.

Both levels use the same five controls and the same question set. Plus adds an independent audit of a sample of devices and cloud accounts, on the same scope as a valid Cyber Essentials certificate. Compare the two levels.

Preparation

What should recruitment agencies gather before starting?

Most of the self-assessment is describing your estate accurately. Have these to hand before you open the question set and the answers take hours, not weeks.

  • Every cloud service that holds candidate data: CRM or applicant-tracking system, job boards, LinkedIn Recruiter, video interview, e-signature, timesheet and payroll platforms (A2.9).
  • The agency's social media accounts, which the question set counts as cloud services (A2.9).
  • A list of consultants who use personal phones or laptops for work email or the CRM (A2.4.1, A2.8).
  • The leaver checklist and evidence that leavers' CRM and job-board seats are removed, not only their email (A7.3).
  • The framework or contract reference if you are bidding for public sector work, for A1.10.2.
Scope

What scope problems do recruitment agencies bring?

Scope must cover every device and cloud service that reaches organisational data, or a sub-set segregated by a firewall or VLAN that you can justify. These are the boundaries this sector tends to get wrong.

Consultants working from home

Home-based consultants on personal laptops with CRM access are in scope as BYOD.

A2.4.1A2.4.2A2.6

Candidate data in many cloud services

CRM, job boards, video interview tools and e-signature platforms are all cloud services needing MFA for every user.

A2.9A7.17AUTO-FAIL

High staff turnover

Leaver accounts left active in the CRM, job boards and email.

A7.3

Personal phones for candidate contact

Messaging and social apps on personal phones that also read work email bring the phone into scope.

A2.8A5.9
Common failures

Which questions do recruitment agencies commonly fail?

Questions recruitment agencies commonly fail include A7.3, A7.17AUTO-FAIL and A5.9. This is a typical pattern from assessor experience, not a statistic, but it is worth planning around.

QuestionWhy it failsFix
A7.3How do you ensure you have deleted, or disabled, any accounts for staff who are no longer with your organisation?Turnover in recruitment is high and leaver accounts on the CRM are often missed.Make the CRM and job-board seats part of the leaver checklist and run a monthly account review.
A7.17AUTO-FAILHas MFA been applied to all users of your cloud services, excluding any listed in A7.15 that do not provide it?MFA is often enforced on email but not on the CRM or job-board accounts that hold the candidate data.Enforce MFA in every platform that offers it, and use single sign-on through Microsoft 365 or Google where the platform supports it.
A5.9When a device requires a user to have the device in hand, do you set a locking mechanism on your devices to access the software and services installed?Consultants' personal phones without a screen lock are common.Require a passcode through a mobile application management policy, or remove the phone's access to work data so it leaves scope.
How assessors check this
Assessors read the notes fields for these questions first. A yes with no mechanism described is the answer most likely to come back for clarification.
FAQ

Frequently asked questions

Where a central government buyer or NHS body is procuring, PPN 014 tells it to ask for Cyber Essentials on contracts that handle personal data, and candidate records are personal data. Framework terms vary, so read the selection questionnaire for the lot you are bidding for and have the certificate in place before award.

Yes. Every cloud service the agency uses goes in A2.9, and the Danzell guidance counts social media accounts as cloud services. Each one needs MFA for every user and administrator where the service offers it, under A7.16 and A7.17, which fail automatically on a no.

It covers every device, network, user account and cloud service that accesses your organisation's data or services, including staff-owned phones and laptops under BYOD. You can certify part of the organisation if the excluded networks are segregated by a firewall or VLAN (A2.1, A2.2.2), but the certificate then reads 'Partial Organisation', which a buyer may question.

Twelve months from certification, and buyers under PPN 014 expect it renewed every year of the contract. Renewal is a fresh self-assessment against the question set current at the time, so a certificate first issued under an older version is reassessed against v3.3 and the Danzell question set when it renews.

Related pages

Sources
Certification with Precursor

Get certified at a fixed price

Precursor is an IASME Certification Body: Cyber Essentials from £1,500 and Cyber Essentials Plus from £3,000, with the IASME fee included, a free re-test if gaps are found and a written fixed price after a 20-minute scoping call.

Get a fixed-price quoteCheck your readiness
  • IASME Certification Body
  • CREST accredited
  • UK offices in Leeds, Newcastle, London and Edinburgh