The questions buyers ask
Most security questionnaires cover the same ground. The NCSC publishes a set of supplier assurance questions that any organisation can use, and they fall into ten areas:
- Security governance
- Managing and recovering from incidents
- Protecting your network
- Protecting data
- Offshoring
- Personal data
- Personnel security
- Physical security
- Independent testing and assurance
- Other contractual matters
Cyber Essentials and UK government contracts
Cyber Essentials is the UK government-backed baseline: five technical controls covering firewalls, secure configuration, security updates, user access and malware protection. IASME runs it as the NCSC's delivery partner. The basic level is a self-assessment checked by an independent certification body; Cyber Essentials Plus covers the same controls and adds hands-on vulnerability testing.
Under PPN 014, central government departments, their agencies and NHS bodies require Cyber Essentials or Plus, renewed every year, for contracts where the supplier handles citizens' or staff personal data, supplies IT systems that hold OFFICIAL data, or handles information about how government runs. It applies to procurements starting on or after 24 February 2025, and buyers are told to apply it proportionately rather than to every contract.
| What | Price | What it covers |
|---|---|---|
| Micro (0 to 9 employees) | £320 + VAT | Cyber Essentials self-assessment |
| Small (10 to 49) | £440 + VAT | Cyber Essentials self-assessment |
| Medium (50 to 249) | £500 + VAT | Cyber Essentials self-assessment |
| Large (250 or more) | £600 + VAT | Cyber Essentials self-assessment |
IASME's published fees, which IASME sets and may change: check its site before you budget. Cyber Essentials Plus is priced by quote. The NCSC's funded Cyber Essentials programme has closed.
If you sell software
Buyers of software also want to know how it's built and looked after. The UK's Software Security Code of Practice, first published in May 2025, is a voluntary baseline for software vendors: fourteen principles covering secure design and development, a protected build environment, secure deployment and maintenance, and clear communication with customers, including at least a year's notice before support ends. It makes a useful checklist for the evidence a buyer is likely to want.
What the Tender Enabler gives you
The Tender Enabler (£7,500) is built for this moment. It includes everything in the Deep-Dive Assessment, plus:
- Build-ready tender / remediation specification any firm can quote against
- Light penetration test of the exposed surface
- Scalability and compliance-gap review
- Investor / due-diligence-ready summary
Cyber Essentials certificates are issued by IASME's certification bodies. An assessment shows you where you stand and what to fix before you apply.