ISO 27001 consultants for public sector suppliers

If you are bidding for central government work, the certificate the policy names is Cyber Essentials, not ISO 27001. That is worth knowing before you spend anything, and it is the first thing a consultancy should tell you.

At a glance: what buyers in this sector ask for

What the procurement policy actually says

The Cabinet Office procurement policy note on the Cyber Essentials scheme is binding policy rather than guidance, and it replaced the two earlier notes on the same subject. The government has required suppliers bidding for certain public contracts to hold Cyber Essentials or Cyber Essentials Plus, or demonstrate equivalent controls, since 2014.

The operative requirement is that evidence of holding a Cyber Essentials certificate, basic or Plus, or equivalent, is required before contract award for in-scope contracts. Not during delivery, and not at some later assurance stage. Before award.

What Cyber Essentials itself requires — the five technical controls, the scope rules, and what changed in the current version — is on ISO 27001 vs Cyber Essentials.

It is not a blanket rule covering every public contract. The policy note says so in terms: “In-scope organisations must not take a blanket approach.” It applies where the tender or the framework specifies it, so the requirement in front of you is the one that counts.

The two words that decide whether your certificate counts

“Or equivalent” is the phrase everything turns on. PPN 014 says the buyer “in-scope organisations must accept equivalents and suppliers need only demonstrate to the satisfaction of the in-scope organisations that they meet Cyber Essentials requirements. Normally, this should be verified by a technically competent and independent third party.” And for the higher level: “To demonstrate that Cyber Essentials Plus requirements have been met, it is required in all cases that verification is provided by a technically competent and independent third party.”

On ISO 27001 specifically, the policy note is direct: “The ISO27001 standard is widely used but companies that attain this standard will not automatically conform to Cyber Essentials. This is because it is not usual for all of the five technical controls in Cyber Essentials to be included in the scope for ISO27001 implementation. It is also unlikely that any of these controls will be tested for ISO27001. Therefore most businesses with ISO27001 will have to adopt Cyber Essentials in addition to ISO27001 or demonstrate equivalent controls are in place.” So the certificate on its own is rarely the evidence. What counts is showing the five Cyber Essentials controls are in place — independently verified — to the satisfaction of the authority you are bidding to.

The practical consequence is unglamorous and saves a great deal of money: read the requirement in the tender you are actually bidding for, and if it is ambiguous, ask a clarifying question. Procurement processes have a formal route for exactly that. It costs nothing and it is the only way to get an answer that binds.

Why ISO 27001 can still be worth doing

None of the above means the standard is a waste of money for a public-sector supplier. It means it is not a shortcut around a named requirement.

Where it earns its place: framework applications and larger contracts routinely ask security-assurance questions that go well past the five technical control areas Cyber Essentials covers — governance, risk management, supplier management, business continuity, incident response. A management system answers those, and answering them from an existing ISMS is a different exercise from assembling them per bid.

It also travels. A supplier selling to government, to enterprise and possibly abroad needs one security story, and ISO 27001 is the one that is recognised across all three. Cyber Essentials is a UK scheme and does not carry the same weight outside the UK.

The honest summary: Cyber Essentials to be eligible, ISO 27001 to be competitive and to answer the questions Cyber Essentials does not reach.

Scope, subcontractors, and the question that comes after award

Two things trip suppliers up after the certificate exists.

The scope on the certificate has to cover the work. A certificate scoped to one product line does not evidence controls over a different service you have just bid to deliver. Assurance reviewers can read the schedule, and the scope line is the first thing to check.

Your own supply chain is part of the answer. The policy exists because of supply chain risk, so expect to be asked what you require of your subcontractors. Annex A supplier controls are exactly this, and if you are certified you should be able to answer from evidence rather than from memory. A folder of supplier certificates that nobody has checked for currency or scope is a common and avoidable finding — and certificates issued against the withdrawn 2013 edition of the standard stopped being valid in October 2025.

Bid timelines and certification timelines do not fit together

The requirement is evidence before contract award. Set that against how long certification actually takes and the problem is obvious: for most suppliers, a tender that lands with a certification requirement has already landed too late.

ISO 27001 has a floor that money does not move. Clause 9.2 requires an internal audit and clause 9.3 a management review, and both need the management system to have been running long enough to produce something worth examining. On top of that, Stage 1 and Stage 2 are separate visits booked around your certification body’s availability, and the certificate itself follows some weeks after the last audit day once the body completes its own review.

Cyber Essentials is much faster, which is another reason it is the sensible first move for a supplier starting cold. The basic level is a verified self-assessment and turns around quickly. Cyber Essentials Plus adds a hands-on technical audit by the assessment body and has to be scheduled, so it is the one most likely to miss a deadline that felt comfortable when the tender arrived.

Which makes this a pipeline question rather than a compliance one. If public sector work is part of your plan, the certification you will need is decided by the framework you intend to bid into, and that is knowable months before a specific opportunity appears. Read the framework’s requirements now. Suppliers who treat certification as something to arrange once a tender is in front of them are the ones who end up asking whether ISO 27001 can be substituted for something they should already have had.

What this does not change

Whatever sits on top, the arithmetic underneath is the same for every sector. Audit days come from ISO/IEC 27006 audit time table, reproduced in full in an accredited certification body's published audit-duration procedure (QSI-TL.04 rev 21) and are a function of the people inside your scope, your sites and your complexity. Surveillance is one third of the initial audit every year and recertification is two thirds in year three. Your certification body cannot be your consultant, and cannot do the internal audit clause 9.2 requires.

Work out the cost for your headcount, or see the full audit-day table.

Common questions