Do you actually need Cyber Essentials?
It is not a legal requirement — it is a contractual one, and increasingly a commercial one. Here is who genuinely requires it, who benefits without being asked, and the honest cases where it can wait.
The legal position, plainly
No law requires a UK business to hold Cyber Essentials. It is voluntary certification. What makes it feel mandatory is contracts: central government procurement policy requires it for contracts involving certain kinds of personal or sensitive data (the policy note is linked under Sources), and buyers across the public sector have adopted it as a standard supplier condition. Once a tender or a client’s supplier questionnaire names it, “voluntary” stops describing your situation.
Who requires it in practice
- Public-sector buyers. Central government departments and NHS bodies under the procurement policy, and — by their own choice — councils, universities and housing associations. If public-sector work is on your roadmap, treat the certificate as part of the bid.
- Larger private companies. Supply-chain security teams increasingly ask for it in onboarding questionnaires, because one certificate answers a whole block of questions. Subcontractors get asked because their client was asked.
- Some insurers. Cyber policies may ask whether you hold it, price around it, or expect the controls it certifies. Read your proposal form.
The benefit nobody requires
The five controls are aimed at the common, unsophisticated attacks that actually hit small businesses — password guessing, known holes in unpatched software, malware from a dodgy download. Going through the assessment once forces the basics into place: MFA everywhere, automatic updates, screen locks, leavers actually removed. That has value with or without the certificate; the certificate adds the ability to prove it, on a public register anyone can check, before the next client asks.
When it can honestly wait
If you sell only to consumers, nothing on the horizon mentions certification, and cash is tight — the certificate itself can wait. The controls should not: MFA, automatic updates and screen locks cost nothing and are the same measures you would need on the day a contract asks. Do the free parts now (the checklist shows the whole list), and certify when it wins you something.
Basic or Plus?
If a requirement lands, read it literally: “Cyber Essentials” means the basic self-assessment; “Cyber Essentials Plus” means the audited level on top. The comparison guide covers how to tell and what each costs. Most small businesses asked for certification are being asked for basic.
A quick decision path
- Has anyone named it? A tender, client, or insurer — then yes, and the only questions are which level and by when. Start with the step-by-step guide.
- Selling to the public sector or big firms this year? Get ahead of the questionnaire; certification mid-bid is possible but tense.
- Neither? Switch on the free controls now; put the certificate on the list for when a commercial trigger appears — the cost guide shows what you’d be budgeting.
Frequently asked questions
Is Cyber Essentials a legal requirement in the UK?
No. It is voluntary certification. It becomes effectively mandatory when a contract requires it: central government procurement policy requires it for contracts involving certain personal or sensitive data, and many public bodies and larger companies require it of suppliers.
Who typically asks for Cyber Essentials?
Public-sector buyers (central government, councils, NHS bodies, universities), larger private companies vetting their supply chain, and some cyber-insurers as a condition or premium factor. The request usually arrives via a tender or supplier questionnaire.
Is Cyber Essentials worth it if nobody has asked?
Often, for two reasons: the five controls are the measures that stop the common attacks that actually hit small businesses, and holding the certificate answers the supplier-security question before your next big client asks it. The public register lets anyone verify you hold it.
When is it reasonable to wait?
If you sell only to consumers, no contract on the horizon mentions it, and money is tight — do the free controls anyway (MFA, automatic updates, screen locks) and certify when a customer or tender makes it commercially worthwhile.
Do sole traders and micro businesses get asked?
Yes, increasingly — subcontractors on public-sector work and suppliers to larger firms are asked regardless of size. The micro fee tier exists precisely because one-person businesses certify.