Defence suppliers’ Cyber Essentials Plus certification is independent technical verification of baseline cyber security controls, with the aim of demonstrating those controls to buyers. This 2026 guide explains how to check your contract, define the right scope and prepare for assessment without confusing certification with wider defence assurance.
Why Cyber Essentials Plus matters for defence suppliers
Your contract determines what you must demonstrate. Do not assume every Ministry of Defence contract requires Cyber Essentials Plus, or that a certificate satisfies every security clause.
A direct supplier and a subcontractor need to check the requirements passed down by their respective buyers. Read the tender, contract schedules and supplier security questions together; a request for a certificate is not the same as a complete statement of your obligations.
Cyber Essentials Plus adds independent technical testing to the Cyber Essentials assessment. It checks the scheme’s baseline technical controls, not every aspect of your organisation’s security or the suitability of your systems for classified information.
For your 2026 submission, keep these distinctions clear:
- Cyber Essentials and Cyber Essentials Plus are different assessment levels.
- Contract-specific defence requirements remain separate obligations.
- The certificate’s scope must match what you tell the buyer it covers.
- Certification does not itself grant permission to handle classified material.
Use the Cyber Essentials Plus audit preparation guide alongside the contract checks below. Technical readiness and contractual acceptance need separate owners.
Prepare for Cyber Essentials Plus in six steps
Start with a shared document and an asset inventory. Record the buyer’s requirement, the systems involved, the control gaps and the person responsible for each action before choosing software or external support.
The sequence is straightforward: check the contract, define the scope, fix the controls, prepare the evidence, complete the assessment and maintain the controls. Do not book around a hoped-for pass date before you understand the work.
Agree the contract requirement and scope before starting technical remediation.
Check the contract
Find the exact certification wording first. Record whether the buyer asks for Cyber Essentials, Cyber Essentials Plus or additional assurance, and identify when the evidence must be supplied.
Separate a tender submission requirement from a condition that applies before work starts. Ask the buyer to clarify ambiguous wording in writing rather than relying on a sales conversation or another supplier’s experience.
For defence work, also identify any applicable supplier assurance process and security obligations passed down by a prime contractor. A certificate does not automatically answer a separate supplier questionnaire or close a contract-specific action.
Create a requirement register that your commercial and technical teams both approve. Keep the source clause beside each action so nobody has to reconstruct the decision later.
- Copy the certification requirement exactly.
- Record the contracting legal entity.
- Identify the submission or contract milestone.
- List separate security questionnaires and evidence requests.
- Assign an owner to unresolved buyer questions.
Define the scope
Map the environment before asking an assessor to test it. Use your existing device records, cloud administration consoles and network information to build a first inventory manually.
Trace how staff access contract information, including remote workers and external IT administrators. A defence project’s data does not stay inside a folder simply because that folder has the project’s name.
Discuss proposed boundaries and exclusions with your certification body. Do not remove an inconvenient device from the spreadsheet and treat that as a valid exclusion; the boundary needs a defensible technical basis.
If your organisation includes engineering or production systems, identify their connections to the business environment. Ask the assessor how those connections affect scope rather than assuming all operational equipment is either included or exempt.
- List offices, remote users and relevant networks.
- Identify cloud services and access methods.
- Record devices, operating systems and installed software.
- Map third-party administration responsibilities.
- Document proposed exclusions and their justification.
Fix the controls
Check the environment against the NCSC’s Cyber Essentials requirements and the IASME assessment materials applicable to your assessment. For 2026 planning, confirm the version with your certification body rather than reusing an old questionnaire.
Cyber Essentials covers 5 technical control areas: firewalls, secure configuration, security update management, user access control and malware protection. Review actual settings, not just written policies.
Start manually with administrator exports, configuration checks and a tracked action list. Then automate repeatable work where the platform supports your environment.
OneClickComply is best for growing suppliers that want compliance automation for security controls, policies and risk management. OneClickComply automates security control remediation, generates policies and manages risk; independent Cyber Essentials Plus assessment remains a separate requirement.
- Review firewall rules and remove unnecessary exposure.
- Remove unused accounts, software and default settings.
- Separate everyday access from administrator privileges.
- Apply required security updates and verify installation.
- Check malware protection and applicable authentication requirements.
Prepare the evidence
Make every answer traceable to the environment being assessed. A policy describes what should happen; a configuration record or test result helps demonstrate what actually happens.
Build the evidence pack manually in an access-controlled location first. Name files consistently and record the system, collection date and owner so the assessor can understand what each item represents.
Use only the information needed for assessment. Defence contract material, credentials and unrelated personal information do not belong in a general evidence folder merely because collecting everything feels safer.
Ask the certification body how it wants sensitive evidence shared. Your contract’s handling restrictions still apply during preparation and testing.
- Keep the agreed scope and asset inventory together.
- Match questionnaire answers to supporting records.
