Who needs Cyber Essentials?
Cyber Essentials is required by UK central government and NHS buyers under PPN 014, required on MOD contracts carrying DEFCON 658, and asked for by many funders and insurers. See which contracts and sectors need it.
Cyber Essentials is needed by suppliers to UK central government, agencies, non-departmental public bodies and NHS bodies, which must require it under PPN 014 in relevant procurements from 24 February 2025. Ministry of Defence suppliers need it on contracts carrying DEFCON 658, and many private buyers, funders and insurers ask for it. No law requires it otherwise.
- Legal requirement
- None. It is required through contracts and procurement rules
- Public sector
- PPN 014: central government, agencies, NDPBs and NHS bodies, relevant procurements from 24 February 2025
- Defence
- Required at every cyber risk profile level on MOD contracts carrying DEFCON 658 (Def Stan 05-138 Issue 4)
- Insurance
- Included cyber insurance for eligible UK organisations that opt in (A3.1, A3.2)
- Scheme fee
- £320 to £600 plus VAT by staff headcount
Who needs Cyber Essentials?
Any organisation bidding for relevant UK central government or NHS work needs Cyber Essentials, because PPN 014 makes it a condition of those procurements. Everyone else needs it when a customer, prime contractor, funder or insurer asks for it.
The self-assessment asks why you are applying at A1.10, and a government contracting organisation is one of the answers. Where a contract names Cyber Essentials Plus, the self-assessment alone does not meet it. The pages below cover each mandate and sector in turn, with the source for each requirement.
Which mandates and sectors require it?
Cyber Essentials for charities
Why charities and voluntary organisations certify Cyber Essentials: funder and commissioner requirements, the included cyber insurance, scope rules for volunteers and trustees, and the status of the NCSC funded programme.
6 min read6 min readCyber Essentials and cyber insurance
The £25,000 cyber liability insurance included with a Cyber Essentials certificate: who is eligible, what it covers, how to opt in at question A3, and how the certificate affects a standalone cyber insurance policy.
4 min read4 min readIs Cyber Essentials worth it?
Cyber Essentials is worth it for most UK organisations: what it costs, the advantages it brings, when a contract requires it, what it does not cover, and how to decide between the certificate and just the controls.
6 min read6 min readCyber Essentials for MOD and defence suppliers
Why Ministry of Defence contracts ask for Cyber Essentials, how it fits with DEFCON 658, Def Stan 05-138 cyber risk profile levels and Defence Cyber Certification, and when defence suppliers need Cyber Essentials Plus.
7 min read7 min readCyber Essentials for MSPs and IT providers
How managed service providers certify Cyber Essentials for themselves and prepare their clients: the v3.3 rules on third-party accounts, MSP administrator devices, cloud services and sub-sets, and what changes at Cyber Essentials Plus.
6 min read6 min readCyber Essentials for NHS suppliers and the DSPT
How Cyber Essentials fits with the NHS Data Security and Protection Toolkit (DSPT), which NHS bodies must ask for it under PPN 014, and what suppliers handling patient data need to hold.
6 min read6 min readCyber Essentials for schools, trusts and education
Why schools, multi-academy trusts, colleges and universities certify Cyber Essentials, how it relates to Department for Education cyber security standards, and the scope rules for staff, student and BYOD devices.
6 min read6 min readCyber Essentials for UK government contracts (PPN 014)
What Procurement Policy Note 014 under the Procurement Act 2023 requires: which public bodies must ask for Cyber Essentials, from when, which contracts it covers and whether you need Cyber Essentials or Plus.
7 min read7 min read
Next steps
Frequently asked questions
No. No UK law requires every organisation to hold Cyber Essentials. It becomes a requirement through contracts: PPN 014 obliges central government, agencies, non-departmental public bodies and NHS bodies to ask for it in relevant procurements from 24 February 2025, and many private buyers and funders write it into their terms.
Organisations whose contract or buyer names Cyber Essentials Plus. It covers the same five controls but adds an independent technical audit of a sample of devices and cloud services. Higher-risk public sector and defence contracts are the usual trigger. If the contract only says Cyber Essentials, the self-assessment certificate meets it.
Yes. Any organisation of any size or sector can apply, including sole traders, charities and schools. The question set asks for the organisation type at A1.2 and the reason for applying at A1.10, but neither answer changes how the controls are marked.
Often. Prime contractors on government and defence work commonly pass the requirement down to subcontractors and IT providers that handle the buyer's data or systems. Check the flow-down clauses in your subcontract; the level named there is the level you need.
The IASME scheme fee for the self-assessment is £320 to £600 plus VAT, set by staff headcount. Assessor-supported certification and Cyber Essentials Plus are priced by the Certification Body. The cost page breaks down each band.
Get certified at a fixed price
Precursor is an IASME Certification Body: Cyber Essentials from £1,500 and Cyber Essentials Plus from £3,000, with the IASME fee included, a free re-test if gaps are found and a written fixed price after a 20-minute scoping call.
- IASME Certification Body
- CREST accredited
- UK offices in Leeds, Newcastle, London and Edinburgh
- NCSCNCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 · April 2026Read on ncsc.gov.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials Danzell Question Set 2026Read on iasme.co.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials frequently asked questionsRead on iasme.co.uk (opens in a new tab)