Cyber Essentials for Recruitment Agencies

The sector's actual risk profile

• Candidate identity documents and right-to-work evidence stored in the CRM or shared inboxes.
• Bank detail change requests – the classic payroll diversion fraud target.
• High email volume with attachments from unknown senders, which is ideal phishing terrain.
• Consultants working remotely, often on mobiles, with high staff turnover.

Where certification is required

Public sector recruitment and supply frameworks commonly require Cyber Essentials from suppliers, including education supply teaching and wider resourcing agreements. See Cyber Essentials for education recruitment (RM6376) and the GCA frameworks hub. Private sector clients increasingly ask at onboarding, particularly in financial services, legal and healthcare recruitment.

Scoping a recruitment business

• Your CRM or applicant tracking system, and who administers it.
• Microsoft 365 or Google Workspace, including shared mailboxes used for candidate documents.
• Consultant laptops and mobiles, including personal phones used for work email – see BYOD rules.
• Any payroll or umbrella platform your staff administer.

Controls that matter most here

1. MFA on every account. Mailbox compromise is the entry point for payroll fraud, and it is the control buyers ask about first.
2. Leaver process. With high turnover, prompt account removal must be evidenced.
3. Separated admin accounts for the CRM and email tenancy.
4. Supported, patched devices across a distributed consultant base.
5. Malware protection on every device receiving CVs and attachments.

Beyond the certificate

Cyber Essentials does not cover process controls such as verbal verification of bank detail changes, but buyers often ask about both together. Pair certification with a documented payment verification step – it is the single most effective control against diversion fraud.

Cost and timeline

• £320 + VAT, priced by organisation size, with the £25,000 cyber insurance benefit for eligible UK organisations.
• 24 to 48 hours when prepared; two to four weeks if MFA is not yet enforced across all consultants.
• Cyber Essentials Plus £1,400 + VAT where a client requires audited evidence.