G-Cloud 15 Cyber Essentials:
Which Lots Need Certification?
Lots 1a and 1b (cloud hosting) require Cyber Essentials Plus at framework level. Lots 2a, 2b and 3 do not require Cyber Essentials at framework level, but individual buyers can require it in their call-offs.
We regularly certify G-Cloud suppliers inside 24 to 48 hours, including bid-deadline rescues. IASME accredited, first-time pass rate above 95 percent.
- Lot-by-lot advice on whether you need CE, CE Plus or neither at framework level
- Named IASME assessor guiding your G-Cloud 15 submission
- Pre-check before submission to maximise first-time pass
- 24 to 48 hour fast-track for bid deadlines
- Unlimited retests included
Check Your G-Cloud 15 Certification Requirements
Tell us your lot. A named assessor replies within 24 hours.
G-Cloud 15 Cyber Essentials requirements by lot
G-Cloud 15 (RM1557.15) is the Government Commercial Agency (GCA) cloud services framework, used by central government, local authorities, the NHS and the wider public sector. It has five lots, and the Cyber Essentials requirement is set per lot rather than as one rule for every supplier.
| Lot | What it covers | Framework-level requirement | What to check |
|---|---|---|---|
| Lot 1a | Cloud hosting | Cyber Essentials Plus required | Hold a valid CE Plus certificate covering the systems used to deliver the service. |
| Lot 1b | Cloud hosting | Cyber Essentials Plus required | Hold a valid CE Plus certificate covering the systems used to deliver the service. |
| Lot 2a | Infrastructure software as a service | Not required at framework level | Check each buyer's call-off. A buyer can ask for CE or CE Plus. |
| Lot 2b | Software as a service | Not required at framework level | Check each buyer's call-off. A buyer can ask for CE or CE Plus. |
| Lot 3 | Cloud support | Not required at framework level | Check each buyer's call-off. A buyer can ask for CE or CE Plus. |
Always confirm against the technical ability certificate for your lot in the official G-Cloud 15 tender documents and the framework notice on Find a Tender.
Framework requirement vs buyer (call-off) requirement
There are two separate checks. The framework-level requirement decides whether you can join a lot at all: Cyber Essentials Plus for lots 1a and 1b, and no Cyber Essentials requirement for lots 2a, 2b and 3.
The call-off requirement is set by each buyer when it awards work under the framework. A buyer can ask for Cyber Essentials or Cyber Essentials Plus on any lot, often where the work involves personal data or OFFICIAL information. Read every call-off specification, and treat certification as something a buyer may ask for, not something the framework imposes on lots 2a, 2b and 3.
Holding a certificate is one part of a bid. It does not by itself guarantee a place on the framework or a contract award.
Subcontractors and overseas suppliers
Subcontractors: there is no single rule that every subcontractor must be certified. Where your lot or a call-off requires certification, check whether it extends to subcontractors who handle the buyer's data or systems, and agree evidence with the prime contractor early. If a subcontractor needs certifying quickly, see fast Cyber Essentials certification.
Overseas suppliers: the lot rules apply wherever you are registered. Cyber Essentials is a UK scheme but accepts overseas organisations, and the scope covers the systems used to deliver the service, wherever they are hosted.
Realistic certification timelines
- 24 to 48 hours – prepared, scope agreed, MFA already enforced (fast-track).
- 5 to 10 working days – standard organisation, 10 to 49 staff, no blockers.
- 2 to 4 weeks – larger organisation, or MFA rollout and patching still needed.
If a certificate is required for your lot or call-off, it must be valid when it is required, usually at award. Plan renewal around your bid dates. Our guide to G-Cloud 15 deadlines covers timing in detail.
Common certification blockers
- MFA not enforced on every cloud user account – see the MFA requirements.
- Unsupported operating systems still in use – see the unsupported software guide.
- BYOD scope unclear or admin accounts shared.
- Security updates not applied within 14 days where the update fixes a critical or high-risk vulnerability.
Next steps
Work through the G-Cloud 15 supplier readiness checklist, and see how buyers confirm certificates in our guide to the Cyber Essentials Supplier Check Tool. Bidding on other Government Commercial Agency agreements too? The GCA framework requirements table covers RM6309, RM6399, RM6376, RM1043 and more. If you need CE Plus for lots 1a or 1b, start with Cyber Essentials Plus.
Why Cyber Essentials Matters for G-Cloud Suppliers
Public sector organisations handle highly sensitive information and require suppliers to meet minimum cyber security standards.
Protect Your Public Sector Revenue
For many technology and service providers, government contracts represent a significant part of their pipeline. Certification helps ensure you remain eligible to bid.
Maintain Framework Eligibility
Suppliers on government frameworks may need Cyber Essentials certification to maintain compliance with procurement requirements.
Continue Bidding for Contracts
Without certification, organisations may be unable to submit bids for certain public sector opportunities.
Demonstrate Security Credentials
Government buyers increasingly expect suppliers to demonstrate their cyber security posture. Cyber Essentials provides a recognised certification for tender responses.
Build Trust With Public Sector Clients
Certification signals that your organisation takes cyber security seriously and has implemented recognised protections for handling sensitive data.
Government-Backed Standard
Cyber Essentials is a recognised, government-backed standard demonstrating that your organisation has implemented key cyber security protections.
