Cyber Essentials for Local Authority and Council Contracts

What council PQQs typically ask

• Do you hold a current Cyber Essentials certificate? Provide the number and expiry date.
• Does the scope cover the services delivered under this contract?
• Do you hold Cyber Essentials Plus, and if not, will you obtain it within a defined period?
• How do you assure your own sub-contractors?

Buyers verify the certificate on the public IASME registry, so the number and expiry date must match.

Contract types where Plus is more likely

• Adults and children's social care systems or case management.
• Revenues, benefits and housing systems holding financial data.
• Managed IT, hosting or network services for the authority.
• Any contract giving you privileged access into council infrastructure.

See CE vs CE Plus before committing to a level in your bid response.

Scope: the most common scoring problem

Councils increasingly check that your certificate scope covers the delivery team rather than just head office IT. If you certify a narrow slice of the business, expect a clarification question. Whole-organisation scope is usually the cleaner answer. Read good vs bad scope statements.

Timing against the tender calendar

Certification must normally be valid at award, not at submission. In practice, holding the certificate before you submit avoids clarification rounds and scores better. Prepared suppliers certify in 24 to 48 hours; allow two to four weeks if MFA is not yet enforced everywhere. If your deadline is imminent, see urgent tender certification.

Small suppliers and voluntary sector organisations

Cyber Essentials is deliberately proportionate. A ten-person charity delivering a council-funded service goes through the same five control areas as a large supplier, at the lowest pricing band, and typically qualifies for the £25,000 cyber insurance benefit for eligible UK organisations. Details on the Cyber Essentials page.