Cyber Essentials Plus and Microsoft 365 for construction and engineering

Construction and engineering firms are asked about cyber security at prequalification, by public sector clients and, for defence work, by the Ministry of Defence (MoD). In Build UK's Common Assessment Standard, holding Cyber Essentials Plus or ISO 27001 lets you skip seven questions on cyber security and data protection. Basic Cyber Essentials does not. Public buyers can also require it under Procurement Policy Note 014 (PPN 014), the government's rule on Cyber Essentials in contracts.

Build UK says central government departments and wider public sector bodies "should use the Common Assessment Standard to pre-qualify suppliers". Its question 161 asks whether you hold Cyber Essentials Plus or ISO 27001; a yes means you do not need to complete questions 163 to 169, which cover your cyber security policy and data protection. The question is advisory, but Build UK warns that any question not successfully completed "may be flagged" when your data is shared with contractors and clients. Build UK says Version 6 of the question set will be published on 1 November 2026. Commercial contracts matter as much as public ones: in the year to June 2026, 5,736 Cyber Essentials certificates were sought for a commercial contract and 5,291 for a government contract.

When the NCSC launched its first construction guidance in February 2022, it said construction businesses of all sizes "continue to be targets for cyber attackers due to the sensitive data they hold and high-value payments they handle" (NCSC). It named spear-phishing, ransomware and supply chain attacks as common threats.

Two Cyber Essentials rules to check on site and on the shop floor:

• Unsupported software. It must be removed, or kept on a separate network segment with no internet traffic. IASME says any company using unsupported software in scope will fail. So check old PCs that drive machines, plotters or printers.
• Updates. Critical and high-risk updates must go on within 14 days of release, on every in-scope device, including laptops that live in site cabins (NCSC requirements v3.3).

• Managed, £35 per user a month: computers monitored and patched with NinjaOne, up to 2 per user, so site laptops are on the same patching schedule as the office, with Huntress Managed EDR watched 24/7, Defender for Business, MFA, Microsoft 365 backup and unlimited remote fixes during support hours.
• Cyber Essentials Plus for the Common Assessment Standard shortcut, with our pre-audit check and the assessor booked for you. The Plus audit must be completed within 3 months of your Cyber Essentials certificate; book it at least 3 weeks ahead. For 20 to 49 people it is £3,295 a year on Managed or Secure and £3,895 without a plan; every band is on the Cyber Essentials Plus page.
• A Cyber Essentials Plus readiness check, £1,250 fixed for up to 25 devices, if you want to know where you stand before you pay for the audit.
• DCC if you work on MoD sites or contracts: see the defence suppliers section.

Fixing what the review finds: on our Managed and Secure plans, remote fixes to Microsoft 365 and your managed computers are included. On Essentials it is £95 an hour, and £125 an hour without a plan, or a fixed price once we've checked your setup. The certification body makes the decision.