Cyber Essentials for IT Consultants Bidding on Government Work

Why IT consultants keep hitting the same wall

IT consultancies win government work by responding to short-window opportunities. Miss the Cyber Essentials tick and the opportunity closes. Consultancies also carry higher risk in buyer eyes – they touch client environments, credentials and data. Buyers use CE as the entry filter.

Scope for a consultancy

• Whole organisation is normal – consultancies rarely have a separable delivery unit.
• Cloud tenants used for client work must be in scope.
• BYOD is common in consulting – document the policy and enforce MFA. See BYOD rules.
• Client-side devices that consultants access remotely stay in the client's scope, not yours.

Frameworks that require CE

• G-Cloud 15 – cloud hosting, software and support lots.
• Digital Outcomes 6 – outcome-based digital delivery.
• Tech Services 4 – technology services and consultancy.
• MoD Defence Cyber Protection Partnership – Profile 1 maps directly to CE.

Where consultancies fail first

• MFA on all cloud user accounts (not just admins) after the 2026 Danzell tightening.
• Unsupported operating systems on personal devices used for client work.
• Shared admin credentials for client tenants – must be separated.
• Patch cadence assumed rather than evidenced.

Sequence we recommend

1. Enforce MFA org-wide this week.
2. Pull a patch status report and confirm no unsupported OS in scope.
3. Book the assessment slot – see fast Cyber Essentials certification.
4. Reference the certificate in every G-Cloud, DOS and Tech Services submission going forward.

The framework-specific supplier hub is G-Cloud 15 Cyber Essentials. If you also sell to enterprise buyers who ask about governance maturity, look at IASME Cyber Assurance.