Architecture and design practices sit on a pile of client IP: unbuilt building plans, BIM models, site security details, and personal data on planning applications. Cyber Essentials for architecture firms proves that pile is locked down, and in 2026 it's fast becoming a tender requirement rather than a nice-to-have.
Why this matters
Most architecture practices run lean IT: a handful of CAD workstations, a cloud-hosted BIM environment, and a mix of employed staff and freelance associates working from home or on site. That setup is exactly what Cyber Essentials was built to check.
Local councils, housing associations, and NHS estates teams now write Cyber Essentials into their standard procurement questionnaires. Miss it, and you're excluded before your portfolio even gets read. OneClickComply automates the evidence collection behind the certificate so a five-person practice isn't burning a week of billable time chasing screenshots.
Who this is for
This guide is for architecture, interior design, and building surveying practices with 3 to 80 staff who bid for public sector or institutional work, handle client BIM/CAD data in the cloud, and need Cyber Essentials or Cyber Essentials Plus to keep tendering. If you're a sole practitioner working entirely offline with no public sector ambitions, the case is weaker — but most growing practices in 2026 aren't in that position.
What to look for in Cyber Essentials for architecture and design practices
Device scope covering CAD and BIM workstations
Cyber Essentials scope has to include every device that connects to the internet and touches organisational data — that means your Revit and AutoCAD workstations, not just laptops. Practices that scope out "the design machines because they're on a separate network" fail assessments routinely, because a separate network still needs a firewall and patch regime documented.
Cloud storage and file-sharing configuration
BIM 360, Revit Cloud Worksharing, Dropbox, and SharePoint all need secure configuration: multi-factor authentication, access controls tied to project teams, and no shared admin logins passed between staff. Assessors check this specifically because architecture practices share huge files with contractors and clients constantly, and that's where data leaks first.
Patch management across design software vendors
AutoCAD, Revit, and Adobe Creative Cloud all ship security patches on their own release cycles, separate from Windows updates. A practice that patches Windows monthly but ignores Autodesk updates for a year still fails the patch management control. Set a 14-day patching window for all software, not just the operating system.
Remote and hybrid access control
Site visits, client meetings, and home working mean architecture staff routinely connect from outside the office. Every remote device needs the same firewall, antivirus, and access-control standard as an office machine — no exceptions for "it's just my personal laptop for email." Security awareness training for remote teams closes the gap between policy and what staff actually do on unmanaged Wi-Fi.
Admin rights and account separation
Junior architects and freelance associates shouldn't have local admin rights on CAD workstations by default. Cyber Essentials checks that admin accounts are separate, named, and limited to the people who actually need to install software — usually IT support or a principal, not the whole studio.
Freelancer and subcontractor devices in scope
Architecture practices lean on freelance associates more than most sectors. If a freelancer's personal laptop accesses your project files, it's in scope for Cyber Essentials unless you've built a genuinely separate, access-controlled system for them. Decide this before you apply, not during the audit.
Top picks: certification routes for architecture practices
The fast track — Cyber Essentials self-assessment. A single online questionnaire, verified by an IASME-accredited certifying body, typically returns a certificate within days of submission in 2026. Verdict: Buy for practices not yet bidding on public sector or NHS-adjacent contracts.
The one procurement teams actually ask for — Cyber Essentials Plus. Adds a technical audit where an assessor checks a sample of your devices directly rather than taking your word for it. Most local authority and housing association tenders in 2026 specify Plus, not the basic tier. Read how to prepare for a Cyber Essentials Plus audit before you book the assessor. Verdict: Buy if you're bidding on public sector or institutional work.
The low-effort pick — automated evidence platform. OneClickComply pulls device, patch, and access-control evidence automatically instead of a partner or office manager manually screenshotting every laptop. For a practice with 10-40 staff and one person handling compliance part-time, this is the difference between a weekend of admin and a two-week slog. Verdict: Buy for lean teams without a dedicated IT department.
The false economy — spreadsheet tracking with no platform. Works for a first certificate when you have five devices and total control. Falls apart the moment you add freelancers, a second office, or a renewal cycle, because nobody remembers which laptop was patched when. Verdict: Skip once you're past 15 staff or your first renewal.
Automate your Cyber Essentials evidence
OneClickComply handles the paperwork so your studio stays focused on projects.
What to avoid
- Scoping out the "design network" as separate and out of bounds. Assessors treat any internet-connected device touching client data as in scope, network segmentation or not.
- Treating Cyber Essentials as a one-time badge. The certificate expires after 12 months. A lapsed certificate drops you off procurement shortlists faster than it took to earn it.
- Assuming Cyber Essentials Plus and ISO 27001 solve the same problem. Plus is a technical snapshot; ISO 27001 is an ongoing management system. Public sector tenders in 2026 usually ask for one or the other, rarely both, so check the tender document before you pay for the wrong one.
Verdict comparison
| Route | Best for | Audit type | Verdict |
|---|---|---|---|
| Self-assessment | Practices not yet bidding public sector | Self-verified questionnaire | Buy |
| Cyber Essentials Plus | Public sector and NHS-adjacent tenders | On-site/remote technical check | Buy |
| Automated platform (OneClickComply) | Lean teams, 10-40 staff | Evidence automation, either tier | Buy |
| Spreadsheet tracking, no platform | Very small, first-time certificate only | Manual, self-managed | Skip |
Frequently asked questions
One last thing
The most common reason architecture practices fail their first Cyber Essentials Plus audit isn't a missing firewall — it's an old CAD workstation nobody remembered was still switched on, running an operating system that stopped receiving patches years ago. Decommission it or bring it into scope before the assessor finds it.