Cyber Essentials certification: guidance for small and medium-sized enterprises

Why are cyber security controls essential in public sector procurement?

Procurement Policy Notes (PPNs) are used to communicate new policies, which must be applied to public procurement activities. Under the UK government’s PPN 014, Cyber Essentials (CE) certification is now mandatory for certain public sector contracts. Contract examples which meet the characteristics for inclusion of CE requirements can be found in PPN 014 Annex A.

PPN 014  aims to ensure effective and proportionate cyber security controls are applied to public sector contracts to mitigate cyber security risks in the Government supply chain. The note, which replaces PPN 09/23 and PPN 09/14, reflects new terminology introduced by the Procurement Act 2023 and the Procurement Regulations 2024. However, it does not constitute a change in policy.   

Buying organisations that are in scope of PPN 014 must ensure all suppliers demonstrate that they meet certain technical requirements for contracts or services considered to be at a higher risk of cyber security threats. The quickest and most effective means of mitigating cyber security risks associated with such contracts is to request that suppliers provide evidence of CE certification before contract award. 

CCS procurement teams will decide on whether to make CE or CE plus a mandatory requirement according to the nature of the contract and the type of market you’re working  with. Suppliers will be notified at the Preliminary Market Engagement stage.

What are Cyber Essentials and Cyber Essentials Plus?

CE is a Government-backed scheme developed by the National Cyber Security Centre (NCSC). It represents the minimum baseline of technical cyber security controls prescribed by the Government for organisations of all sizes in the UK.

The scheme is administered by government approved certification bodies which are currently accredited by Information Assurance for Small and Medium Enterprises (IASME). 

CE helps organisations to protect against the most common cyber attacks by ensuring 5 basic technical controls are in place that can protect against 80% of common cyber security threats.

CE Plus assesses the same technical controls as CE and comprises remote and on-site vulnerability testing. CE Plus checks whether the controls put in place actually provide a defence against basic hacking and phishing attacks. It is a more rigorous assessment, to be used when there is a higher risk of cyber security threats.This audit helps organisations demonstrate a stronger commitment to cyber security and can be a requirement for some government contracts. An organisation can complete their CE Plus audit within 3 months of their last CE certification.

How can suppliers get Cyber Essentials and Cyber Essentials Plus certification?

Cyber Essentials

CE is a self assessment option. Organisations complete a questionnaire which is verified by an independent certification body to assess whether the appropriate standard has been achieved and certification can be awarded. 

The cost of CE at basic level ranges from £320+VAT for a micro organisation

Cyber Essentials Plus

For CE Plus costs start from approximately £1,400+VAT for a micro organisation due to the thoroughness of the assessment. 

CE certifications, both Standard and Plus, are valid for 12 months. Certification must be renewed annually. Failure to renew within the 12-month period will result in the organisation being removed from the NCSC’s certified list.

Suppliers are encouraged to read the full requirements of the Cyber Essentials and Cyber Essentials Plus Scheme 

Why should SMEs get cyber essentials certification? 

Obtaining CE certification demonstrates your business’s commitment to cyber security. This can build trust with public sector clients, who are increasingly focused on ensuring the security and integrity of their sensitive data. 

There are a number of further benefits to obtaining certification: 

  • implementing CE controls can significantly reduce your organisation’s vulnerability to cyber attacks, improve overall cyber security and reduce damage to operations and costly disruption. 
  • According to a recent report(i), the average cost of a cyber attack for an SME is over £3,000. Furthermore, research carried out by the NCSC states that “92% fewer insurance claims are made by organisations who have CE controls in place”. 
  • CE certification includes automatic cyber liability insurance for any UK organisation who certifies their whole organisation and has less than £20 million annual turnover.
  • Public sector organisations are increasingly aware of the risks associated with cyber attacks, including financial loss, reputational damage, and legal repercussions. Companies with robust cyber security measures can demonstrate their ability to mitigate these risks and reduce their liability, making them more appealing to public sector clients.

Need help with getting your CE certification?

