Cyber Essentials for UK government contracts (PPN 014)

Do you need Cyber Essentials for a UK government contract?

Yes, for relevant procurements. Under PPN 014, central government departments, their executive agencies, non-departmental public bodies and NHS bodies must require Cyber Essentials, Cyber Essentials Plus or equivalent controls from suppliers on higher-risk contracts in procurements commenced on or after 24 February 2025.

What does PPN 014 require?

Procurement Policy Note 014, published by the Cabinet Office on 17 February 2025, replaces PPN 09/14 and PPN 09/23 and restates the policy in the terminology of the Procurement Act 2023. The note says it is not a change in policy: government has required Cyber Essentials for certain types of contract since 2014. For procurements commenced before 24 February 2025, PPN 09/23 still applies.

It applies to central government departments, their executive agencies, non-departmental public bodies and NHS bodies. Where a contract has one of the higher-risk characteristics below, the buyer must ensure the supplier demonstrates the technical requirements, and the note names Cyber Essentials or Cyber Essentials Plus as the quickest route. Where certification is required, the supplier must renew it annually for the duration of the contract. A supplier without a certificate must be able to show equivalent controls by other means.

PPN 014 does not set a general flow-down rule for subcontractors. Its FAQ points out that the government Model Services Contract, used for complex services contracts over £20 million, requires the supplier and relevant subcontractors to hold Cyber Essentials or Plus (or equivalent), and that a supplier's certificate does not extend to third parties such as the cloud providers it shares the buyer's data with.

Checked against the PPN 014 text on GOV.UK (published 17 February 2025, no withdrawal notice) on 3 November 2026.

Which contracts are in scope?

Contracts with at least one of the four characteristics listed in paragraph 12 of the PPN:

• the supplier handles citizens' personal information, such as home addresses, bank details or payment information
• the supplier handles personal information of government employees, ministers or special advisers, such as payroll, travel booking or expenses
• the supplier provides ICT systems or services designed to store or process data at the OFFICIAL level
• the contract deals with information on the day-to-day business of government, service delivery and public finances

Annex A gives examples that meet these characteristics: CV-writing services for jobseekers, car hire for civil servants and contact centre services for the public. It also gives examples where the scheme would not be relevant, such as a communications planning contract with no access to personal data, or a sole-trader driving instructor with very limited data. The PPN sets no contract value threshold, and it tells buyers not to apply Cyber Essentials to every contract as a matter of course.

Question A1.10 on the self-assessment asks why you are applying, and A1.10.2 asks for the government contracting organisation and contract number. Have those to hand: assessors see the answer and it helps them understand the scope you need.

Does a government contract need Cyber Essentials or Cyber Essentials Plus?

Cyber Essentials is the self-assessed certificate of the five technical controls, marked by an IASME Certification Body for a scheme fee of £320 to £600 depending on headcount. PPN 014 describes it as a basic level of assurance.

Cyber Essentials Plus is specified where the buyer judges the risk higher: Annex B of the PPN says Plus "should be used when there is a higher risk of cyber security threats". Plus adds an independent audit of the same controls on a sample of your devices and cloud services, on the same scope as a valid Cyber Essentials certificate. IASME requires the Plus audit to be completed within three months of that certification. If a tender names Plus, plan for two to five weeks rather than one to two, and book the audit day before the self-assessment is submitted.

How do government buyers check a Cyber Essentials certificate?

Buyers look you up on the Cyber Essentials certificate search, and the PPN 014 FAQ tells them to check the scope on the certificate. The certificate carries the name of one legal entity, entered at A1.1. Any other legal entities you include at A1.6.1 are listed on it and share its expiry date. A partial scope reads "Partial Organisation" on the certificate, with the full description from A2.2 on the certificate platform.

Two checks before you submit. First, the legal entity on the certificate must be the one signing the contract. Second, if you certify part of the organisation, the scope description must make sense to a procurement officer reading it cold and must include the team delivering the contract.

When must the certificate be in place for a government contract?

Before award, and renewed every 12 months after. The PPN 014 FAQ says evidence is required before contract award and that a supplier who does not recertify every 12 months becomes uncertified, so a three-year contract will need at least two renewals. Renewals are quicker than first certifications, but the 2026 question set changes and the auto-fail items mean last year's answers cannot simply be resubmitted.

What about local government, universities and the wider public sector?

PPN 014 does not bind local authorities, universities, police forces or housing associations. Paragraph 6 of the note says other public sector bodies may wish to apply its approach, so some of their tenders ask for Cyber Essentials too. When a tender from one of these bodies asks for it, the source is their own policy, and the level and scope they want are whatever the tender says.

What should you have ready before bidding?

A practical list for a supplier facing a PPN 014 tender:

If you do not hold a certificate yet, start with a gap analysis or the free readiness check: common failures such as unsupported software and cloud services without enforced MFA take the longest to fix.

How much does this cost a supplier?

The scheme fee is £320 to £600 ex VAT by headcount. Assessor-supported certification with Precursor is from £1,500 with the fee included, and Cyber Essentials Plus from £3,000. Against the value of most government contracts, the certificate is a small fixed cost; the larger cost is the remediation if a gap analysis finds unsupported software or cloud services without MFA, so start early.