regulation
Cyber Essentials and Public Contracts
5 min readBy David OkonjoReviewed by Helen MarshPublished 2026-06-02Last reviewed 2026-07-22
In short
Cyber Essentials is mandatory for central government contracts involving the handling of personal or sensitive information, and is routinely requested elsewhere. Basic certification is a self-assessment verified by a certification body and can usually be completed in two to four weeks.
The five technical controls
Certification tests a deliberately narrow set of controls.
- Firewalls and internet gateways
- Secure configuration
- User access control
- Malware protection
- Security update management
Timing it around a tender
Start certification before the ITT lands. Suppliers regularly discover a mandatory requirement with ten days remaining and cannot remediate device estates in time.
Frequently asked questions
Is Cyber Essentials Plus different?
Yes. Plus adds a hands-on technical audit by the certification body and takes longer to arrange.
Sources