PPN 014: the government contract rule that requires Cyber Essentials

UK government departments use Procurement Policy Notes (PPNs) to set standing requirements that suppliers have to meet before they can bid on certain contracts. One of these is the PPN that mandates Cyber Essentials, and in some cases Cyber Essentials Plus, for suppliers bidding on central government contracts that involve handling personal data or providing certain IT and network services. If you're bidding into central government, it's worth checking the specific PPN referenced in the tender documents directly, since the detail and thresholds are set by the current version, not a fixed rule that never changes.

This is a different requirement from the NHS and wider public-sector supplier rules we cover elsewhere: it sits at the level of central government procurement policy rather than being specific to health or local-authority contracts, though the practical effect is similar. If a tender or pre-qualification questionnaire references Cyber Essentials, treat it as a hard gate on being able to bid at all, not a box to tick after you've already won the work.

If a tender or pre-qualification questionnaire references Cyber Essentials, treat it as a hard gate on being able to bid at all, not a box to tick after you've already won the work.

The practical risk isn't the requirement itself, it's the timing. Getting certified takes real lead time: working through the question set, closing any gaps it turns up, and going through the certification body's review. None of that compresses well into the final days before a bid deadline. Businesses that check their tender pipeline early and start the readiness work before a specific opportunity forces the issue put themselves in a much stronger position.

Run the free 5-minute readiness check to see where you stand before a tender deadline is the thing forcing the timeline.