PPN 014 contains links to CE Advice and Guidance, the CE readiness toolkit and the NCSC Supply Chain Risk Assessment Guidance. There is also a list of useful FAQs regarding CE certification available from IASME

Cyber Essentials certification –  5 things suppliers need to know

  1. Although required for all CCS commercial agreements, not all contracts require suppliers to be certified under a CE Scheme. CE certification (or equivalent) should only be required by contracting authorities where it is relevant to the subject matter of the contract, proportionate and necessary to manage cyber security risks. 
  2. If a supplier does not hold CE certification, they can still bid for CCS agreements requiring CE if they can demonstrate equivalent controls are in place which meet CE requirements. This should be verified by a technically competent, independent third party.
  3. The ISO27001 standard doesn’t automatically conform to CE because it is not usual for all of the 5 CE technical controls to be included in the scope for ISO27001 implementation
  4. Evidence of holding a CE certificate (or equivalent) is essential at the point when data is to be passed to the supplier at the point of entering into a call off contract. The initial self-assessment will help you identify areas to address to avoid having to reapply and incurring an additional application fee. If you receive a ‘fail’ notification, you will have 2 working days to resolve any issues and resubmit for further review without  further cost.

Find out more

If you require further information when bidding on a CCS procurement please follow the instructions for clarification questions in the published bid pack.

To learn more about how CCS is levelling the playing field for suppliers of all sizes, download our digital brochure.

We always welcome feedback, suggestions or queries. These can be submitted to smefeedback@crowncommercial.gov.uk

(i) Source: Securing SuccessThe Role of Cybersecurity in SME Growth

Crown Commercial Service and NHS England celebrate 3 years of transforming NHS infrastructure

A CCS and NHS England partnership, through the Construction Works and Associated Services 2 and ProCure23 commercial agreement, has supported the NHS in awarding £1.8 billion of healthcare construction schemes and securing a pipeline of future projects worth an extra £1.7 billion. 

The agreement enables the NHS to work with CCS to effectively procure design, construction and building services at capped rates. Previous iterations  have supported the NHS in procuring over £10 billion worth of projects, helping to build an NHS estate that is fit for the future.

It is NHS England’s preferred route to market for the provision of design and construction services to NHS capital projects. Since launching in spring 2022, 102 contracts have been awarded through the Gold Standard agreement. It directly supports the government’s commitments to modernise NHS infrastructure while implementing construction playbook principles, which include a focus on modern construction delivery, sustainability and social value.

During 2024/25 notable projects procured through the agreement included:

  • a new, state-of-the-art adult mental health inpatient hospital at North View, Manchester, which provides 150 single en-suite bedrooms across 9 single-sex wards, supporting national ambitions to eradicate dormitory accommodation in mental health facilities.
  • a new Community Diagnostic Centre at Newmarket Community Hospital in West Suffolk, which improves access to a range of diagnostic tests such as MRI, CT, ultrasound and X-rays.
  • construction of a new 9-storey link extension to the Royal Marsden Hospital, London, which will expand patient capacity and modernise existing facilities.
  • improvement to Urgent and Emergency Care services at Heartlands Hospital, through a new 10,000 square metre emergency department. 

Since the partnership began, over 50 NHS trusts have procured through the agreement, gaining access to benefits including:

  • capped framework rates and fees and a robust pool of approved suppliers who are proficient with health/complex project design and construction
  • NHSE implementation leads support, offered in an impartial capacity, free of charge
  • call-off options to suit differing project needs, values and complexities while ensuring clients’ post-construction review compliance.
  • templated New Engineering Contracts , guidance and information papers. 

The agreement also promotes innovation in modern construction methods. All suppliers on ProCure23 are committed to emerging construction technologies and net zero carbon techniques, ensuring innovation is at the forefront of all capital delivery within the NHS.

John Welch, Commercial Director for Estates at CCS, said: 

Over the past 3 years, CWAS2/ProCure23 has enabled trusts to deliver essential healthcare facilities faster, more cost-effectively, and with greater attention to patient and staff needs. We’re proud to see these projects continuing to make a tangible difference to healthcare provision across the country. CCS is passionate about our commitment to our National Health Service and working together to positively change patients’ lives.

