In short: Cyber Essentials supply chain assurance means asking suppliers to hold a current Cyber Essentials or Cyber Essentials Plus certificate as evidence of basic technical security. Government contracts under PPN 014, defence work through Defence Cyber Certification and many private buyers require it, and anyone can verify a certificate through IASME's search tools.
Why buyers ask suppliers for Cyber Essentials
Attackers often reach a target through a smaller, less well-defended supplier: a shared mailbox, an IT provider's remote access account or a contractor's laptop. Buyers cannot audit every supplier themselves, so they need a common, independently checked baseline.
The NCSC's supply chain security guidance describes Cyber Essentials certification as a practical way to gain confidence that suppliers and other third parties have put the fundamental technical controls in place, the kind that protect against most untargeted, commodity attacks. For a buyer that means:
- One recognised standard instead of a different questionnaire for every supplier.
- Independent verification. Answers are marked by an assessor at a Certification Body licensed by IASME, the NCSC's Cyber Essentials Delivery Partner; at the Plus level the controls are also tested hands-on.
- An annual cycle. Certificates expire after 12 months, so a current certificate says something recent about the supplier.
- Easy checking. Certificates can be looked up publicly (see below).
For suppliers the benefit runs the other way: one certificate can answer the same security questions for many customers, which saves time on tenders and onboarding.
The government push for supply chain adoption
Government and the NCSC are actively encouraging large organisations to require Cyber Essentials across their supply chains. The NCSC Annual Review 2025 points out that few UK businesses review the cyber risk posed by their immediate suppliers, often because buyers lack the capacity, skills or tools, and says the government is calling on large organisations to develop ways of raising Cyber Essentials adoption among their suppliers.
The same review describes a joint statement issued by the NCSC and the Department for Science, Innovation and Technology with six major UK banks, encouraging businesses to strengthen their defences and adopt Cyber Essentials across their supply chains. It also mentions a new IASME tool that lets organisations enter a long list of suppliers and see which are certified to Cyber Essentials or Cyber Essentials Plus, which is covered on our certificate search page.
For suppliers, the direction is clear: expect more customers, not fewer, to ask for a certificate as a condition of doing business.
Where Cyber Essentials is a formal requirement
Some requirements come from policy or contract terms rather than individual buyer preference. The main ones in the UK are:
| Requirement | Who it affects | What is asked for |
|---|---|---|
| PPN 014 | Suppliers to central government departments, executive agencies, NDPBs and NHS bodies on in-scope contracts | Cyber Essentials or Cyber Essentials Plus (or equivalent controls) before award, renewed every year of the contract |
| Defence Cyber Certification | Suppliers in the defence supply chain | Every level starts with Cyber Essentials; Levels 2 and 3 also need Cyber Essentials Plus |
| NHS DSP Toolkit | Organisations with access to NHS patient data and systems | An annual toolkit assessment; separate from Cyber Essentials, though NHS bodies can require Cyber Essentials when buying |
| Legal aid contracts | Firms holding Legal Aid Agency contracts | Cyber Essentials (or an equivalent standard) for the life of the contract |
| Colleges | Further education colleges in England | Cyber Essentials under the funding agreement; optional for schools |
| Private-sector buyers | Suppliers to larger companies | Varies by buyer; some ask for Cyber Essentials Plus where a supplier handles sensitive data or connects to their systems |
Always read the tender or contract wording. It will say which level is needed, whether an equivalent is accepted and when the evidence must be provided.
How buyers verify a supplier's certificate
A PDF certificate attached to a tender is a starting point, not proof. Good practice is to:
- Look it up. IASME's public certificate search lists current certificates and can be searched by organisation name or certificate number. For a large supplier base, IASME's Supplier Check tool lets you check a whole list of suppliers in one go.
- Check the legal entity. Under the Danzell question set, which applies to assessment accounts created after 26 April 2026, every in-scope legal entity must be listed in the assessment by name, address and company number. Make sure the company you are contracting with is one of them.
- Check the level and date. Is it Cyber Essentials or Cyber Essentials Plus, and will it still be valid when work starts?
- Check the scope. A certificate can cover the whole organisation or a defined part of it. Under the 2026 changes, certificates can carry a detailed scope description on IASME's digital certificate platform; confirm the part that will handle your data or systems is included.
- Diary the renewal. Ask for the renewed certificate each year, particularly where a contract requires annual renewal.
See how to check a Cyber Essentials certificate for more detail.
What Cyber Essentials does not cover
Cyber Essentials is a baseline, and buyers should treat it as one. PPN 014 itself makes the same points:
- It assures the supplier's own IT against five technical controls. It does not assure a particular product or service the supplier sells you.
- It is not designed to stop advanced, targeted attacks. Higher-risk contracts may need further controls, Cyber Essentials Plus testing or a wider standard such as ISO 27001.
- A supplier's certificate does not cover its own suppliers, such as cloud providers or subcontractors. Decide whether they need their own certificates.
The NCSC's supply chain guidance sets out twelve principles for gaining and keeping oversight of suppliers, and our UK cyber security frameworks hub explains where other standards fit.
How we help suppliers meet buyer requirements
If a customer or tender has asked for Cyber Essentials, Forever Systems gets you there in a planned way. We review your devices, cloud services and accounts against the current requirements in a gap analysis, fix the gaps, help you set a scope that covers what the buyer cares about, and support you through the question set. The assessment itself is carried out by an IASME-licensed Certification Body we work alongside, which issues the certificate.
Where the buyer wants Cyber Essentials Plus, we rehearse the audit beforehand, and we can help you keep compliant through the year so renewal is routine. Cost depends on your size, scope and how much needs fixing; see the cost factors and ask us for a quote.
Contact us with the buyer's requirement and your deadline.
Explore Supply chain
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Why do customers ask suppliers for Cyber Essentials?
It gives them independent evidence that a supplier has the basic technical controls that stop most common attacks, using one recognised standard rather than a bespoke questionnaire. The NCSC and government actively encourage large organisations to require it across their supply chains.
Is Cyber Essentials mandatory for suppliers?
Not by law, but it is required by many contracts. In-scope central government and NHS contracts require it under PPN 014, defence suppliers need it for Defence Cyber Certification, legal aid contracts require it, and many private buyers set it as a condition.
How do I check if a supplier has Cyber Essentials?
Use IASME's public certificate search, which lists current certificates, or IASME's Supplier Check tool to check a whole list of suppliers at once. Then confirm the legal entity, level, scope and issue date match what you need.
Does a supplier's Cyber Essentials certificate cover their subcontractors?
No. A certificate covers the organisation, or the defined part of it, that was assessed. Cloud providers and subcontractors are separate, so consider whether they need their own certificates or other assurance.
Should we ask suppliers for Cyber Essentials or Cyber Essentials Plus?
Base it on risk. Cyber Essentials is a sensible minimum for most suppliers; Cyber Essentials Plus adds hands-on testing and suits suppliers that handle sensitive data or connect to your systems. PPN 014 says Plus should be used where the risk is higher.