In short: PPN 014 is the Cabinet Office procurement policy note that requires in-scope public bodies to ask suppliers for Cyber Essentials or Cyber Essentials Plus, or equivalent controls, on contracts involving personal data or certain ICT services. It applies to procurements started on or after 24 February 2025, and certificates must be renewed every year of the contract.
What PPN 014 is
PPN 014, *Cyber Essentials Scheme*, was published by the Cabinet Office on 17 February 2025. It replaces two earlier notes, PPN 09/14 and PPN 09/23, and restates the same policy using the terminology of the Procurement Act 2023 and the Procurement Regulations 2024.
The key dates:
- Procurements started on or after 24 February 2025 follow PPN 014, because that is when the new procurement regime took effect.
- Procurements started, and contracts awarded, before that date continue to refer to PPN 09/23.
- The update did not change the underlying policy. Government has asked for Cyber Essentials on certain contracts since 2014, and obligations already in place carry on.
You can read the note in full on gov.uk. The note itself says a fuller update will follow the NCSC's redevelopment of the scheme, so check gov.uk for any newer version before relying on the detail.
Which public bodies it applies to
PPN 014 applies to what it calls in-scope organisations:
- central government departments
- their executive agencies
- non-departmental public bodies (NDPBs)
- NHS bodies
Other public sector organisations, such as local authorities, are not bound by it but may choose to follow the same approach. The note is aimed at commercial, procurement and contract management staff as well as cyber security and digital teams, so expect the requirement to appear in tender documents, selection questionnaires and contract terms.
Which contracts are in scope
The note is not meant to be applied to every contract. A contract is likely to be in scope where it has one or more of these characteristics:
| Characteristic | Examples |
|---|---|
| The supplier handles citizens' personal information | Home addresses, bank details, payment information |
| The supplier handles personal information about government staff, ministers or special advisers | Payroll, travel and expenses data |
| ICT systems or services are designed to store or process data at OFFICIAL | Hosted systems, managed IT services, software that holds government data |
| The contract deals with day-to-day government business, service delivery or public finances | Contact centres, service delivery, finance-related work |
The note gives further examples in an annex, which it describes as illustrative rather than a complete list. Buyers must not take a blanket approach: controls have to be relevant and proportionate to what is being bought, decisions should be recorded in the audit trail, and the note warns against over-burdening suppliers or deterring small and medium-sized enterprises. If you think a requirement has been applied where it does not fit, raise it with the buyer through the tender's clarification process.
What suppliers must show, and when
For an in-scope contract, the supplier must meet the Cyber Essentials technical requirements. PPN 014 describes certification as the quickest and most effective way to show this:
- Hold Cyber Essentials or Cyber Essentials Plus, as the buyer specifies, covering the legal entity that delivers the contract.
- Provide the evidence before contract award, and make sure it is valid when the buyer's data is passed to you.
- Renew every year for the whole life of the contract. A lapsed certificate is a contract compliance problem.
A supplier without a certificate can instead show equivalent controls. The note says that evidence should normally be verified by a technically competent, independent third party, which can easily be more work than simply certifying. In exceptional cases a buyer can take a recorded, risk-based decision to let a contract start while an expired certificate is being renewed, but the supplier must still have valid certification or equivalent controls before data is handed over.
Cyber Essentials or Cyber Essentials Plus?
The buyer decides which level to ask for. PPN 014 describes Cyber Essentials as a self-assessment verified by a Certification Body that gives a basic level of assurance, and Cyber Essentials Plus as the same five controls with added remote and on-site vulnerability testing, to be used where there is a higher risk of cyber threats.
The note also flags that some contracts, such as professional services handling data above OFFICIAL or managed and outsourced ICT services that store data, are likely to need controls beyond the scheme. Our Cyber Essentials vs Cyber Essentials Plus page compares the two levels in detail.
Scope, subcontractors and cloud services
Some points in the note's FAQs catch suppliers out:
- Certificate scope. By default the certificate should cover the legal entity providing the goods or services. If your certificate covers only part of your organisation, make sure that part is the one delivering the contract. See defining your Cyber Essentials scope.
- Third parties. Your certificate does not assure your cloud providers or subcontractors. Buyers are told to check scope and consider whether third parties need certification too. Larger, complex ICT and outsourcing contracts let under the government's Model Services Contract require relevant subcontractors to hold Cyber Essentials, Cyber Essentials Plus or equivalent.
- G-Cloud. Suppliers on G-Cloud must show they meet the Cloud Security Principles; Cyber Essentials is encouraged there but not required.
- Legacy IT. Systems that cannot meet the requirements need alternative controls agreed with the buyer.
For suppliers, the safest position is a whole-organisation certificate, renewed on time, with your certificate details matching the entity named in the contract.
How we help public sector suppliers
Forever Systems prepares suppliers for PPN 014 requirements: we check your scope matches the contracting entity, run a gap analysis against the current question set, fix what is missing and support you through assessment with an IASME-licensed Certification Body, which issues the certificate. Where a tender asks for Plus, we rehearse the audit first. We then help you stay compliant so the annual renewal never puts a contract at risk.
Pricing depends on your size and starting point, so ask us for a quote. Contact us with the tender deadline and we will plan backwards from it.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is PPN 014?
PPN 014 is a Cabinet Office procurement policy note, published in February 2025, that tells central government departments, their agencies, NDPBs and NHS bodies to require Cyber Essentials, Cyber Essentials Plus or equivalent controls from suppliers on contracts involving personal data or certain ICT services.
What did PPN 014 replace?
It replaced PPN 09/14 and PPN 09/23. The policy is the same; the note was updated for the Procurement Act 2023. Procurements started before 24 February 2025 still refer to PPN 09/23.
Does PPN 014 apply to local authorities?
Not directly. It applies to central government departments, executive agencies, NDPBs and NHS bodies. Other public bodies, including local authorities, may choose to apply the same approach, so check each tender.
When do I need my Cyber Essentials certificate for a government contract?
Before the contract is awarded, and it must be valid when the buyer's data is passed to you. You then renew it every year for the life of the contract.
Can I use another standard instead of Cyber Essentials?
PPN 014 allows suppliers to show equivalent controls instead, normally verified by an independent, technically competent third party. In practice certification is usually the simplest route, and the tender will say what evidence it accepts.
Does PPN 014 require Cyber Essentials Plus?
The buyer chooses the level. PPN 014 says Cyber Essentials Plus should be used where the risk is higher, so some contracts ask for Plus and others accept the basic certificate.