Cyber Essentials and Central Belt Tenders: What Buyers Now Expect

If you bid for work with councils, the NHS, universities or larger private sector buyers across the central belt, you have probably watched Cyber Essentials move from a nice-to-have on the scoring matrix to a straight pass or fail question.

The good news is that it is one of the more achievable certifications. The bad news is that firms routinely fail it on things they could have fixed in an afternoon.

What Cyber Essentials actually covers

It is a UK government backed scheme built around five technical controls:

• Firewalls protecting your internet connection
• Secure configuration of devices and software, meaning default passwords gone and unused features switched off
• User access control so people only have the access their job needs, with admin rights tightly limited
• Malware protection on every device
• Security update management, keeping operating systems and applications patched within defined timescales

Cyber Essentials Plus covers the same ground but adds a hands-on technical audit by an assessor rather than relying on your self-assessment.

Why buyers keep asking for it

Supply chain attacks are the reason. A buyer can spend heavily on its own defences and still be compromised through a supplier with an unpatched server. Asking every supplier for Cyber Essentials is the cheapest way to raise the floor across the whole chain.

Increasingly, cyber insurers want to see it too, and premiums often reflect that.

Where firms usually fail

• Unsupported software. Anything past its end-of-life date, including old Windows versions and out-of-date phones, is an automatic fail.
• Missing patches. High and critical severity updates need applying within 14 days. Left to individuals, this never happens consistently.
• Everyday admin accounts. Staff doing daily work on accounts with administrator rights fails the access control requirement.
• Forgotten devices. Personal phones and tablets that touch company email are in scope, and firms often overlook them.
• No MFA on cloud services. Multi-factor authentication is required on cloud accounts, and this catches out businesses relying on passwords alone.

What it costs and how long it takes

The certification fee itself is modest and scales with organisation size. The real cost is the remediation work needed to meet the controls, and that varies enormously depending on how well maintained your estate already is.

A well-run business can be ready in a couple of weeks. A neglected one can take a couple of months, mostly spent replacing kit that should have been retired years ago.

Certification lasts twelve months, so it becomes an annual rhythm rather than a one-off.

Treat it as a floor, not a finish line

Cyber Essentials is a baseline. It will not stop a determined attacker on its own. What it does is close the open doors that the overwhelming majority of attacks walk through, and it gives you something concrete to show a buyer.

The Orange Penguin take

We get Scottish businesses certified and, more importantly, keep them there. Patching, access control, malware protection and device management run continuously on our managed plans, which means the annual renewal is a formality rather than a fire drill.

If a tender has landed on your desk with Cyber Essentials on it, book a free IT health check and we will tell you honestly how far off you are. Our deeper guide on Cyber Essentials costs in Scotland has more detail, and you can see local coverage for Glasgow, Edinburgh and Stirling.