Cyber Essentials for software and saas companies
Who asks software and saas companies for the certificate, which level to choose, what to gather first, the scope problems the sector brings and the questions it commonly fails.
- Mandated by
- No formal mandate; customer and funder requirements
- Typical scope
- Developer laptops with admin rights, Cloud consoles, Production servers, Network segmentation
- Cyber Essentials
- From £1,500, 1 to 2 weeks, IASME fee included
- Cyber Essentials Plus
- From £3,000, 2 to 5 weeks
G-Cloud 15 makes Cyber Essentials mandatory for software and support suppliers handling personal or OFFICIAL data, and Cyber Essentials Plus mandatory for hosting lots. Enterprise buyers ask for it in vendor due diligence. Virtual machines you manage need all five controls; for PaaS and SaaS, user access control is always yours.
Do software and SaaS companies need Cyber Essentials?
Not formally. No regulator mandates it. Public sector frameworks such as G-Cloud 15 and customer due diligence drive demand.
G-Cloud 15 framework (RM1557.15)
Source checkedCyber Essentials is mandatory on Lots 2a, 2b and 3 for prime suppliers and any subcontractors processing personal or OFFICIAL data, with certificates validated within 12 months of award and suspension until a valid one is provided. Cyber Essentials Plus is mandatory and validated on Lots 1a and 1b (IaaS and PaaS). Only validated certificates show on the platform (checked 3 November 2026).
Whatever the source, the contract, grant or tender is what binds you. Read it for the level it names, the scope it expects and the date the certificate must be in place, and record the reason at A1.10 when you apply.
Do software and SaaS companies need Cyber Essentials or Cyber Essentials Plus?
Cyber Essentials for G-Cloud 15 software (Lots 2a, 2b) and support (Lot 3); Cyber Essentials Plus for hosting (Lots 1a, 1b). Enterprise customers holding sensitive data often expect Plus.
Both levels use the same five controls and the same question set. Plus adds an independent audit of a sample of devices and cloud accounts, on the same scope as a valid Cyber Essentials certificate. Compare the two levels.
What should software and SaaS companies gather before starting?
Most of the self-assessment is describing your estate accurately. Have these to hand before you open the question set and the answers take hours, not weeks.
- Every cloud account and console: AWS, Azure or GCP organisations, source control, CI/CD, error tracking, support desk and status-page tools (A2.9).
- A list of IaaS virtual machines you manage, with operating system versions, since they need all five controls (A2.7).
- The public IP addresses and inbound rules for each environment, with the business need recorded for each rule (A4.7, A4.8).
- Runtime and framework versions on servers and build agents, such as Java, Node.js and .NET, checked against the vendor's support dates (A6.2).
- The developer laptop build, and how developers get admin rights when they need them (A7.6, A7.7).
What scope problems do software and SaaS companies bring?
Scope must cover every device and cloud service that reaches organisational data, or a sub-set segregated by a firewall or VLAN that you can justify. These are the boundaries this sector tends to get wrong.
Developer laptops with admin rights
Developers working as local administrators on their daily account fail account separation.
Cloud consoles
AWS, Azure and GCP consoles need MFA on root and every user; source control and CI/CD platforms are cloud services too.
Production servers
Virtual machines you manage are IaaS and need all five controls. For managed PaaS databases and functions, user access control is always yours, and secure configuration and patching are shared with the provider, per the cloud services table in v3.3.
Network segmentation
A sub-set must be segregated by a firewall or VLAN. Security groups, micro-segmentation and software-based methods are not accepted for A2.2.2.
Which questions do software and SaaS companies commonly fail?
Questions software and SaaS companies commonly fail include A7.7, A6.2 and A4.8. This is a typical pattern from assessor experience, not a statistic, but it is worth planning around.
| Question | Why it fails | Fix |
|---|---|---|
| A7.7How does your organisation prevent administrator accounts from being used to carry out everyday tasks like browsing the web or accessing email? | Developers using admin accounts for everything is a typical pattern in software firms. | Standard accounts by default with just-in-time elevation, and dedicated admin identities for cloud consoles. |
| A6.2Is all the software on your devices supported by a supplier that produces regular vulnerability fixes for any security problems? | Unsupported runtimes and self-hosted tools on build servers. | Inventory server software, upgrade to supported versions and remove what is no longer needed. |
| A4.8Please describe how you approve and document your allowed inbound connections. | SSH and RDP open to the whole internet on cloud instances, with no documented business need or approval for the inbound rule. | Remove rules open to 0.0.0.0/0, use a bastion, VPN or session manager with MFA, and record the approval and business need for every inbound rule that remains. |
Frequently asked questions
Yes. Cloud services cannot be excluded from scope under v3.3. Virtual machines you manage in AWS, Azure or another IaaS provider need all five controls. For serverless, managed databases and other PaaS components, user access control is always yours, and secure configuration and security updates are shared with the provider; the provider's commitment should be in the contract or its published shared responsibility documents.
Lots 1a and 1b, the IaaS and PaaS hosting lots, need Cyber Essentials Plus, and only validated certificates show on the platform. Lots 2a, 2b and 3 need Cyber Essentials for primes and subcontractors processing personal or OFFICIAL data, validated within 12 months of award. Check the current framework documents before you bid.
It covers every device, network, user account and cloud service that accesses your organisation's data or services, including staff-owned phones and laptops under BYOD. You can certify part of the organisation if the excluded networks are segregated by a firewall or VLAN (A2.1, A2.2.2), but the certificate then reads 'Partial Organisation', which a buyer may question.
Twelve months from certification, and buyers under PPN 014 expect it renewed every year of the contract. Renewal is a fresh self-assessment against the question set current at the time, so a certificate first issued under an older version is reassessed against v3.3 and the Danzell question set when it renews.
Related pages
- AWS setupRoot MFA, security groups and patching
- Azure setupEntra MFA, NSGs and update management
- Test 1: external vulnerability scanEvery public IP, including IaaS
- Firewall requirementsInbound rules and business need
- Who needs Cyber Essentials?Government, MoD, NHS and other mandates.
- Scope: what is in and outBYOD, home working, cloud and sub-sets.
- How much does it cost?Fixed prices and IASME fee bands.
- Check your readinessFree check against the 2026 question set.
- Cyber Essentials for charities and not-for-profits
- Cyber Essentials for schools, academies and multi-academy trusts
- Cyber Essentials for law firms
- NCSCNCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 · April 2026Read on ncsc.gov.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials Danzell Question Set 2026Read on iasme.co.uk (opens in a new tab)
- GOV.UKCrown Commercial Service, Key changes between the G-Cloud 14 and G-Cloud 15 Framework Agreements (v3.0)Read on assets.crowncommercial.gov.uk (opens in a new tab)
Get certified at a fixed price
Precursor is an IASME Certification Body: Cyber Essentials from £1,500 and Cyber Essentials Plus from £3,000, with the IASME fee included, a free re-test if gaps are found and a written fixed price after a 20-minute scoping call.
- IASME Certification Body
- CREST accredited
- UK offices in Leeds, Newcastle, London and Edinburgh