CYBER ESSENTIALS FOR
GOVERNMENT & DEFENCE
In the UK's government and defence sectors, security is more than a compliance exercise — it protects national operations, sensitive data, and critical infrastructure. Whether you are a local authority, central government body, or MOD supplier, cyber threats are persistent and increasingly sophisticated. We simplify the journey to Cyber Essentials with clear, practical guidance aligned to Def Stan 05-138 (the standard underpinning DCC) and wider public-sector assurance frameworks.
WHY CYBER ESSENTIALS MATTERS FOR YOUR SECTOR
MOD SUPPLY CHAIN COMPLIANCE
Cyber Essentials is a prerequisite for MOD contracts and a foundation for DCC Level 0. We are an IASME Approved Certification Body authorised to deliver both, keeping you tender-ready for DCC Level 0, which is assessed against Def Stan 05-138.
DEFCON 658 & CSM v4 ALIGNED
Our assessment process is aligned to the MOD Cyber Security Model v4. We understand the defence procurement landscape and guide you through requirements clearly — no unnecessary complexity.
PROTECT SENSITIVE INFORMATION
Government and defence organisations handle classified, sensitive, and personal data. Cyber Essentials provides the baseline technical controls required to protect this information and demonstrate compliance.
MEET PROCUREMENT REQUIREMENTS
Under PPN 014, Cyber Essentials is mandatory for in-scope central government contracts. CE Plus is required for contracts over £5m, involving personal data, or supporting critical services. We advise on the right tier for your specific contract.
LOCAL AUTHORITY & PUBLIC SECTOR
Local councils, NHS bodies, and public sector organisations face increasing cyber threats. Cyber Essentials provides a clear, achievable baseline that meets procurement and regulatory requirements.
WORKS TO YOUR DEADLINE
Government procurement deadlines are fixed. We work backwards from your tender date to ensure certification is in place in time — contact us as early as possible for urgent requirements.
WHAT CYBER ESSENTIALS COVERS
Developed by the National Cyber Security Centre (NCSC), Cyber Essentials is the UK Government's baseline cyber security standard — widely mandated across public sector procurement and a strict requirement for MOD suppliers. Certification is built around five critical technical controls, independently verified by an approved assessor.
Control 1
FIREWALLS
Boundary firewalls and internet gateways that establish a secure perimeter between your internal networks and the internet, blocking unauthorised access.
Control 2
SECURE CONFIGURATION
Ensure all devices and software are configured securely — removing default credentials, unnecessary services, and features that create exploitable attack surface.
Control 3
USER ACCESS CONTROL
Limit administrative privileges so only authorised personnel can access sensitive systems and data — reducing the blast radius of any compromised account.
Control 4
MALWARE PROTECTION
Endpoint protection and antivirus software to detect and block malicious software before it can compromise government or defence data.
Control 5
PATCH MANAGEMENT
Keep all software, operating systems, and firmware up to date. Unpatched systems are the most common entry point for threat actors targeting government supply chains.
Tier 1
CYBER ESSENTIALS
A verified self-assessment questionnaire signed off by a senior responsible officer and reviewed by an approved external assessor. Your systems are checked against the five baseline controls. Mandatory under PPN 014 for lower-risk government contracts. CE Plus is required for contracts involving personal/sensitive data or over £5m.
- ✓Self-assessment questionnaire
- ✓Senior officer sign-off
- ✓External assessor verification
- ✓Mandatory prerequisite for DCC Level 0
Tier 2
CYBER ESSENTIALS PLUS
Builds on the self-assessment with an independent hands-on technical audit. An approved assessor actively tests your devices and conducts external vulnerability scans of your IT infrastructure to verify the five controls are correctly implemented in practice — not just documented.
- ✓Everything in Cyber Essentials
- ✓Independent technical audit
- ✓External vulnerability scanning
- ✓Required for higher-value MOD & enterprise contracts
HOW WE WORK WITH YOU
We guide you through every step of the Cyber Essentials process — from initial scoping through to your certificate. Our approach is built around your sector's specific requirements, working around your operational constraints.
What's Included
- Initial scoping call to understand your environment
- Guided submission support against Cyber Essentials requirements
- Guidance on addressing any gaps identified
- Support through the self-assessment questionnaire
- IASME assessor review and certification
- Certificate, digital badge, and NCSC register listing
COMMON QUESTIONS
READY TO MEET YOUR GOVERNMENT PROCUREMENT REQUIREMENTS?
Talk to our UK-based team. We understand the government and defence procurement landscape and will guide you through clearly.