Cyber Essentials and Microsoft 365 for public sector suppliers

UK central government and NHS buyers must ask for Cyber Essentials, Cyber Essentials Plus or equivalent controls on contracts with higher cyber risk. The rule is Procurement Policy Note 014 (PPN 014), the government's note to its buyers, published on 17 February 2025 and still the current note. Councils and other public bodies can choose to follow it. It does not cover every contract, and where a tender says Cyber Essentials, the basic certificate is enough.

PPN 014 applies to "all central government departments, their executive agencies and non-departmental public bodies, and NHS bodies". It covers procurements started on or after 24 February 2025 under the Procurement Act 2023; earlier procurements fall under PPN 09/23. Buyers must make suppliers show they meet certain technical requirements on contracts with any of these features:

• the supplier handles citizens' personal information, such as home addresses, bank details or payment information
• the supplier handles personal information of government staff, ministers or special advisers, such as payroll, travel booking or expenses
• the supplier provides ICT systems designed to store or process OFFICIAL data
• the contract deals with the day-to-day business of government, service delivery or public finances

PPN 014 says the "quickest and most effective" way to manage these risks is for the requirements to include Cyber Essentials or Cyber Essentials Plus.

Timing matters. PPN 014 says any Cyber Essentials requirement "must be specified in the tender notice" and wants evidence before award. If the tender asks for Plus, you need Cyber Essentials first. IASME says that if your Cyber Essentials certificate is less than 3 months old when you certify to Plus, you do not repeat the questionnaire stage. Both certificates expire after 12 months. Scottish Government guidance says the need for certification "should be judged on a case-by-case-basis" (gov.scot). NHS bodies are inside PPN 014, and the healthcare and care page covers the extra NHS rules; Ministry of Defence contracts follow their own model, in the defence suppliers section. In the year to June 2026, the government's Cyber Essentials data records 5,291 certificates sought for a government contract and 5,736 for a commercial contract (DSIT management information).

1. Check the tender. Tell us what it asks for: Cyber Essentials, Plus or "equivalent". We say which you need and whether the deadline is realistic.
2. Fix what fails. The current requirements include MFA on every cloud account, critical and high-risk updates within 14 days, separate admin accounts and supported software. On Managed or Secure, patching, MFA and security settings are already part of the plan, and remote fixes are included.
3. Certify. On Managed or Secure, we fill in the answers from the setup we manage and you check them. Otherwise we review your answers. Either way we support the submission. For Plus, we run a pre-audit check and book the assessor.
4. Keep it valid. We handle the renewal each year, so the certificate stays in date for the life of the contract.

Cyber Essentials is £995 a year for 1 to 9 people, or £795 on Managed or Secure. Plus is £2,495, or £2,195 on a plan, and the Plus audit on its own is £1,495 if you already hold Cyber Essentials. Every band is on the Cyber Essentials and Cyber Essentials Plus pages. The certification body makes the decision.