Do sole traders need Cyber Essentials?

Sole traders working with public sector clients, regulated buyers or as supply-chain subcontractors are increasingly required to hold it. Certification is available at the micro tier for £320 + VAT.

Is Cyber Essentials mandatory for UK government work?

Yes, for UK central government contracts handling personal or sensitive information. It has been mandatory since 2014 and is enforced through the GOV.UK Procurement Policy Note.

Do private sector buyers require Cyber Essentials?

Increasingly, yes. It is common in supply-chain due diligence questionnaires from financial services, professional services and healthcare buyers.

Does my cyber insurance need it?

Many UK cyber insurers list Cyber Essentials as a minimum control or apply discounts for certified organisations. Some refuse cover without it for organisations holding regulated data.

I am a UK SME with no government work. Should I still get it?

If you handle client data, financial information or operate in a regulated sector, yes. It is a recognised baseline that customers, insurers and partners increasingly expect.

Who Needs Cyber Essentials? UK Buyer & Sector Guide

Mandatory for these buyers

UK central government – mandatory since 2014 for contracts handling personal or sensitive information.
Government Commercial Agency frameworks – G-Cloud 14, DOS 6, Tech Services 4, all require CE.
MoD suppliers – CE or CE Plus depending on DEFCON / Cyber Risk Profile.
NHS Digital – DSP Toolkit submissions reference Cyber Essentials.
Most local authorities – tender PQQs typically require it as a pass/fail.

Strongly recommended for these sectors

Independent Financial Advisers – aligns with FCA operational resilience expectations (SYSC, PRIN).
Law firms – meets SRA and Lexcel client confidentiality benchmarks.
Schools and MATs – DfE Digital Standards reference CE as a minimum.
Estate agents and property finance – AML and client money handling.
G-Cloud SaaS suppliers – framework eligibility.

SMEs bidding for private sector work

Large enterprises increasingly cascade Cyber Essentials down their supply chain as a contractual minimum. If you sell into financial services, professional services, healthcare or critical national infrastructure, expect to be asked. Holding the certificate before bidding is faster and cheaper than getting it under deadline pressure – though we can also help with urgent tender deadlines.

Cyber insurance

Many UK cyber insurers now require Cyber Essentials as a minimum control or offer reduced premiums for certified organisations. Our certification includes £25,000 of cyber liability cover for eligible UK organisations under £20m turnover.