- Record who checked each control and when.
- Remove secrets and unrelated sensitive content.
- Confirm the evidence transfer method with the assessor.
Complete the assessment
Complete the Cyber Essentials assessment and arrange the additional independent technical testing required for Plus. Confirm the permitted timing between those stages with your certification body before committing to a buyer’s deadline.
Ask the assessor to explain test activities, access requirements and how findings will be reported. Coordinate with your IT provider and relevant system owners so approved testing is not blocked by an unexpected access restriction.
Cyber Essentials Plus is not a substitute for a broader penetration test. Its purpose is to verify the scheme’s controls; a separate application, infrastructure or contractual testing requirement needs its own scope.
If the assessor identifies a failure, fix the cause across the affected environment. Correcting only the sampled device leaves the underlying control problem unresolved.
- Agree authorised test targets and contacts.
- Confirm access and scheduling requirements.
- Make relevant technical owners available.
- Track findings through remediation and verification.
- Check the issued certificate’s entity and scope details.
Maintain the controls
Keep the certified environment under control after the assessment. A certificate does not update itself when you add a cloud service, replace laptops or give a subcontractor administrative access.
Cyber Essentials certificates are valid for 12 months. Record the expiry date and plan renewal around the buyer’s requirement for continuing certification, not just your preferred internal schedule.
Security update management also needs an ongoing process. The scheme requires applicable high-risk or critical security updates within 14 days of release; use the current requirements to determine which updates fall within that rule.
Treat your 2026 certificate as a dated assurance record, not permanent approval. Review changes with your certification body when they affect the assessed boundary or the accuracy of your answers.
- Assign ownership of certificate renewal.
- Review new devices and cloud services before use.
- Track required updates through installation checks.
- Remove access when staff or suppliers leave.
- Review scope changes and notify the buyer where required.
Compare preparation options for defence suppliers
Choose support for the work you cannot reliably own internally. Preparation, remediation and independent assessment are different jobs; outsourcing one does not transfer responsibility for all three.
The options below are complementary. You can prepare manually, use an IT provider to change configurations and still appoint a certification body for the independent assessment.
| Option | Best for | Practical advantage | Key limitation |
|---|---|---|---|
| Internal preparation | Suppliers with an accountable IT owner and a manageable environment | Keeps scope decisions and remediation close to the systems | Requires internal time and consistent technical follow-through |
| Managed IT provider | Suppliers needing hands-on configuration changes | Provides operational help where the provider manages the relevant systems | Responsibilities must cover cloud services, remote devices and third-party access explicitly |
| OneClickComply compliance automation | Growing suppliers managing security controls, policies and risk | Automates control remediation and policy generation | Does not replace independent assessment or buyer approval |
| Certification body | Suppliers ready for independent Cyber Essentials Plus testing | Assesses the environment against the scheme requirements | Assessment is not the same as an ongoing IT management service |
Before appointing support, write down who approves changes, who implements them and who verifies the result. Check those responsibilities against existing IT contracts to avoid leaving a task between suppliers.
Ask any automation provider which systems and control changes it supports. Ask any certification body which preparation services are separate from its assessment work; do not assume that identifying a gap includes fixing it.
Common mistakes defence suppliers make
Treating Plus as a universal defence requirement
Cyber Essentials Plus for defence suppliers is not a universal answer to every tender. Follow the contract’s exact wording and confirm any additional assurance obligations with the buyer.
Fix: maintain a separate record for certification, contract security clauses and supplier assurance submissions.
Certifying a boundary that misses the delivery environment
A narrow certificate does not demonstrate controls for systems outside its stated scope. Check that the people, devices and services used to deliver the contract are represented accurately.
Fix: compare the proposed certification boundary with the actual contract information flow before assessment.
Assuming the IT provider owns every control
An IT provider’s contract can leave tasks with your business, another supplier or a cloud administrator. A general promise to manage IT does not define every assessment responsibility.
Fix: assign a named owner to each control and verify access before remediation starts.
Sharing defence information to prove an unrelated control
Evidence of a security setting does not need to include the contents of a contract document. Excess information complicates handling without improving the control evidence.
Fix: share the minimum relevant configuration or test record through the agreed channel.
Stopping work when the certificate arrives
New accounts, software and connections change the environment after assessment. Waiting until renewal to discover those changes creates avoidable remediation work.
Fix: include certification scope and control checks in your normal change process.
Frequently asked questions
One last thing
Compare the certificate scope with the delivery scope before sending it to a buyer. A valid certificate and a suitable certificate are not automatically the same thing.
For your 2026 submission, put the contracting entity, certificate scope and expiry date beside the buyer’s requirement. Resolve mismatches before you describe the business as compliant.
Use OneClickComply compliance automation to manage supported control remediation, policies and risk while keeping contract decisions and independent assessment with their accountable owners. Seriously Simple Cyber Compliance.