It isn't a legal requirement for every business. But you'll need it for many government and public sector contracts, it's increasingly asked for by larger customers and insurers, and it protects you against the most common attacks.
When it's required
Central government contracts. Under Procurement Policy Note 014, central government departments, their agencies and NHS bodies must require Cyber Essentials or Cyber Essentials Plus from suppliers whose contracts involve:
- handling citizens' personal information, such as home addresses or bank details,
- handling personal information of government staff, such as payroll or expenses,
- ICT systems or services that store or process government data at the OFFICIAL level.
Suppliers must renew the certificate every year for as long as the contract runs. There's no minimum contract value, so small contracts count too.
Defence suppliers. Ministry of Defence suppliers are assessed under the Defence Cyber Protection Partnership's model, which usually expects at least Cyber Essentials.
Councils, housing associations and the wider public sector. Many follow the same approach and ask for Cyber Essentials in tenders and supplier forms, even where the central rules don't strictly apply.
When it's asked for
- Larger customers' supply chains. Main contractors, facilities managers and corporate clients increasingly ask small suppliers for it, because a supplier's weakness can become theirs.
- Insurers. Cyber insurers ask about the same controls, and certification can make cover easier to get.
- Customers who care about their data. Accountants, healthcare and beauty businesses handle sensitive information, and certification is a simple way to show you take it seriously.
Is it worth it if nobody's asking?
For most small businesses, yes. The five controls (firewalls, secure settings, updates, access control and malware protection) block the attacks small businesses see most, such as stolen passwords and unpatched devices. The fee is modest, eligible organisations can opt in to £25,000 of included cyber insurance, and having the certificate ready means you won't miss a contract because of a short deadline.
Who it suits
Cyber Essentials is designed for organisations of any size, but it's particularly suited to small and medium businesses and charities, because it sets out a clear, achievable baseline. Larger organisations with complex systems often go further, with Cyber Essentials Plus or ISO 27001.
Where to start
Take our free two-minute health check to see roughly where you stand, then use the full readiness report to find and fix every gap before you apply.
Common questions
Is Cyber Essentials a legal requirement?
No, not for every business. It's required for many central government contracts that involve personal data or government ICT, and is often asked for by councils, larger customers and insurers.
Is there a minimum contract value?
Procurement Policy Note 014 sets no minimum value. It depends on what the contract involves, such as handling personal information.
Do I need to renew it?
Yes. Certificates last 12 months, and government suppliers must renew for as long as the contract runs.
Sources
This guide is general information, not legal advice. Fees and rules can change, so check the sources before you rely on them.