Buyers ask because cleaning contractors hold client door codes, alarm codes and addresses, and often handle staff data on behalf of the client. Public sector contracts that involve personal information can require Cyber Essentials under government procurement rules. For most cleaning businesses, getting ready takes days, not months.
Why buyers ask
A cleaning contractor holds the keys to its clients' buildings, often literally. Door codes, alarm codes and key safe numbers kept in text messages or shared spreadsheets are one lost phone away from a serious problem. Buyers want to know their codes and premises are protected.
For central government and NHS contracts, the procurement rules in PPN 014 say suppliers must meet the Cyber Essentials technical requirements when a contract involves citizens' personal information. Other public bodies, and many facilities management firms, follow the same approach.
What it involves for a cleaning business
- Phones. Supervisors' and cleaners' work phones need a PIN or fingerprint lock, up-to-date software, and apps only from official app stores.
- Client codes. Keep them in a password manager or secure system, never in texts or notes apps, and change them when someone leaves.
- Accounts. Everyone has their own login for email and scheduling apps, with two-step verification switched on.
- The office computer. Firewall on, automatic updates on, and no old versions of Windows.
What it costs
The Cyber Essentials self-assessment costs £320 plus VAT for businesses with up to 9 people and £440 plus VAT for 10 to 49 people. See our full guide to costs. The certificate lasts 12 months.
Using it to win work
Once certified, mention it in every tender and on your website. Many buyers also send a security questionnaire. Your readiness report's tender pack gives you ready-written answers based on what you actually do.
Common questions
Do cleaning companies need Cyber Essentials?
It isn't a legal requirement, but many facilities management and public sector contracts ask for it, especially where the contractor handles personal information or client access codes.
Do cleaners' personal phones count?
If they're used for work email or apps, yes. They need a screen lock, supported software and two-step verification on work accounts.
How long does it take to get ready?
For a small cleaning business with a few devices, usually a few days of fixes and an hour or two on the application itself.
Sources
This guide is general information, not legal advice. Fees and rules can change, so check the sources before you rely on them.