Tender documents have a habit of arriving at awkward moments. A Friday, usually. Question 14 asks for a Cyber Essentials certificate, the deadline is three weeks away, and the business has nothing to show. Plenty of small firms have landed in exactly that spot, and the sensible ones now buy Cyber Essentials while nothing is on fire. The scheme is government-backed and was developed with the National Cyber Security Centre. Buyers read the certificate as shorthand for “this supplier has done the basics.”
Why buyers keep asking for it
Procurement staff read piles of supplier responses every week. They cannot audit each company, and nobody expects them to. A certificate does that job on their behalf, in a single line, which is why it gets a tick and a quick move to the next bid. Without it, a response can be marked down or set aside before anyone reaches the sections you spent days polishing.
Anyone can write that their firm takes security seriously. That costs nothing. A certificate has been checked by an independent body, and the difference between a claim and a checked claim is the whole reason buyers like the scheme.
Liability plays a part too. When a supplier’s laptop turns out to be the way into a customer’s network, the customer is the one explaining it to clients and regulators. Hence the requirement keeps travelling down supply chains, from large organisations to the small firms that serve them.
What actually gets checked
Five areas. Firewalls, secure settings, user access, malware protection and security updates. None of it is exotic. A firewall filters traffic, secure settings mean default passwords get changed and unused features get switched off, and access control stops the receptionist from being an administrator by accident. Malware protection catches hostile files. Updates close holes that attackers already know about.
A certificate with an expiry date
It lasts twelve months, then the whole exercise repeats. Some owners grumble about that. Offices drift, though. New starters arrive, an old laptop sits in a cupboard still logged in, and somebody signs up for a file-sharing tool on a personal card. A yearly check pulls those loose ends together before they matter.
Waiting costs more than it looks
Nobody phones to say a bid lost points over a missing certificate. The score comes back a bit lower, or the invitation never turns up. That silence hides the cost, and it makes the problem easy to put off for another quarter.
There is a practical side as well. Assessments take time, particularly when a few settings need fixing first, and rushing them leads to mistakes in the answers. A few weeks of notice turns a fire drill into an ordinary task.
Set it against an incident
Government surveys of UK businesses regularly show a large share of firms reporting some kind of attack or breach in the past year, with phishing emails near the top of the list. Even a minor incident can mean days of lost work, awkward calls to clients and a bill from a specialist. Certification will not make a business immune. It does cover the habits that block everyday attacks. Eligible organisations also get cyber insurance bundled with the scheme, subject to its terms, so those are worth reading.
Is now the right time?
Probably, if any of these apply: a client has asked for the certificate, public sector bids are on the horizon, staff have started working from home on their own devices, or a competitor has put the badge on its website. One reason is enough. The “perfect moment” to buy cyber essentials rarely comes, and the one that does arrive is usually a deadline.
Choosing who to buy from
Plenty of companies sell certification, and they differ most when something goes wrong. A good one explains the questions in plain language, helps with the scope and picks up the phone. A shared printer or a managed tablet can be surprisingly hard to describe on the form, and a short call saves an hour of guessing. Check that the provider is licensed as a certification body or works with one. Ask what happens if the first submission needs changes.
Objections that come up every time
“We are too small to be a target.” Attackers do not browse by company size. They send the same phishing email to thousands of addresses and see who clicks. A two-person bookkeeping practice holds client bank details and tax records, which makes it more interesting than it thinks.
“We already have antivirus.” Good, and that covers one of the five areas. The other four are about how devices are set up, who can do what and whether patches get installed.
“It is only paperwork.” Partly true. The questionnaire is paperwork, but answering it honestly forces a handful of fixes that would otherwise sit on a to-do list for years. Most owners find at least one surprise, such as an ex-employee’s account that never got closed.
“It will cost too much.” Fees are modest compared with one lost contract, and far smaller than the clean-up after a successful attack. Ask for a clear quote and compare what is included.
Putting the badge to work
A certificate sitting in a drawer earns nothing. Mention it in the opening summary of every tender, add the logo to the website footer, and give the sales team a one-sentence explanation of what it covers. When two bids are close on price, visible evidence of tidy security habits can settle the argument.
Start with a list
Write down every device, every cloud account and every person with administrator rights. That single page does most of the preparation. Then buy cyber essentials and work through the assessment with someone on hand to answer questions. The next tender will arrive eventually. Better to have the certificate waiting.