Do I Need Cyber Essentials Plus for Government Contracts?
Cyber Essentials Plus is required when the ITT or framework lot explicitly demands external vulnerability testing — common on central government ICT, some NHS and defence-related procurements. Basic Cyber Essentials proves self-assessed controls; Plus adds hands-on technical verification. Suppliers must confirm which level is mandatory before pursuit because Plus certification takes longer and costs more.
Put this into practice
Use TenderLedger to find, qualify and win UK public sector contracts with buyer context, award history and renewal signals.
Why this matters commercially
Submitting Basic where Plus is mandatory is an automatic compliance failure.
Plus testing can reveal gaps that delay certification — timeline risk on tight ITTs.
Competitors with Plus already in place win on speed when cyber is scored.
Renewal requires repeat testing — budget for ongoing certification not just first bid.
How suppliers usually do this manually
Teams obtain Basic certification and assume it satisfies all government cyber questions.
External tester engaged only after ITT release — cannot certify before deadline.
Scope excludes remote workers or cloud assets that Plus testing must cover.
Group certification on parent entity while subsidiary with different infrastructure bids.
Signals worth tracking
ITT states 'Cyber Essentials Plus' explicitly — not 'Cyber Essentials or equivalent'.
G-Cloud or central government framework lot descriptions require Plus at application.
Security questionnaire asks for external assessment report or Plus certificate number.
Contract involves administration of OFFICIAL-SENSITIVE or connection to government networks.
Buyer published cyber procurement policy distinguishing Basic versus Plus tiers.
Common mistakes to avoid
Quoting Basic certificate number in Plus mandatory field.
Failing remediation retest after Plus assessment failures.
Certifying wrong organisational scope — legal entity mismatch at evaluation.
Letting Plus lapse between framework award and call-off submission.
Assuming ISO 27001 automatically substitutes without ITT permission.
How TenderLedger supports this workflow
TenderLedger identifies ICT tenders and buyers where Plus is historically required.
Qualification prevents pursuit of cyber-gated opportunities without feasible certification timeline.
Competitor award data shows cyber credential patterns on similar contracts.
Investment in Plus follows evidence of recurring pipeline demand — not single ITT panic.
Why teams trust TenderLedger
- - Built for UK public procurement suppliers and bid teams
- - Uses official sources including Find a Tender and Contracts Finder
- - Designed for qualification, not just notice volume
About this data
TenderLedger aggregates UK public procurement signals from official sources including Find a Tender (FTS) and Contracts Finder. We combine notice metadata, contracting authorities, and award history into a consistent opportunity view for suppliers.
For these pages, we structure insights using procurement patterns commonly visible in award notices, framework call-offs, and DPS activity. The examples below are designed to mirror how supplier teams qualify bids day-to-day.
Author: TenderLedger Research Team
Last updated: 01 June 2026
FAQs
What is the difference between Cyber Essentials and Plus?
Basic is self-assessment. Plus adds independent technical verification of your controls and devices.
How long does Cyber Essentials Plus take?
Typically four to eight weeks including testing and any remediation — plan well before ITT deadlines.
Can I upgrade from Basic to Plus quickly?
You must complete Plus assessment and testing. Basic alone does not convert — allow full Plus lead time.
Related pages
Suggested next reads
For a practical starting point, read UK contract renewal playbook and Find contracts likely to re-tender soon. Then compare Public procurement intelligence platform and Contract award tracking for a pipeline view. Finally, see Healthcare procurement intelligence for sector examples and qualification signals.
Ready to improve your UK public sector pipeline?
Use procurement intelligence to identify better opportunities earlier and qualify faster.
Stop browsing notices manually.
Start prioritising the contracts you can actually win.
Start Free TrialBuilt on official UK procurement sources