Do you need Cyber Essentials to supply the NHS or public sector?

Most public-sector procurement now mandates Cyber Essentials, or Cyber Essentials Plus, before a contract can start. This includes NHS trusts, defence and local-authority supply chains, and Crown Commercial Service frameworks more broadly. If a tender or supplier questionnaire mentions Cyber Essentials, it's almost always a hard requirement, not a nice-to-have.

The certificate itself has to come from an IASME-licensed Certification Body. There's no self-certifying route. What you can do yourself first is find out where you actually stand against the current rules, so you're not caught out partway through a tender process.

Run the free 5-minute readiness check to see where the gaps are before you commit to a certification timeline.