Simon Corben, Director of Estates and Facilities at NHS England, added: 

ProCure23 builds on almost two decades of success of ProCure as a route to market for NHS capital projects. Now in its third year, this award-winning partnership with Crown Commercial Service has proven to be a cornerstone in addressing all aspects of the NHS’s capital requirements. This includes not only increasing our estate’s capacity with new developments, but also the crucial work of managing backlog maintenance, and reconfiguring spaces to better meet the health and care needs of our local communities.

The ProCure23 agreement

The ProCure23 agreement gives healthcare organisations access to approved suppliers who can help them to increase their estate’s capacity through a range of construction works and services to better meet the health and care needs of their local communities. 

Lots 1-3 are specifically for healthcare projects in England, while lots 4 and 5 are available to all public sector bodies in the UK. 

The agreement runs alongside our existing Construction Works and Associated Services agreement which helps support a wide range of major and minor building and civil engineering projects of all values for the public sector, helping our customers build everything from new schools and hospitals to prisons and houses. 

Together we are building an NHS fit for the future 

To find out more about our Construction Works and Associated Services 2/Procure23 agreement, please visit our framework page. To speak to a member of our expert team, please complete our online form or call us on: 0345 410 2222.

You can also visit our Estates webpage to learn more about our complete construction offering and check out our handy resources; from webinars, podcasts, to interactive guides – we’ve got you covered. 

Call for evaluators for the latest iteration of the Facilities Management and Security Services agreement

We are looking for evaluation support from our public sector customers for the newest iteration of the Facilities Management and Security Services agreement (RM6378). Invitation to tender (ITT) is launching in early September 2025. This is a great opportunity to assist cross-government commercial colleagues and be part of a group of experienced professionals.

The evaluation period is planned for November to mid December 2025.  It is expected that consensus and moderation meetings will take place from early January to mid February 2026.  

Full training will be provided for evaluators during late September to early October 2025. This will be a 1-2 hour virtual meeting.

We will confirm specific dates as soon as possible, however we would appreciate all indicative offers. If you are interested please email info@crowncommercial.gov.uk and quote RM6378 in the subject line.

Changes to our agreements in April

Welcome to our monthly framework update to help you with your procurement planning. We will publish it online each month and also share it in our newsletters and on our social media channels.

The update provides a brief summary of what has been awarded, extended or expired during the previous month. It also outlines what is due to expire in the next 3 months.

You can also get an overview of all of our live frameworks in our interactive digital brochure.

Agreements awarded in April

Agreements extended in April

Agreements that expired in April

Agreements due to expire in the next 3 months

Further information

If you need further details about any of these agreements get in touch.

You can also find out what new procurements we are working on by exploring our upcoming agreement page.

If you don’t currently receive our monthly customer newsletter why not also subscribe to receive these updates and more directly to your inbox? fill in this short form.

CCS recognised for providing high quality public service

We’re pleased to announce that CCS has achieved a ‘Best’ rating (over 90%) in the most recent Commercial Continuous Improvement Assessment Framework (CCIAF) review. 

The CCIAF is a requirement introduced by the Cabinet Office in 2021 for all relevant public bodies to assess themselves against publicly available procurement standards. The standards define how all Government departments should operate commercially to ensure strong commercial behaviours and obtaining best value for taxpayers money. It is designed to help achieve continuous improvement and set standards for commercial practices across the public sector. 

CCIAF assesses each organisation’s practices against 8 theme areas including capability and resourcing, functional strategy, planning and governance, commercial systems and information and policy.

The assessment provides each organisation with a commercial maturity rating (Good, Better and Best). Best practice and innovations are shared with other public sector commercial organisations.

How we achieved the ‘Best’ rating

Following a previous assessment in 2023, we had already made significant progress, increasing our score by 10 points, to 85%. But given our role as the UK’s biggest public procurement organisation, we knew we had an opportunity and a responsibility to improve this score.

To improve, our Operational Control Centre (OpCC) put in place an action plan focusing on all assessment measures where we scored below 90%. Across the 8 themes of the CCIAF assessment, we identified 88 areas for development and worked collaboratively to address them. Our goal was to reach the ‘Best’ rating by securing a score over 90% .

