Public sector · Suppliers · Councils
Selling to government: the cyber security requirements, explained
A practical guide for suppliers bidding for central government, NHS and local authority contracts, and for the public bodies buying from them. It covers Cyber Essentials under PPN 014, GovAssure and the Cyber Assessment Framework, the local government CAF, and what the Cyber Security and Resilience Bill will change.
At a glance
Context
Why this matters now
Public bodies are being held to a higher cyber standard than ever, and they are passing that standard down their supply chains. The Government Cyber Action Plan, published in January 2026, set up a central Government Cyber Unit and committed government to meeting the same expectations it sets for industry. Many of the most damaging public sector incidents of recent years started with a supplier, not the public body itself.
For suppliers, that means cyber security is no longer a tick box at the end of a tender. It decides whether you can bid at all, how your answers are scored, and what you are contractually committed to once you win. For buyers, it means knowing what to ask for, and asking for it proportionately.
Procurement policy
Cyber Essentials and PPN 014
Procurement Policy Note 014, issued in February 2025 under the Procurement Act 2023, replaced PPN 09/23 and PPN 09/14. It applies to central government departments, their executive agencies and non-departmental public bodies, and NHS bodies. Other public bodies, including councils, may adopt the same approach, and many do.
When Cyber Essentials is expected
Buyers should require Cyber Essentials, or Cyber Essentials Plus where the risk justifies it, for contracts that involve:
- citizens’ personal data, such as addresses, bank details or payment information;
- personal information about government staff, such as payroll, travel or expenses;
- ICT systems and services that store or process information at OFFICIAL level;
- government business information, service delivery or public finances.
The certificate must be in place by the time data is passed to the supplier. It is renewed annually, and the Model Services Contract requires relevant subcontractors to hold it or an equivalent too.
What PPN 014 does not say
It is not a blanket requirement. The note tells buyers not to apply Cyber Essentials to every contract regardless of risk, and to avoid putting unnecessary burden on small businesses and voluntary organisations. Buyers may also accept equivalent controls, verified by a technically competent and independent third party. If a tender asks for Cyber Essentials on a contract with no data or systems at stake, it is reasonable to ask why.
Cyber Essentials or Plus?
Cyber Essentials is a verified self-assessment of five technical controls: firewalls, secure configuration, user access control, malware protection and security update management. Cyber Essentials Plus adds an independent technical audit of the same controls. Where the contract involves sensitive personal data or access to a public body’s systems, expect buyers to ask for Plus. Our Cyber Essentials guide covers the controls in detail.
Central government
GovAssure and the Cyber Assessment Framework
GovAssure is the government’s scheme for assessing the cyber resilience of its critical systems. Departments assess their systems against the NCSC Cyber Assessment Framework (CAF), have that self-assessment independently reviewed, and agree a targeted improvement plan. It is run by the Government Cyber Unit, which moved from DSIT to DCMS in 2026.
Why it matters to suppliers
GovAssure assesses systems, and many government systems are built, hosted or run by suppliers. When a department rates itself against CAF outcomes such as supply chain (A4.a), secure management (B4.c) or response planning (D1.a), it needs evidence from the suppliers who run those parts. Expect contract schedules and security questionnaires that follow CAF language, and requests to take part in assessments, exercises and incident rehearsals.
What changed with CAF v4.0
The NCSC released CAF version 4.0 to respond to a sharper threat. It adds or strengthens outcomes on understanding the threat (A2.b), secure software development and support (A4.b), threat intelligence in monitoring (C1.f) and threat hunting (C2.a), and treats AI risk throughout. Suppliers that develop software for government should read A4.b closely, alongside the government’s Software Security Code of Practice. Our NHS CAF and DSPT guide walks through every CAF outcome in plain English.
Local government
Councils and the local government CAF
The Ministry of Housing, Communities and Local Government (MHCLG) has adapted the CAF for councils in England. Participation is voluntary, and the process is set out in four steps: understand the framework, prepare and scope, complete a self-assessment with architecture maps, and get an independent review of that self-assessment with a plan to improve.
For councils, the local government CAF gives a common language for cyber risk that members, chief executives and auditors can all follow. For suppliers to councils, it means the same shift as in central government: expect questions framed around CAF outcomes, especially on supply chain, access and recovery.
Five questions for a council leadership team
- Which of our services would stop if our biggest IT supplier were unavailable for two weeks, and when did we last rehearse that?
- Do our contracts give us the right to see a supplier’s incident, backup and access evidence, and have we ever asked?
- Who holds administrator access to our systems, including suppliers, and when was it last reviewed?
- Have we completed a CAF self-assessment, and has anyone independent looked at it?
- If we were attacked tomorrow, who decides whether to pay, whom to tell and how to keep statutory services running?
Legislation
The Cyber Security and Resilience Bill
The Bill that will update the Network and Information Systems Regulations 2018 has completed committee stage in the House of Lords, with report stage scheduled for 26 October 2026 (checked 30 September 2026). It is not yet law. As introduced, it would:
- bring medium and large managed service providers and data centres into regulation;
- let regulators designate critical suppliers whose disruption would hit essential services;
- require significant incidents to be reported within 24 hours, with a fuller report within 72 hours;
- strengthen regulators’ powers and cost recovery.
