If your business wants to bid for UK public sector contracts, Cyber Essentials certification is no longer optional for many opportunities. Since the government introduced PPN 014, Cyber Essentials has been a mandatory requirement for suppliers tendering for central government contracts that involve handling personal data or delivering certain IT services.

For owner-managed businesses in Sussex and Kent with fewer than 25 employees, this requirement can feel daunting — particularly with the Cyber Essentials scheme updating again in April 2026. But certification is a structured process with clear requirements, and most SMEs complete it within a few months with the right guidance.

This article explains what Cyber Essentials is, why it matters for government contracting, and how to approach certification without losing sight of your core business.

Why Cyber Essentials Matters for SME Bidding

The National Cyber Security Centre (NCSC) developed Cyber Essentials as the government-recommended baseline for cyber security across all UK organisations. The scheme covers five core controls:

• Firewalls and internet security

• Secure configuration of devices and software

• Access control and user privileges

• Malware protection

• Security update management

Holding an up-to-date certificate allows your business to bid for government contracts through Contracts Finder where handling of financial or personal data is involved. Several government departments now require it as a pre-qualification condition before even considering a tender.

Beyond unlocking contracts, certification demonstrates to private-sector clients that you take data protection seriously. For an SME of ten to twenty-five people, that signal can be the difference between shortlisting and being filtered out.

What Changes Come to Cyber Essentials in April 2026?

The Cyber Essentials scheme is reviewed annually. The April 2026 update, which will apply to all new assessment accounts created after 26 April 2026, introduces stricter marking criteria and clarifies several areas that had caused ambiguity.

The five core controls remain unchanged. What changes is how those controls are assessed:

Multi-factor authentication (MFA) becomes mandatory. Under the updated scheme, MFA must be enabled for all cloud services where it is available — whether the option is free, included in your licence, or a paid add-on. Organisations that fail to implement MFA for available cloud services will automatically fail the assessment.

Stricter security update timelines. Two new questions have been designated as auto-fail: organisations must install high-risk or critical security updates for operating systems and router or firewall firmware within 14 days of release, and do the same for applications and associated files or extensions within 14 days.

Simplified scoping language. The terms "untrusted" and "user-initiated" have been removed from internet connection definitions. Organisations must now justify any networks excluded from the Cyber Essentials scope and explain how those networks are segregated from in-scope systems.

Enhanced backup guidance. Backup guidance has been repositioned earlier in the requirements document to reflect its importance in enabling recovery from cyber incidents.

Any assessment account created before 26 April 2026 will have six months to complete certification under the previous requirements. If you are planning certification for spring 2026, you have a clear window to prepare.

The updated Cyber Essentials Requirements for IT Infrastructure v3.3 is available from the NCSC, and IASME — the main assessment body — has published detailed guidance on the changes.

Cyber Essentials or Cyber Essentials Plus — Which Does Your Contract Require?

Most public sector contracts require the standard Cyber Essentials certificate, obtained through a verified self-assessment (VSA) completed on the IASME online platform and validated by an accredited assessor.

Cyber Essentials Plus adds a technical verification component: an assessor carries out an internal scan and spot-checks a sample of devices to confirm the five controls are properly implemented. This is typically required only when a specific contract or government department mandates it.

Your contract's procurement documentation will specify which level is needed. If it does not, standard Cyber Essentials will cover the minimum baseline requirement for most central government bids.

Getting Started: Your First Steps to Certification

For a small, owner-managed business, the most efficient path to Cyber Essentials certification follows three practical steps.

Assess your current position. Before engaging with an assessor, you need to understand how your IT environment aligns with the five controls. A Security Triage Baseline Review maps your current setup against the Cyber Essentials requirements, identifying gaps and estimating the effort needed to close them.

Close the gaps. Most SMEs find that addressing Cyber Essentials requirements involves well-known IT security practices: ensuring firewalls are configured, enabling MFA across cloud services (especially Microsoft 365), tightening access controls, and establishing a disciplined patching schedule. If you use Microsoft 365 as your core platform, several of these controls overlap with the security configurations you should already have in place.

Complete the assessment. Once your controls are in place, an accredited assessor — typically IASME — processes your self-assessment and issues your certificate. The process usually takes several weeks from start to finish.

The April 2026 changes mean now is the right time to start, not to wait. The MFA and patching-timing requirements will take effect immediately for new assessments, and planning ahead gives you time to address any infrastructure gaps without rushing.

Frequently Asked Questions

How long does it take an SME to get Cyber Essentials certified?

Most small businesses complete the process within four to eight weeks, depending on how far their current setup is from meeting the five core controls. The Self-Assessment questionnaire takes a few hours to complete; adding the time to close identified gaps is the main variable.

Does Cyber Essentials cover remote workers?

Yes. The scope includes all devices that access your organisation's in-scope systems, whether those devices are in the office, at home, or connecting remotely. The April 2026 update broadens this further by bringing home-working devices and routers more explicitly into scope.

What happens if we fail the assessment?

You receive feedback on which controls did not meet the required standard. You can rectify the gaps and resubmit your assessment. Under the April 2026 marking criteria, certain auto-fail questions mean that missing MFA on a cloud service or failing to meet the 14-day patching window will result in an automatic failure regardless of your overall score.

Can we maintain certification indefinitely once we have it?

Your certificate is valid for 12 months and must be renewed. The updated scheme now requires a signed declaration from a board member or director confirming that you will maintain compliance with all five Cyber Essentials controls throughout the certification period, not just at the point of assessment.

Is there a cost to get Cyber Essentials certified?

Fees vary between accredited assessors. IASME, which processes the majority of Cyber Essentials assessments, publishes its fee structure on its website. The cost is typically a few hundred pounds for the standard certificate.