IT resellers and VARs increasingly need Cyber Essentials before an enterprise or public sector buyer will even open a tender. This guide covers what the certification actually requires, which variant fits a reseller model, and where the applications trip up.
Why this matters
Buyers stopped taking a reseller's word for it. Procurement teams now ask for a certificate number before they sign, not a promise.
For resellers selling into G-Cloud government contracts, Cyber Essentials Plus is often a hard requirement, not a nice-to-have. Miss it and you're out of the tender before pricing gets discussed.
The scheme itself hasn't changed much since it launched, but the buyers asking for it have multiplied. In 2026, more mid-market IT buyers list Cyber Essentials as a shortlist filter than at any point since the scheme started.
Who this is for
This guide is for IT resellers, VARs, and channel partners who sell hardware, software licences, or managed services to UK businesses and need to prove baseline security before a contract gets signed. It's also relevant if you resell into the public sector and need Cyber Essentials Plus to stay on a framework.
If you're running your own MSP arm on top of reselling, the scope questions below matter even more — you're certifying your own business, not your clients'.
What to look for in Cyber Essentials for IT resellers and VARs
Scope that matches how you actually operate
Resellers run lean. Remote staff, cloud-hosted email, a handful of laptops and maybe a warehouse system. Get the scope wrong and you either over-certify unrelated systems or leave a gap an assessor flags on the next renewal.
Define your scope around the devices and cloud services that touch client data and quotes, not every system in the building.
Certification body speed and cost
Not every IASME-licensed certification body runs the same turnaround. Some clear a Basic self-assessment in days; others queue applications for weeks during renewal season.
If you're chasing a tender deadline, the certification bodies compared breakdown matters more than the badge itself.
Basic vs Plus — read the actual contract clause
Most commercial clients accept Cyber Essentials Basic. Public sector and G-Cloud buyers usually specify Plus, which adds an external vulnerability scan and device-level verification.
Don't guess. Pull the actual RFP or framework wording — it usually names the variant explicitly.
Patch and vulnerability management you can prove
Cyber Essentials checks that you're applying critical and high-severity patches within 14 days. Resellers running a fleet of client devices or their own infrastructure need a process, not a memory.
MSPs juggling patch cycles across multiple client environments hit this control hardest — see patch management for MSPs if that's your setup.
Renewal cadence that doesn't ambush you
Cyber Essentials expires 12 months after certification, no grace period. Resellers that treat it as a one-off project lose the badge mid-contract and scramble to recertify while a client is watching.
Build renewal into your calendar the day you get certified, not the month before it lapses.
Automate your Cyber Essentials evidence
OneClickComply handles evidence collection and renewal tracking end-to-end.
Top picks for resellers and VARs
Cyber Essentials (Basic) — the fast entry ticket. Self-assessed questionnaire, verified by a certification body, renews every 12 months. Most commercial IT contracts in 2026 accept this as sufficient proof of baseline security. Verdict: Buy if your clients are SMEs and mid-market commercial accounts.
Cyber Essentials Plus — the one government contracts actually check. Adds an external vulnerability scan and hands-on technical verification of your devices, not just a questionnaire. This is the variant named in most G-Cloud and public sector framework terms. Verdict: Buy if you sell into public sector or government contracts at all.
IASME Cyber Assurance — the wildcard for broader governance asks. Covers the same technical ground as Cyber Essentials plus wider governance and data protection practices. Some enterprise buyers ask for this when Cyber Essentials alone doesn't satisfy their vendor risk checklist. Verdict: Consider if a client's security questionnaire goes beyond the five Cyber Essentials controls.
SOC 2 — the overkill pick for most resellers. Built for SaaS vendors handling customer data at scale, with a multi-month audit period and ongoing evidence trail. A pure hardware or licence reseller rarely needs this. Verdict: Skip unless you're also running a hosted software product for US clients.
What to avoid
- Certifying the wrong entity. If you operate as a group with multiple trading names, make sure the certificate matches the legal entity named on the contract, not a parent company.
- Treating Plus as optional when the tender says otherwise. Some resellers submit Basic and hope it passes procurement review. It usually doesn't.
- Letting renewal lapse mid-contract. A lapsed certificate mid-engagement can trigger a contract review clause. Track renewal dates the same way you track contract end dates — see how to renew Cyber Essentials each year for the cadence.
Verdict comparison
| Scheme | Assessment type | Renewal | Best for | Verdict |
|---|---|---|---|---|
| Cyber Essentials (Basic) | Self-assessed questionnaire | 12 months | Commercial resellers, SME clients | Buy |
| Cyber Essentials Plus | External scan + verification | 12 months | G-Cloud and public sector resellers | Buy |
| IASME Cyber Assurance | Extended self-assessment | 12 months | Broader governance asks | Consider |
| SOC 2 | Multi-month independent audit | Annual | Hosted SaaS with US clients | Skip |
Frequently asked questions
One last thing
The control that trips up more reseller applications than any other isn't the technical scan — it's scope definition. Resellers who list every laptop in the building instead of only the ones touching client data end up failing controls that were never relevant to the certificate in the first place. Scope it tight, scope it accurate, and the rest of the Cyber Essentials application moves fast.