Conditional requirement
Cyber Essentials / Cyber Essentials Plus
Cyber Essentials / Cyber Essentials Plus — conditional requirement, United Kingdom. It binds suppliers bidding for in-scope central-government contracts — departments, executive agencies, non-departmental public bodies and NHS organisations.
- Jurisdiction
- United Kingdom
- Record class
- Conditional requirement
- Instrument
- Certification
- Last verified
Where this applies
This record is scoped to United Kingdom. Scope is part of the claim: a rule that binds one part of a country does not bind the whole of it, and this library states the scope its sources state.
Instrument
PPN 014 — Cyber Essentials Scheme (procurements started on or after 24 February 2025; replaces PPN 09/23 and PPN 09/14)
Who it binds
Suppliers bidding for in-scope central-government contracts — departments, executive agencies, non-departmental public bodies and NHS organisations.
What it requires
For in-scope central-government contracts, a supplier must hold Cyber Essentials or Cyber Essentials Plus (or an accepted equivalent) before the contract is signed. The scheme owner is the NCSC; IASME is the official delivery partner. Under the Procurement Act 2023 s.56, in-scope bodies must accept equivalents.
Route to the authority
Last verified:
Related records and requirements
- Public Sector and Education — Applies if you're bidding for an in-scope central-government contract (PPN 014 scope).
- Technology and Data — Applies if you're bidding for an in-scope central-government contract (PPN 014 scope).
- Cyber Essentials — The general Cyber Essentials framework page — the same NCSC/IASME scheme, described there without this jurisdiction's procurement-mandate framing.
This page is for information only; it is not legal advice, and it does not establish whether this record applies to your business. Verify current status through the official source above.