A customer asks for Cyber Essentials Plus. Your business already holds Cyber Essentials, and the renewal date is in the diary.
Before answering the bid, establish whether that meets the actual requirement. The level, scope, legal entity, expiry and evidence deadline all matter. So does the work IT may need to complete before an assessment.
Getting those details straight early helps avoid an unsupported assurance answer, a rush purchase or a certification delay that complicates the start of the work.
Start with this customer's requirement
There is no single certification rule for every construction contract or every highly regulated customer. Read the tender, framework conditions and relevant terms. Ask procurement for clarification where the wording is unclear.
For certain public contracts, Cabinet Office policy requires Cyber Essentials or Plus, or equivalent controls. The requirement depends on the contract and the organisations in scope. It is not a blanket instruction that every contractor must obtain Plus or ISO 27001. Cabinet Office PPN 014.
Use a small requirement register with the bid owner, IT and whoever maintains certification.
| Detail | Question to resolve |
|---|---|
| Required assurance | Essentials, Plus, ISO 27001, another requirement, or an accepted equivalent? |
| Scope | Which organisation, activities and systems must it cover? |
| Evidence date | At bid, before award, before data is shared, or another specified stage? |
| Validity | Will the certificate remain current at the relevant stage and throughout any required period? |
| Gap | What additional controls, assessment or evidence are needed? |
| Owner and cost | Who confirms the answer and plans any work and budget? |
Certification can support eligibility and customer confidence. It does not guarantee an award, and a provider should not promise that it will open a particular contract without checking the terms.
Essentials and Plus are not interchangeable
Cyber Essentials is a verified self-assessment. Plus adds an independent technical assessment of the same control areas. Neither guarantees that a business cannot suffer an incident.
The Plus assessment includes checks against a representative sample of relevant systems. It should not be presented as testing every device, business process or possible attack. Confirm the current scope and evidence requirements with the certification body. IASME assessment guidance.
ISO 27001 concerns an information security management system within its defined scope. Holding it does not automatically satisfy Cyber Essentials, nor does Plus replace ISO 27001 where that is required. Check the actual scope and the customer's acceptance criteria.
A phone can work and still need replacing
A phone that still runs the project app may be reaching the end of supported software. A laptop may still do the work while needing an operating-system change.
That is a budgeting issue as well as a technical one. Discovering it shortly before assessment can leave little time to replace equipment, move users and confirm the setup.
Ask IT to review the device and software inventory against support dates and current requirements. The NCSC publishes the applicable requirements and effective dates. Do not carry last year's assumptions into a new assessment. NCSC technical requirements.
A planning record might include the device type, operating system, support date, owner, proposed action, estimated cost and decision date. Use your real estate and supplier information. No universal replacement age or standard cost applies to every business.
Managed devices support controls; EMM is not the certificate
Device and application management can help IT maintain an agreed setup, control work access and check relevant device status, depending on the platform, licences and configuration.
The requirement is to meet the applicable controls. Buying an EMM product does not establish compliance, and the scheme does not universally prescribe a product called EMM.
It is reasonable to discuss managed phones, Microsoft controls, patching and supported devices when the review identifies a gap. A mobile contract alone does not resolve certification.
Make the renewal a planned review
Record the assessment date, scope and evidence requirements. Work back to the decisions on remediation, replacements and testing. Confirm who maintains the information as people, projects and software change.
If your controls and certificate are already current, this review can be brief. Confirm what remains true and what the customer actually needs, rather than repeat work for its own sake.
Need to identify which control areas deserve attention? Assured Digital's Cyber Health Check offers a broader self-review. It does not inspect your systems or replace a certification assessment. A subsequent discussion should start with your requirement, timeframe and current setup.
