PPN 014: what the Cyber Essentials procurement rule actually says

What PPN 014 is

A Procurement Policy Note (PPN) is an instruction from the Cabinet Office to public buyers. Action Note 014, titled “Cyber Essentials scheme”, was published in February 2025. It replaces the earlier notes PPN 09/14 and PPN 09/23, and buyers were told to apply it from 24 February 2025. The February 2025 update is explicitly not a change of policy: the underlying requirement has been in place, in one form or another, since 2014.

Who it binds

The note applies to central government departments, their executive agencies and non-departmental public bodies, and NHS bodies — the note calls these “in-scope organisations”. It does not, on its own terms, bind councils, universities, housing associations or private companies. It does say other public bodies “may wish to apply” the same approach, and in practice many do, which is why council tenders so often copy its wording. If you are bidding to a body outside central government, the tender documents, not the note, decide what applies.

When a buyer must ask for Cyber Essentials

The note does not say “every contract”. It says in-scope buyers must ensure suppliers meet technical requirements for contracts or services with certain characteristics. Paraphrased, those are contracts where the supplier:

• handles personal information about citizens — the note’s examples are home addresses, bank details and payment information;
• handles personal information about government employees, ministers or special advisers, such as payroll, travel or expenses data;
• supplies ICT systems or services designed to store or process data at the OFFICIAL classification level; or
• deals with information about the day-to-day business of government, service delivery and public finances, including commercially sensitive material and the contract itself.

For those contracts the note says the “quickest and most effective” mitigation is to require either Cyber Essentials or Cyber Essentials Plus, and that where the certificate is required it must be renewed annually for the life of the contract. Annex A gives worked examples: a CV-writing service holding jobseekers’ personal details, a car-hire contract holding civil servants’ home addresses and driving-licence numbers, a contact centre handling citizens’ National Insurance numbers. All three meet the test because of the data they hold, not because of what they sell.

Basic or Plus?

The note treats the two levels as options for the buyer to choose between. Its Annex B describes Cyber Essentials as the self-assessed level offering “a basic level of assurance”, and Cyber Essentials Plus as the same controls with independent vulnerability testing added, to be used “when there is a higher risk of cyber security threats”. A tender that says “Cyber Essentials” means the self-assessed level; Plus is named when it is wanted. The Basic versus Plus guide covers the practical difference, and the tenders guide covers how to read ambiguous wording.

When you have to show the certificate

Two timing points matter. Evidence of a current certificate (or an accepted equivalent) is required before contract award. The note also allows a buyer, in exceptional circumstances, to let a contract start while a lapsed certificate is being renewed — but it insists the supplier must hold it by the point at which data is passed to them. In plain terms: have the certificate before you submit, or at the very latest before you touch the buyer’s data, and never let it lapse mid-contract, because the annual renewal is a term of the deal. The how-long guide gives realistic lead times.

“Or equivalent”

The note is clear that a buyer must accept equivalents. Section 56 of the Procurement Act 2023 requires it, and the note says a supplier without the certificate must be able to show equivalent controls are in place “through other means” — normally verified by a technically competent, independent third party. That is a real route, but for a small business it is usually more work than simply certifying: the certificate is the pre-agreed way of proving the five controls, and the assessment fee starts at £320 + VAT. For Plus-level requirements the note says independent verification is required in every case.

What the note tells buyers not to do

Suppliers rarely read this part, and it is useful. The note says the scheme “should not be applied to all contracts as a matter of course”, that buyers must not take a blanket approach, that controls must be relevant and proportionate to what is being bought, and that buyers should take care not to over-burden suppliers or deter small and medium-sized enterprises and voluntary organisations from bidding. Annex A lists cases where it would be wrong to ask: a marketing-planning contract with no personal data, or a sole-trader driving instructor whose use of IT is incidental. If a tender demands Cyber Essentials for a contract that plainly touches no personal or sensitive data, the clarification process is the place to ask why — politely, citing the note’s own proportionality wording.

Two limits are also spelled out. Cyber Essentials does not assure a specific product or service being supplied, and it is not designed to stop targeted, sophisticated attacks. For higher-risk contracts buyers are told to add further measures, which is why some tenders pair the certificate with extra security schedules.

G-Cloud and framework suppliers

Suppliers on the Crown Commercial Service G-Cloud agreements are required to meet the government’s Cloud Security Principles, and are encouraged to state whether they hold Cyber Essentials — but the note says holding it is not a condition of the framework itself. Individual call-off contracts can still ask for it, and buyers are told to satisfy themselves about cyber risk before awarding one.

Cost, according to the note

The note’s own FAQ puts the basic-level cost for smaller companies at between £300 and £500 plus VAT and warns that it may change. The current IASME fee table is £320 + VAT for a micro-organisation rising to £600 + VAT for a large one; the cost guide has the bands and what else to budget for.

What it means for a small supplier

• If you handle citizens’ or civil servants’ personal data for a central government body, expect the requirement — and expect it to be checked at award, not after.
• Certify before you bid. The self-assessment is designed to be done in days once you have your device list and settings straight; waiting for a tender to appear is how businesses end up scrambling.
• Renewal is contractual. Put the expiry date in the diary; the renewal guide explains what changes year to year.
• The scope of your certificate matters. The note tells buyers to check whether a certificate covers the part of the business that will deliver the contract, and points out that your cloud providers are not covered by your certificate. Keep the scope honest and whole-organisation where you can.