Tiri.Tese achieved Cyber Essentials certification in July 2026. This is not a marketing claim — it is a verifiable credential. You can check our certificate on the NCSC's public registry at registry.blockmarktech.com.
We are writing about what Cyber Essentials is and what it means for procurement because the certification is frequently misunderstood — both by suppliers who treat it as a box to tick and by procurement officers who treat it as a sufficient proxy for a supplier's security posture. Neither view is accurate.
What Cyber Essentials is
Cyber Essentials is a UK government-backed certification scheme administered by the National Cyber Security Centre (NCSC). It was introduced in 2014 to establish a baseline of cyber security controls that protect organisations against the most common internet-based threats. The scheme has been updated several times since, with version 3.3 (Montpellier) introducing significant clarifications around cloud services, home working, and device management.
The certification covers five technical control areas:
- Firewalls: A boundary firewall or equivalent is in place and configured to block unauthorised traffic. This applies to cloud environments as well as traditional on-premise networks.
- Secure configuration: Devices and software are set up securely — unnecessary features and services disabled, default passwords changed, unnecessary accounts removed.
- User access control: Access to systems and data is managed based on what is needed for each role. Standard user accounts rather than administrator accounts are used for routine work. Multi-factor authentication is required for cloud services and remote access.
- Malware protection: Protection against malware through a combination of technical controls — anti-malware software, application allowlisting, or sandboxing — appropriate to the operating environment.
- Security update management (patch management): Operating systems and software are kept up to date. High and critical patches applied within 14 days; unsupported software is not used in scope systems.
Cyber Essentials self-assessment requires completing a detailed questionnaire that is assessed by an authorised certifying body. The certifying body cannot modify the questions or the marking criteria — they are set by the NCSC. If the questionnaire reveals gaps against the five controls, the application is rejected and the applicant must remediate before reapplying.
Cyber Essentials Plus
Cyber Essentials Plus builds on the self-assessment by adding an external technical audit. An assessor from a certifying body conducts hands-on verification of the controls — testing that firewalls are configured as described, checking that patch management is actually operating within the required timeframes, verifying MFA enforcement. The audit uses the same scope and controls as the self-assessment but provides independent evidence rather than relying on self-reported answers.
CE+ is more credible for contracts involving sensitive or personal data, and is increasingly specified in procurement for NHS and local authority digital contracts. It is not automatically required — read the tender carefully — but where a contract involves handling data at any meaningful sensitivity level, CE+ is the better position to be in.
What it does not cover
Cyber Essentials is a baseline. It is not comprehensive cyber security. The five controls protect against common commodity attacks — phishing, malware, unpatched software exploitation, credential theft via weak passwords. They do not address:
- Physical security of devices and premises
- Staff security awareness training
- Incident response planning and capability
- Supply chain security and third-party risk management
- Business continuity and disaster recovery
- Data classification and handling procedures
- Advanced persistent threats or nation-state level attacks
A procurement officer who treats Cyber Essentials certification as sufficient assurance for a contract involving highly sensitive data is not applying the right standard. For contracts at higher assurance tiers, ISO 27001 or a bespoke security assessment is the appropriate requirement. CE is the floor, not the ceiling.
For procurement officers. The Government Functional Standard GovS 007 requires Cyber Essentials as a minimum for contracts involving personal information or certain technical products. It also sets out where higher assurance is required. If you are procuring software that will handle data at OFFICIAL-SENSITIVE or above, CE alone is not a sufficient basis for supplier assurance.
Why it matters for procurement in practice
For SME software suppliers bidding for public sector work, Cyber Essentials is the practical entry credential for the first sift. Many procurement officers will not proceed with a supplier who cannot evidence CE certification, regardless of how strong the proposal is in other respects. This is not unreasonable — the NCSC's analysis consistently shows that the five controls would have prevented the majority of common cyber attacks that affected UK organisations.
The procurement-relevant distinction is between suppliers who have CE and can evidence it, and suppliers who say they meet the controls but have not been certified. Self-reported compliance without independent verification is not the same thing, and a procurement officer who accepts it is accepting more risk than the controls are designed to eliminate.
The renewal requirement
Cyber Essentials certification expires after twelve months. This means the controls are reassessed annually, which matters because the scope of what counts as "in scope" changes as the organisation's IT environment changes — new cloud services, new remote working arrangements, new devices. The annual cycle is designed to ensure the assessment reflects the actual current environment, not a snapshot from three years ago.
For procurement officers, this means checking the expiry date on the certificate, not just its existence. A certificate from 2023 tells you nothing about the supplier's current posture. We publish our current certificate on our website and will provide it on request with a clear expiry date.
Our certificate
Tiri.Tese holds Cyber Essentials certification. Our certificate is publicly verifiable at registry.blockmarktech.com. We are pursuing Cyber Essentials Plus as the next step in our assurance posture, alongside our ISO 27001 readiness programme.
If you are evaluating us as a supplier and have questions about our security controls, data handling procedures, or the scope of our certification, contact us directly. We provide full compliance documentation as part of our standard due diligence pack.