Cyber Essentials and insurance: how to get them before you bid

1. Why buyers ask for these

Checked against official and certification body pages on 13 October 2026. Prices and rules change, so check the links before you pay.

Most tenders have pass or fail gates before anyone reads your answers. Security and insurance are two of the most common. If you do not hold them when the tender closes, you can be rejected without being scored.

• Cyber Essentials shows you have basic protection against common internet attacks.
• Insurance shows the buyer is covered if something goes wrong, and that you can pay for it.
• Both take time to arrange. Do not start the week a tender closes.

2. What buyers usually ask for

3. Get Cyber Essentials: step by step

1. 1

   Step 1. Decide who is in charge

   Choose one person to lead. A board member or equivalent must sign off the answers, so choose someone with the authority.

2. 2

   Step 2. List your devices and accounts

   • Every laptop, desktop, tablet and phone used for company work. Include personal devices and home working.
   • Where your team works from, including anyone outside the UK. Check the question set for what it asks about this.
   • Your cloud services: email, file storage, accounting, project tools.
   • Your router or firewall at each location, and how people log in.
3. 3

   Step 3. Download the free question set

   • Download the question set (PDF or Excel) from IASME. It is free.
   • Read it first. Prepare answers before you pay.
   • Free help from the NCSC includes a readiness tool and a 30-minute consultation for small businesses.
4. 4

   Step 4. Fix the gaps

   Cyber Essentials checks five areas:

   Area	In plain words	Typical fix
   AreaFirewalls	In plain wordsA barrier between your devices and the internet.	Typical fixTurn on the built-in firewall. Check your router settings.
   AreaSecure configuration	In plain wordsDevices set up safely.	Typical fixRemove unused software and accounts. Change default passwords.
   AreaSecurity updates	In plain wordsSoftware kept up to date.	Typical fixTurn on automatic updates. Remove software the maker no longer supports.
   AreaUser access control	In plain wordsOnly the right people have access.	Typical fixSeparate admin accounts. Remove leavers. Use multi-factor sign-in.
   AreaMalware protection	In plain wordsProtection against viruses and bad software.	Typical fixUse up-to-date protection on every device.

5. 5

   Step 5. Apply and pay

   • Choose how to apply: self-led through IASME, or supported by a Certification Body licensed by IASME.
   • Register and pay. You get login details for the online portal.
   • You have 6 months from applying to submit.

   Organisation size	Price (excluding VAT)
   Organisation sizeMicro: 0 to 9 employees	Price (excluding VAT)£320
   Organisation sizeSmall: 10 to 49	Price (excluding VAT)£440
   Organisation sizeMedium: 50 to 249	Price (excluding VAT)£500
   Organisation sizeLarge: 250 and over	Price (excluding VAT)£600

   Prices are from IASME and can change. A Certification Body may charge more for help.

6. 6

   Step 6. Complete the self-assessment

   • It takes about an hour if your answers are ready.
   • Answer honestly. The assessor marks it.
   • A board member or equivalent signs it off.
   • Keep a copy of your answers. You need them next year.
7. 7

   Step 7. Get your result

   • Assessors usually aim to return results within 3 days.
   • If you fail, you have 2 working days to fix simple issues and resubmit at no extra charge.
   • If you still fail, you must apply and pay again.
8. 8

   Step 8. Use and renew your certificate

   • Download your certificate. Save the number. Buyers can check it on the IASME certificate search.
   • It lasts 12 months. Diary a renewal reminder for 2 months before expiry.
   • Put the certificate in your Find a Tender supplier information under trade assurances, and use it in every tender.

4. Cyber Essentials Plus

• Do it only if a tender asks for it. It is the same five areas, plus a technical audit.
• The audit includes vulnerability scans and tests a sample of your devices and internet-facing systems. It can be remote or on site.
• You get quotes from Certification Bodies. Cost depends on size and complexity.
• If you finished the self-assessment less than 3 months earlier, you do not have to repeat the questions.

5. Insurance: step by step

1. 1

   Step 1. Employers' liability: do you need it?

   • If you employ staff, the law says you must have it from the day you take on your first employee.
   • The minimum cover is £5 million, from an authorised insurer.
   • The fine is £2,500 for each day you are not properly insured, and £1,000 if you do not display your certificate.
   • You may be exempt if you only employ close family members or people based outside England, Scotland and Wales. Check the GOV.UK page for the exact rules.
   • If you only use contractors or directors, ask a broker whether you need it. Do not guess.
2. 2

   Step 2. Check what the tender asks for

   • Look in the selection questionnaire or conditions of participation for the cover levels.
   • Write down each type and amount. For example: public liability £1m, professional indemnity £1m.
   • Note whether the cover must be in place at tender or only at contract start.
3. 3

   Step 3. Get quotes from a broker

   • Use an insurance broker. They can arrange several covers together.
   • To find one, use the British Insurance Brokers' Association (BIBA) find a broker service.
   • Check the insurer is authorised on the Financial Conduct Authority register.
   • Tell the broker: what you do, your turnover, number of staff and contractors, who your clients are, and the cover levels in the tenders you want.
   • Ask: does the professional indemnity policy cover technology and AI advice? Does it cover subcontractors? What is excluded?
4. 4

   Step 4. Buy and keep the evidence

   • Save the certificate for each policy. Note the insurer, the policy number, the cover level and the end date.
   • Display the employers' liability certificate where employees can access it, for example on a shared drive.
   • Diary renewals. An expired policy fails the gate.
5. 5

   Step 5. If a tender asks for more than you have

   • Ask your broker if you can increase the cover, and how much it costs.
   • Ask the buyer in a clarification whether they will accept a commitment to increase cover if you win. Some do.
   • If you cannot meet it, consider partnering as a subcontractor, or pass.

6. Your gate sheet

Fill this in once. Use it for every tender.

7. A two-week plan

8. Common problems

9. Links