Cyber Essentials for Government Contracts: Tenders & Insurance

If you sell to government, or to larger businesses that copy government buying habits, the question usually arrives as a line in a tender: "Do you hold Cyber Essentials?" For many suppliers it is a pass or fail gate, not a scoring bonus.

This guide explains when Cyber Essentials for government contracts is actually required, what the central government Procurement Policy Note on Cyber Essentials says, how certification helps with tenders and customer questionnaires, and where it sits alongside cyber insurance. It also sets out what to do before you submit a bid, because certification takes time and cannot be rushed the week a tender closes.

Wording and thresholds change, so treat this as a briefing and check the tender documents and current guidance for the specific contract you are chasing.

When Cyber Essentials is required for government contracts

There is no single law that makes every supplier certify. The requirement comes from procurement policy and from individual contract terms. For central government, the key document is the Procurement Policy Note on Cyber Essentials, which replaced earlier notes (PPN 09/14 and PPN 09/23) with effect from 24 February 2025. The update changed terminology to fit the Procurement Act 2023 and did not introduce a new policy.

The note applies to central government departments, their executive agencies, non-departmental public bodies and NHS bodies. Other public sector bodies, such as councils and housing associations, can choose to follow the same approach, and many do.

It is not a blanket rule

The note tells buyers not to demand certification on every contract. They should judge the risk of each one. That is why you will see Cyber Essentials required on one framework and ignored on another.

The contracts most likely to require it

Certification is expected where a contract carries higher-risk characteristics, including where the supplier:

• handles personal information about citizens, such as home addresses, bank details or payment information;
• handles personal information about government employees, ministers or special advisers, such as payroll, travel or expenses data;
• runs ICT systems that store or process data at the OFFICIAL classification;
• works on day-to-day government business, service delivery or public finances, or in sensitive areas such as criminal justice, defence and commercial interests.

Where it applies, the supplier must hold Cyber Essentials or Cyber Essentials Plus for the life of the contract, renewed annually, or show equivalent controls. The buyer should see evidence before data is passed across.

What the Procurement Policy Note means in practice

Public sector procurement teams use the note as a checklist. The table below translates it into questions you can answer before you bid.

The note also recognises a limit: Cyber Essentials does not cover the security of third parties you share data with. Buyers are encouraged to check the scope of your certificate, so be ready to explain it.

Ministry of Defence and other sensitive sectors

Defence appears by name in the central government guidance as an area where higher-risk contract characteristics are more likely. If you are bidding for Ministry of Defence work or sitting in its supply chain, assume the buyer will look closely at your security posture.

Cyber Essentials may be the entry point rather than the whole requirement. Defence contracts can carry their own security conditions, and these depend on the data and systems involved. The tender documents will say what applies. If a contract names a standard you have not heard of, ask the buyer to clarify before the deadline, not after award.

The same pattern applies to criminal justice, health and education work. Buyers there tend to ask for certification and then add sector-specific requirements. If you serve these markets, our pages for healthcare and schools show how we approach the security expectations of those customers.

How Cyber Essentials helps you win tenders

Even where a tender does not demand certification, holding it removes friction. Cyber Essentials tenders often include a security section scored alongside price and quality, and a current certificate lets you answer several questions with one document.

• It clears the gate. Many bids are rejected at the compliance stage if a mandatory certificate is missing at submission or at contract award.
• It shortens security answers. A certificate number and scope statement can replace pages of explanation about firewalls, patching, access control and malware protection.
• It signals discipline. The NCSC Cyber Essentials overview describes the scheme as the government-recommended minimum standard, and the NCSC notes that a growing number of organisations require suppliers to be certified to bid.
• It reduces follow-up. Buyers who see a recognised certificate are less likely to send a long list of clarification questions.

Cyber Essentials or Cyber Essentials Plus?

Read the tender carefully. Some ask for either level; some name Plus. Plus adds independent technical testing, so it carries higher assurance. Our guide on the difference between the two levels explains which suits which contract, and the sibling article on the Cyber Essentials Plus audit covers what the testing involves.

Answering a supplier security questionnaire

Private sector customers rarely quote procurement policy, but their supplier security questionnaire often asks the same things. Law firms, accountancies, manufacturers and housebuilders now send these routinely, particularly after high-profile breaches through suppliers. Our article on supply chain risks from recent retail breaches shows why customers have become more cautious.

A current certificate helps in three ways:

1. It answers the common questions on patching, malware protection, firewalls and user access in one line.
2. It gives the customer an independent reference point rather than your own description.
3. It speeds up onboarding, because the customer's risk team has less to chase.

It does not answer everything. Questionnaires often go on to ask about incident response, staff training, data retention, backups and subcontractors. Keep a short, accurate pack ready: certificate, scope statement, policies and a named security contact. If your business is a smaller one, our small business IT support team can help assemble that pack.

Cyber Essentials and cyber insurance

The link between certification and insurance is real but often overstated. Here is what can be confirmed from the schemes themselves.

The NCSC and IASME state that UK organisations with turnover under £20m that certify their whole organisation are entitled to cyber liability insurance arranged through IASME, the scheme's delivery partner. You must opt in, and the certification price is the same either way. The IASME cyber liability insurance page sets out the terms.

Where to be cautious

• The included cover is a starting point, not a substitute for a full policy. A £25,000 limit may be small against the cost of a serious incident.
• You cannot claim under two policies, so check how it sits with any existing cover before opting in.
• Other insurers set their own questions. Some ask about the controls Cyber Essentials covers, such as multi-factor authentication and patching, but holding the certificate does not guarantee cover or a lower premium. Ask your broker.

Treat certification as evidence that supports an insurance application, not as a promise of cover.

Supply chain security and your subcontractors

Supply chain security is the reason most of these requirements exist. Buyers know an attacker may go after a smaller supplier to reach a larger customer. Cyber Essentials is a baseline check on that supplier's own systems.

Prepare for three follow-up questions:

• What is in scope? A certificate covering one office or a single subsidiary will not satisfy a buyer who expects the systems holding their data to be covered. The sibling guide on Cyber Essentials requirements explains how scope is set.
• Who else touches the data? Cloud providers, payroll bureaux and offshore teams may be asked about. Certification does not cover them for you.
• Do your own suppliers need it? On larger contracts, subcontractors may need Cyber Essentials, or equivalent controls, written into their terms.

Our cyber security audit services can test whether your wider controls hold up beyond the five technical themes that Cyber Essentials assesses: firewalls, secure configuration, security update management, user access control and malware protection.

What to do before you bid

Certification is a self-assessment reviewed by a certification body, and fixes can take time if gaps appear. Start early.

If you prefer not to do this alone, our Cyber Essentials support helps organisations prepare for assessment and fix gaps. We prepare and support; the assessment itself goes through a certification body.

Conclusion: Cyber Essentials for government contracts

Cyber Essentials for government contracts is required where the contract carries higher risk, particularly personal data, OFFICIAL-level systems and sensitive areas such as defence. It also helps on lower-risk bids and in customer questionnaires by giving buyers independent evidence that the basics are in place.

The insurance link is useful but limited, so read the terms and speak to your broker. Check the tender, confirm your scope and start preparing before the deadline, not after it. If you want a hand, get in touch with NetMonkeys.

Frequently asked questions