Our assessment was peer reviewed by another governmental department to verify results. This year, the Department for Education carried out an extremely thorough assessment.

What does ‘Best’ rating mean?

Achieving a ‘Best’ rating means that we demonstrated: 

  • the governance and direction of delivering commercial activities is fully integrated with the governance and direction of CCS
  • commercial strategies incorporate short and long term targets in line with leading industry practice
  • commercial policy outcomes are embedded throughout the commercial life-cycle and outcomes reports are available on demand
  • technology is used to make commercial reporting and analytics accessible to inform organisational strategy and policy decisions
  • learning from experience and organisational improvement is demonstrated through continuous improvement being embedded and evidenced within the organisation

CEO of CCS, Sam Ulyatt says

“This achievement is the result of a dedicated, cross-directorate effort to strengthen our commercial capability, make improvements, and showcase best practices. Thank you to everyone within CCS who contributed.

While we have demonstrated significant improvements this year to achieve a ‘Best’ rating, we are not intending to rest on our laurels and are committed to continuing to ensure that we are a world class procurement organisation. We will build on this momentum for even greater success in the future and to continue to achieve value for the nation.”

Find out more   

Further guidance on the CCIAF is available on the GOV.UK website.

 

What suppliers need to know about creating and maintaining Carbon Reduction Plans

In this article, Marta Hyder, Crown Commercial Service’s (CCS – now GCA) CRP compliance lead, advises suppliers on how to meet their net zero requirements to continue to work with the public sector.

What is a Carbon Reduction Plan?

A Carbon Reduction Plan (CRP) is a strategy that demonstrates how an organisation is committed to reaching net zero by 2050 in line with the Government’s ambitions. It is designed to help buyers understand the impact a contract has upon the environment.

It should:

  • state the supplier’s clear commitment to achieving net zero by 2050 or before
  • contain carbon emissions data from the most recent 18-month reporting period before the CRP’s submission
  • outline the emissions reduction measures and projects you already have in place, or will implement, that will be used in the delivery of the contract for which you are bidding
  • detail any structural changes that might impact your environmental activity
  • be published on your website within the last 12 months

A CRP is a compliance requirement for UK Government suppliers when bidding for government contracts with an anticipated annual value (including VAT) of £5 million or above.

To stay compliant you are responsible for reviewing your CRP and updating your current emissions data at least annually.

Why do public sector suppliers need a CRP?

In June 2021, Cabinet Office published a new Procurement Policy Note (PPN), called PPN 06/21, that required suppliers who bid for public sector contracts valued at £5 million per year and above to submit an updated CRP. 

This means suppliers bidding for public sector contracts valued over that threshold are required to submit a plan at the selection stage of the procurement. It is judged against a set of criteria that determines whether it meets the necessary standard.

Suppliers who do not have a CRP, or submit an outdated plan, will not meet this requirement and therefore will not be able to continue with their bid.

Under the Procurement Act 2023, which governs all procurement activity commencing after 24 February 2025, a new PPN has been published which maintains the same basic requirements, called PPN 006. All procurements undertaken prior to this date will remain subject to PPN 06/21 until the agreement or contract expires.

Guidance has been published by Cabinet Office to assist suppliers with their CRPs under both PPN 06/21 and PPN 006, including the information that you must include and how it should be presented.

5 top tips for suppliers when creating a CRP

1. Check whether you need a CRP

If the contract you are bidding for does not meet the £5 million per year threshold, it will not require a CRP to be submitted. This threshold means plenty of contracts are exempt from CRP requirements.

However, putting a CRP in place, even when not strictly required, could prove a benefit for you. Using less energy and cheaper renewable sources will ultimately save businesses money, and having a CRP ready can also help you more easily move on to new larger-scale opportunities in the long term.

2. Get help calculating your current carbon footprint

A number of private sector organisations offer support and tools for businesses wanting to calculate their carbon footprint, although there are also plenty of free resources available to assist in this process. Some of these services in the private sector are available for free, easing the burden on smaller suppliers. 

A Government-endorsed carbon footprint calculator is available via the UK Business Climate Hub, and can be accessed through our dedicated CRP webpage. 

