Cyber Essentials in tenders: reading the requirement before you price the bid

Where the requirement comes from

Central government buyers work under a procurement policy note on Cyber Essentials (PPN 014 — the current note is linked under Sources) which requires suppliers to hold certification for contracts meeting its conditions: broadly, those involving certain personal or sensitive data or ICT systems. The precise conditions are the policy’s, not ours — read the note and, more importantly, the tender pack, which states what applies to this contract. For the note itself — who it binds, the four contract characteristics that trigger it, and where Plus comes in — see the PPN 014 explainer. The note also covers NHS bodies. Beyond those, councils, universities and prime contractors copy the requirement into their own tenders by choice, so the wording you actually face is whatever the buyer wrote. If the scheme itself is new to you, start with what the certificate covers.

Reading the wording

• “Cyber Essentials” alone means the basic, self-assessed certificate. “Cyber Essentials Plus” is named explicitly when the audited level is required — the comparison guide covers the difference and what Plus costs.
• “Or equivalent” appears in some packs. Buyers covered by PPN 014 must accept equivalents (normally verified by an independent third party), and what counts is for the buyer to judge — if you plan to rely on that clause, ask through clarification questions rather than assuming.
• When it’s needed varies: at bid submission, by contract award, or by service start. This single detail decides your timeline, and it’s a normal clarification question if the pack doesn’t say.
• Who needs it can include subcontractors handling the relevant data — if you’re the prime, check your chain; if you’re the sub, expect the ask.

Timing certification against a bid

The questionnaire is an afternoon, but honest preparation takes days to weeks depending on your starting point (the timing guide gives ranges), and the assessor’s review time belongs to your certification body. Working back: if certification is required at bid, start before you write a word of the response; if by award, start when you decide to bid — award timelines shrink without warning. What kills bids is discovering an unsupported device or a fleet without MFA a fortnight before deadline: run the free check the day the tender lands, so the fix list exists on day one.

Evidencing it

Certificates are listed on the scheme’s public register, searchable by organisation name — buyers check it, and you can check your subcontractors the same way. Keep the certificate number and date in your bid library alongside your insurance schedule, and diary the expiry: a certificate that lapses mid-contract becomes a compliance conversation nobody enjoys. The renewal planner turns the expiry date into a timeline, and continuous certification is itself a condition in some contracts.

If the deadline is genuinely too close

Be straight with the buyer through the clarification process: state that certification is underway and the date you expect it. Some buyers accept certification by award or mobilisation; some don’t — but a dated plan reads better than silence, and bidding while quietly uncertified where the pack requires it at submission risks the whole bid. The cheapest insurance is structural: for any business that sells to the public sector, holding the certificate year-round costs a few hundred pounds annually and removes this entire section from every future bid.