Cyber Essentials Certification Readiness Check

Why this matters

Under Procurement Policy Note 014 (PPN 014), Cyber Essentials certification is now a mandatory requirement for suppliers bidding on certain UK public sector contracts commenced from 24 February 2025, and buying organisations must confirm suppliers meet the technical controls before contracts are awarded. From April 2026, the certification itself was updated to expect a more holistic approach to digital risk management — covering technical controls, organisational processes and ongoing monitoring — rather than a one-off checklist exercise, and the Ministry of Defence has separately asked industry partners to achieve Cyber Essentials as part of its Defence Cyber Certification (DCC) Level 0 requirement by 31 December 2026. Even outside direct government work, larger private-sector customers are increasingly pushing Cyber Essentials down their supply chains through procurement questionnaires and contract terms, and some cyber insurers now expect it as a condition of cover.

For small and mid-sized businesses that supply goods, services or IT to public bodies, larger companies, or the MOD, not holding — or not being ready for — Cyber Essentials certification can mean losing out on contracts or facing last-minute scrambles ahead of tender deadlines. The scheme itself is built around five technical controls: firewalls, secure configuration, user access control, malware protection and patch management. Businesses that understand which controls they already meet, which need work, and whether Cyber Essentials or the more rigorous Cyber Essentials Plus is likely to be required, are far better placed to certify quickly when a contract or client demands it — rather than losing the deal while catching up.

What you'll need

• Whether your business currently bids for, or supplies, public sector or MOD contracts
• Whether any clients or insurers have asked about Cyber Essentials certification
• Basic knowledge of your IT setup (in-house, outsourced IT provider, or cloud-based)
• Any existing security controls such as firewalls, antivirus software, or a patch management process

What you'll get

A personalised compliance report covering: a score out of 100, an executive summary, a list of findings ranked by severity, and a prioritised action plan with timeframes.