3. Understand what you need to include

Creating a CRP does not mean every single piece of information relating to carbon net zero or environmental impact you have needs to be included.

CRPs from suppliers bidding for the same contract are not ‘scored’ or compared to each other as part of the procurement process – you simply have to meet the required standard. 

The requirements clearly state the information that is expected as part of these plans and can be found through the Cabinet Office guidance on the respective PPNs.

4. Use the resources available

Suppliers are encouraged to make use of the CRP template that is included in Annex A of PPN 06/21 and Section 7 of PPN 006. This gives a clear framework to help lay out your plans and save you time and resources. 

Cabinet Office has also created a more extensive frequently asked questions (FAQ) page about CRPs that is available on GOV.UK. This page covers a wide range of questions and information for suppliers about the process of creating a plan and its application in the bid process.

5. Sign up for dedicated CRP training

The GCA Sustainability team offers monthly training sessions to help suppliers create a compliant CRP.

These training sessions’ primary objective is to help break down the process of creating a CRP. The sessions look at the critical components required and common mistakes to avoid.

Suppliers and customers can sign up for training sessions or view the sessions on demand.

Find out more

To learn more about our work in the journey towards carbon net zero, visit our dedicated web page. 

To learn more about how GCA is levelling the playing field for suppliers of all sizes, download our digital brochure.

We always welcome feedback, suggestions or queries. These can be submitted to smefeedback@gca.gov.uk.

What buyers need to know about the new National Procurement Policy Statement

The UK Government published a new National Procurement Policy Statement (NPPS) which came into effect on 24 February 2025 alongside the Procurement Act 2023.

This strategic statement lays out the key objectives public sector organisations should look to achieve when they spend public money through procurement.

Contracting authorities must “have regard” to the NPPS when they carry out any procurement activity, with some limited exceptions. 

What does this mean for public sector buyers?

The overarching aim of the statement is to ensure value for money through public sector procurement, supporting the Government’s 5 missions.

The statement lays out 3 key pathways to achieving this value for money that contracting authorities should consider:

  • driving economic growth
  • delivering social and economic value
  • building commercial capability

The full NPPS contains further detail on each of these 3 pathways, as well as key deliverables to help contracting authorities understand how to contribute to each.

The Procurement Act 2023 says contracting authorities should be able to show that the goals of the NPPS were considered as part of any given procurement. It is therefore recommended for buyers to document their decision-making processes in relation to the NPPS.

What action do you need to take now?

Everyone involved in the procurement process across the UK public sector has a role to play in delivering the strategic aims set out by the Government. 

The NPPS should be read and its aims understood not just by procurement teams, but by the strategic leadership and key decision-makers in contracting authorities. It should then be considered every time you, as a buyer, carry out a procurement using public money, and your activity aligned to these aims where practical.

This means aiming, in your procurement decisions, to achieve value for money by using public money efficiently, promoting social value, and building your own commercial capability. 

As a buyer, you should assess your own processes and procurement priorities, ensuring they are compatible with the key aims of the NPPS and identify opportunities to contribute to them, as well as any potential roadblocks. 

This could include:

  • creating action plans for increasing your work with SME and VCSE suppliers 
  • considering any upskilling opportunities needed to improve commercial capability 
  • assessing your modern slavery and carbon net zero policies to make sure they are fit for purpose 

Supporting these aims over the longer term will keep you in step with other contracting authorities as they adapt to meet the new aims.

Finally, the aims should be applied proportionately to the procurement in question. This means you need to keep your procurement goals realistic for the contract size. 

Meeting NPPS requirements does not mean that you need to create extra savings or add social value measures that are not relevant and proportionate to the contract. 

Find out more

You can read the National Procurement Policy Statement along with accompanying guidance on GOV.UK.

You can also now find all of our Procurement Essentials articles in one place on our website. 

Call for evaluators for our new Courier, Distribution, Storage and Specialist Solutions agreement

We are looking for a group of volunteers from public sector organisations to help with the evaluation of our new Courier, Distribution, Storage and Specialist Solutions agreement (RM6354).

