Quarterly BAS Due (July–September)
Form 1099-NEC & Contractor Payment Reporting Check
Why this matters.
Under Procurement Policy Note 014 (PPN 014), Cyber Essentials certification is now a mandatory requirement for suppliers bidding on certain UK public sector contracts commenced from 24 February 2025, and buying organisations must confirm suppliers meet the technical controls before contracts are awarded. From April 2026, the certification itself was updated to expect a more holistic approach to digital risk management — covering technical controls, organisational processes and ongoing monitoring — rather than a one-off checklist exercise, and the Ministry of Defence has separately asked industry partners to achieve Cyber Essentials as part of its Defence Cyber Certification (DCC) Level 0 requirement by 31 December 2026. Even outside direct government work, larger private-sector customers are increasingly pushing Cyber Essentials down their supply chains through procurement questionnaires and contract terms, and some cyber insurers now expect it as a condition of cover.
For small and mid-sized businesses that supply goods, services or IT to public bodies, larger companies, or the MOD, not holding — or not being ready for — Cyber Essentials certification can mean losing out on contracts or facing last-minute scrambles ahead of tender deadlines. The scheme itself is built around five technical controls: firewalls, secure configuration, user access control, malware protection and patch management. Businesses that understand which controls they already meet, which need work, and whether Cyber Essentials or the more rigorous Cyber Essentials Plus is likely to be required, are far better placed to certify quickly when a contract or client demands it — rather than losing the deal while catching up.