If you provide managed IT services to public bodies, now is the time to check whether you would fall in scope, and whether you could meet a 24-hour reporting clock today.
Across the UK
Scotland, Wales and Northern Ireland
PPN 014 is a UK government policy note. The devolved administrations set their own procurement policy, but in practice the expectations are closely aligned: Cyber Essentials for contracts involving personal data, and the CAF as the common language for resilience. The Scottish Government’s Public Sector Cyber Resilience Framework is widely used by Scottish public bodies. See our pages for Scotland, Wales and Northern Ireland.
Tenders
What buyers ask in a tender
| Question | What a strong answer includes |
|---|---|
| Do you hold Cyber Essentials or Plus? | Certificate number, scope (whole organisation, not a single office), expiry date, and how you keep it valid between renewals. |
| How do you protect our data? | Where it is held, who can access it, encryption, retention and deletion at contract end. |
| How would you tell us about an incident? | A named contact, a time commitment in hours, and what information you would give in the first report. |
| How do you manage your own suppliers? | Which subcontractors touch the buyer’s data, and how you check them. |
| How do you recover from ransomware? | Offline or immutable backups, restore testing dates and recovery time for the service being bought. |
| Have you rehearsed an incident? | When, with whom (including leadership), and what you changed as a result. |
Evaluators score evidence, not adjectives. A dated exercise report beats a paragraph about being “committed to security” every time.
From experience
Where suppliers fall short
- Certificates that lapse. A Cyber Essentials certificate that expired mid-contract is a breach waiting to be found.
- Narrow scope. Certifying one office or one network while the contract is delivered from somewhere else.
- Always-on remote access. Supplier access to customer systems that is never switched off or reviewed.
- No incident clock. Contracts promise “prompt” notification, but nobody knows who calls the customer, or when.
- Untested backups. Backups exist, but a full restore of the service has never been tried.
- Policies without proof. Security answers copied from the last tender, with no evidence behind them.
Working with us
How we can help
We work with suppliers bidding for public contracts and with the public bodies buying from them. Every piece of work is priced in writing before it starts.
Tender readiness review
We review your security position against PPN 014 and the CAF outcomes your customers will ask about, and give you a prioritised gap list and evidence pack for bids.
Fixed price, agreed before we start
Independent CAF assessment
An independent review of a CAF self-assessment for councils, public bodies and suppliers, with risk and confidence ratings. Only where we have not helped you prepare.
Fixed price by organisation size
Executive cyber exercise
A realistic incident rehearsal for your leadership team, including the call to your public sector customer. It gives you the evidence tenders and CAF outcome D1.c ask for.
From £2,650 + VAT
Board and leadership briefing
A focused session so directors or council leaders understand the risk, the obligations and the questions to ask.
Fixed price per session
Runbooks and virtual CISO
Incident response, access review and backup testing runbooks, or a virtual CISO or DPO to own security for you.
Runbooks · Virtual CISO and DPO
Runbooks from £165 + VAT each
Exposure monitoring
Ongoing monitoring of what attackers can see of your organisation from the internet, reported in plain English.
Monthly fee, agreed before we start
Our independence rule
We never assess work we have advised on, and we never sell the fix for anything we assess. We never assess any organisation where a member of our team is employed. We do not sell the technology that would close the gaps we find.
Talk to us about public sector work Take the free self-check
FAQ
Questions we are asked
Is Cyber Essentials mandatory for all government contracts?
No. Under PPN 014 it is expected where a contract involves personal data, OFFICIAL-level ICT systems or government business information. Buyers are told not to apply it as a blanket requirement.
Do councils have to follow PPN 014?
PPN 014 applies to central government, its agencies and NHS bodies. Other public bodies, including councils, may adopt it, and many use the same approach in their tenders.
Cyber Essentials or Cyber Essentials Plus?
Plus adds an independent technical audit. Expect buyers to ask for it where the contract involves sensitive personal data or access to their systems.
Do our subcontractors need Cyber Essentials?
Under the Model Services Contract, relevant subcontractors must hold the certificate or an equivalent. Check your tender and contract schedules.
What is GovAssure?
The government’s scheme for assessing its critical systems against the NCSC Cyber Assessment Framework, with independent review and a targeted improvement plan. It is run by the Government Cyber Unit.
Will the Cyber Security and Resilience Bill affect us?
If you are a medium or large managed service provider or data centre operator, very possibly. It is still before Parliament, so check the final text when it passes.
Sources
Primary sources
- PPN 014: Cyber Essentials scheme (Cabinet Office, February 2025)
- GovAssure for central government departments (Government Security)
- Cyber Assessment Framework for local government (MHCLG)
- Government Cyber Action Plan (January 2026)
- Cyber Assessment Framework (NCSC)
- Cyber Essentials (NCSC)
- Cyber Security and Resilience Bill: stages (UK Parliament)