This new agreement will replace 2 existing CCS agreements: Courier and Specialist Movements (RM6171) and Storage, Distribution, Kitting and Associated Services (RM6282).

Evaluators are an important part of the procurement process. In addition to playing an important role within CCS, becoming an evaluator counts towards your corporate contribution and is encouraged in departments across the Civil Service.

Evaluation of this procurement will consist of an independent evaluation followed by consensus meetings.

The current timescales for procurement are as follows:

  • publication of find a tender notice (FTS): July 2025
  • evaluation period: September 2025
  • consensus: October 2025
  • award: January 2026

Volunteers will be required to attend a short training call before taking on the role of evaluator (maximum 2 hours) and will be provided with the necessary tools and information.

Evaluators will need to have commercial experience, experience in a specialism covered under the lots on the agreement, such as courier, logistics and warehousing and/or knowledge of these markets. 

If you are interested in getting involved, please register your interest by emailing  info@crowncommercial.gov.uk and quoting RM6354 in the subject line.

New green energy agreement launched, offering price stability for sustainable power across UK public sector

A new commercial agreement from Crown Commercial Service (CCS), entitled the Provision of Power Purchase Agreement (PPA), gives central government and wider public sector organisations direct access to UK-based renewable energy and competitive long-term contracts with suppliers.

Procured under PCR 2015, the innovative agreement offers a unique combination of renewable energy sourcing, long-term fixed pricing, and UK-based supply security that has never been available at this scale. This is a significant step forward in supporting public sector organisations to meet their net-zero targets while providing wider access to the market and greater budget certainty. 

The agreement went live on 15 April 2025 and will be in place for 4 years.

What are Power Purchase Agreements?

Corporate PPAs are long-term power contracts between customers and suppliers that allow for the purchase of agreed volumes of green energy directly from renewable generators for a fixed period. Renewable generation may come from various sources, such as onshore and offshore wind turbines and solar PV farms.

John Welch, Commercial Director – Estates at Crown Commercial Service, explains:

This new agreement represents an important step forward in our commitment to supporting public sector organisations in meeting their sustainability goals while securing predictable energy costs. By enabling access to a UK-based renewable energy supply through long-term contracts, we’re helping the public sector reduce its environmental impact and contribute to the government’s net-zero ambitions.

Sustainable energy solutions with predictable, long-term pricing

Market intelligence gathered has shown the need for CCS customers to have access to greener energy with a clear, concise route to market. This new agreement gives CCS customers and the wider public sector direct access to green electricity with price certainty, protecting them from market volatility while accelerating progress towards net zero targets. 

The agreement creates significant value for the nation, providing energy security, economic efficiency, market innovation, and carbon reduction. 

For example, by focusing on UK-based renewable assets, this agreement strengthens national energy independence, reducing our reliance on imported energy. The agreement will also support the government’s mission to make Britain a clean energy superpower. Encouraging innovation in the renewable energy sector advances the UK’s commitment to reach net zero by 2050.  

As a result, customers using the new agreement will benefit from:

  • access to UK-based renewable energy assets
  • competitive rates 
  • fixed-term pricing options, allowing for more efficient budgeting and future cost estimation
  • a simplified procurement process that provides access to call-off contract terms aligned with the PPA market
  • support toward net zero targets

Find out more

To learn more about the new Provision of Power Purchase Agreement framework, please visit the agreement page or contact the Service Desk at info@gca.gov.uk or 0345 410 2222.

Changes to our agreements in March

Welcome to our monthly framework update to help you with your procurement planning. We will publish it online each month and also share it in our newsletters and on our social media channels.

The update provides a brief summary of what has been awarded, extended or expired during the previous month. It also outlines what is due to expire in the next 3 months.

You can also get an overview of all of our live frameworks in our interactive digital brochure.

Agreements awarded in March

No agreements were awarded in March.

Agreements extended in March

No agreements were extended in March.

Agreements that expired in March

Agreements due to expire in the next 3 months

Further information

If you need further details about any of these agreements get in touch.

You can also find out what new procurements we are working on by exploring our upcoming agreement page.

If you don’t currently receive our monthly customer newsletter why not also subscribe to receive these updates and more directly to your inbox? fill in this short form.