Built for Busy Suppliers
We guide your organisation through every step – our aim is to make certification predictable and efficient.
Built for Busy Suppliers
Many organisations bidding for government work are focused on delivery, not compliance processes. Our service makes certification straightforward and manageable.
Named Certification Advisor
One named UK assessor supports your organisation throughout the process – from start to certification.
Plain-English Guidance
We remove the technical complexity so your organisation can focus on delivering services. Clear explanations without jargon.
Direct Communication
Direct communication via phone, email or video. No ticket systems or automated responses.
We Handle the Complexity
Certification scope definition, environment readiness review, questionnaire guidance, security requirements explained, pre-submission review – all covered.
Retest Support Included
Pre-submission review catches issues early. If adjustments are needed, unlimited retests are included at no extra cost.
You Can Find Cheaper.
You Won't Find Easier.
We are not the cheapest certification provider. Our focus is helping organisations achieve Cyber Essentials certification quickly and efficiently.
Pre-Check Before Submission
We review your assessment before you submit, catching issues early to maximise your chance of first-time success.
Named Assessor Ownership
One named UK assessor guides you throughout – no ticket systems, no being passed around. Your assessor knows your organisation.
Unlimited Retests Included
If something needs adjusting, we'll guide you through corrections and retest at no extra cost. Unlimited retests included until you pass.
Fixed Fee, No Surprises
Fixed fee, no hidden extras. The price we quote is the price you pay – no scope creep, no nasty surprises at the end.
Fast Certification Available
Our process minimises disruption so your team can stay focused on delivery while we guide certification. Urgent turnaround available.
Post-Certification Support
We don't disappear after certification. Ongoing compliance advice included to help you stay secure.
Transparent Pricing
Most G-Cloud suppliers fall into the 1–9 or 10–49 employee categories.
How many employees are in your organisation?
Cyber Essentials Standard
Guided self-assessment with expert support
Organisations wanting certification with guidance
- Online questionnaire guidance
- Readiness review
- Named assessor support
- Certification valid 12 months
- £25k cyber insurance included
- Cyber Essentials badge
- Post-certification advice
Cyber Essentials Done For You
Ideal for busy organisations that want minimal internal effort
Hands-off certification for busy teams
- Everything in Standard
- Assessment completed for you
- Technical environment review
- Gap analysis and remediation guidance
- Policy templates if required
- Dedicated advisor support
- Expedited processing available
Need Cyber Essentials Plus or have specific requirements? for bespoke pricing.
Meet Your Assessors
You won't deal with a faceless organisation. You'll work directly with one of our two dedicated assessors – real people who genuinely care about getting you through.
Emma Wharram
Cyber Essentials Assessor
With almost 30 years of experience across data, information, and security in the public sector, Emma makes even the most complex requirements feel manageable. She holds a Master's in Cyber Security and is completing a PhD exploring how organisations build genuine security cultures. Her warm, approachable style puts everyone at ease – no jargon, no judgement, just clear guidance from start to finish.
- Warm, approachable style that makes the process feel manageable
- Deep public sector, healthcare, and education experience
- Passionate about helping every organisation feel confident in their security posture
Harpal Bilan
Cyber Essentials Assessor
Harpal brings a calm, reassuring approach rooted in his strong data and analytics background. With hands-on experience across data science and security frameworks, he makes the certification process feel straightforward and stress-free. No question is too small, no concern too basic – Harpal is there to guide you through every step and make sure you feel confident and supported throughout.
- Patient, supportive style – no question is ever too basic
- Data and analytics background bringing a detail-oriented, methodical approach
- Dedicated to making your certification journey smooth and worry-free
A Team That Reflects the Organisations We Serve
Cyber security is for everyone, and our team reflects that. Whether you're a sole trader or a large enterprise, our assessors bring a welcoming, judgement-free approach. We believe the best security outcomes come when everyone feels comfortable asking questions – no matter their background or experience level.
What Our Clients Say
Join organisations who've achieved certification with our expert support.
"The 24-hour turnaround was exactly what we needed. We had a GCloud tender deadline and the team delivered our certification with time to spare. The pre-check saved us from a simple mistake that could have delayed everything."
Sarah M.
Tech Consultancy
"Harpal from NixInfinity-AI was incredibly proactive and responded to our queries within a few hours. The Cyber Essentials assessment was explained well, and he made sure we understood the process. Thanks for all your help!"
Craig F.
Cybersecurity & Managed IT Services
"A very simple process with clear pricing, and the team was very responsive, including by WhatsApp. Highly recommend."
DearMP
Casework software for UK Members of Parliament
"Needed CE Plus urgently for a defence contract. They scheduled my assessment within days and the technical audit was thorough but not intimidating. Highly recommend."
David K.
Government Contractor
G-Cloud 15 Cyber Essentials FAQs
Get Cyber Essentials Certified
Speak with a certification advisor and receive a tailored certification plan for your organisation.
Related G-Cloud 15 Guides
G-Cloud 15 Supplier Readiness Checklist
Every evidence item GCA and IASME expect for a G-Cloud 15 Cyber Essentials submission.
Read guideG-Cloud 15 Deadlines: Cyber Essentials in Time
How to time CE against your G-Cloud 15 submission and award window.
Read guideCyber Essentials Supplier Check Tool
How buyers verify CE and CE Plus certificates, and what suppliers should check before a procurement review.
Read guide