No Cyber Essentials? No contract.

No Cyber Essentials? No Contract.

Why Cyber Essentials is becoming your ticket to winning work in construction.

If you work in construction, you already know the paperwork you need before you're allowed on a job: CSCS cards, insurance certificates, RAMS, health and safety accreditations.

There's another certificate now appearing on more tender forms and supplier questionnaires: Cyber Essentials.

And for some contractors and suppliers, not having it could mean missing out on valuable work.

Here's what it is, why clients are asking for it, and why it matters to everyone in the business, from the site team to the boardroom.

What is Cyber Essentials?

Cyber Essentials is a UK government-backed certification scheme designed to help businesses protect themselves against common cyber attacks.

It focuses on five essential security controls:

• Firewalls: Protecting your network and devices from unwanted connections.

• Secure configuration: Making sure computers, phones and software are set up securely.

• Access control: Ensuring people only have access to what they need.

• Malware protection: Protecting devices against viruses and malicious software.

• Security update management: Keeping operating systems, applications and devices updated.

There are two certification levels.

Cyber Essentials is a verified self-assessment covering these technical controls.

Cyber Essentials Plus includes additional independent technical testing to check that the controls are working in practice.

Neither certification guarantees complete protection against every cyber attack. Instead, they establish a recognised baseline that helps prevent many common threats.

Source: UK Government — Cyber Essentials scheme

Why are construction clients asking for it?

1. Government contracts increasingly require it

For certain public sector contracts, suppliers must demonstrate that they hold Cyber Essentials or Cyber Essentials Plus certification, or that equivalent security controls are in place.

This includes relevant contracts awarded by central government organisations and NHS bodies.

Importantly, not every public sector contract requires Cyber Essentials. The requirements depend on the nature and cyber security risks of the work being procured.

But if your business wants to compete for contracts where certification is specified, you need to be prepared before the contract is awarded.

Certification also needs to be renewed annually where required throughout the contract.

Source: Cabinet Office — Procurement Policy Note 014

2. Large businesses are being encouraged to check their suppliers

In October 2025, UK government ministers and the National Cyber Security Centre wrote to leading British companies, including those in the FTSE 100 and FTSE 250.

One of their key recommendations was to require Cyber Essentials throughout their supply chains.

The letter also highlighted that only 14% of UK businesses assessed the cyber risks posed by their immediate suppliers.

Think about what that means for construction.

A large developer or main contractor may have strong cyber security, but what about the subcontractors, plant hire businesses, engineers, consultants and suppliers accessing its systems or exchanging project information?

A cyber attack against one smaller supplier can create problems throughout the supply chain.

Source: UK Government — Ministerial letter on cyber security, October 2025

3. Certification can influence who gets the work

Construction businesses already understand the importance of demonstrating competence.

Clients expect evidence of insurance, training, qualifications and safe working practices.

Cyber security is increasingly becoming part of that same supplier approval process.

If two contractors offer comparable services, but only one can demonstrate independently verified cyber security controls, that certification may strengthen their position.

Cyber Essentials isn't a guarantee of winning contracts. But not having it could prevent you from qualifying for some opportunities.

The requirements are getting tougher

Cyber Essentials isn't a certificate you obtain once and forget about.

The scheme is updated as technology and cyber threats evolve.

Changes applying to new assessments from 27 April 2026 strengthened the assessment rules.

In particular, multi-factor authentication (MFA) must be implemented for cloud services where it is available. Failure to meet this requirement now results in an automatic assessment failure.

The updated assessment also places greater emphasis on installing critical security updates promptly.

For construction businesses, this means looking beyond the office computers.

Your security arrangements may need to cover:

• Microsoft 365 and business email

• Laptops used by estimators, surveyors and site managers

• Mobile phones accessing company information

• Cloud-based accounts, project management and document systems

• Remote access and VPN connections

• Supported and regularly updated software

Cloud services used by the organisation cannot simply be left outside the assessment scope.

Source: IASME — Changes to Cyber Essentials for April 2026

Why everyone on site needs to stay alert

Cyber security isn't just an IT department problem.

The government's Cyber Security Breaches Survey 2025/26 found that 43% of UK businesses identified a cyber security breach or attack during the previous 12 months.

That's approximately 612,000 businesses.

Phishing remained the most common form of attack, affecting 38% of businesses.

And smaller companies were far from immune: 42% of micro businesses and 46% of small businesses reported a breach or attack.

Source: UK Government — Cyber Security Breaches Survey 2025/26

Construction has already seen the consequences

In 2022, the Information Commissioner's Office fined construction and outsourcing company Interserve £4.4 million following serious data security failings.

The incident began with a phishing email. Attackers subsequently compromised systems and accessed personal information relating to as many as 113,000 employees.

The investigation highlighted failures involving security alerts, outdated software, staff training and risk assessments.

It's a reminder that a major incident can begin with something as ordinary as opening an email.

For construction businesses, that could happen on a laptop in the office or a mobile phone in a site cabin.

Five things everyone can do

You don't need to be an IT expert to make a difference.

1. Think before you click. Be suspicious of unexpected invoices, payment requests, delivery notifications and messages asking you to change bank details.

2. Use multi-factor authentication. That extra approval on your phone can help prevent someone accessing your accounts even if they have your password.

3. Keep devices updated. Don't continually postpone updates on laptops, tablets or phones.

4. Never share passwords. Everyone should have their own account, with access appropriate to their job.

5. Report suspicious activity immediately. If you've clicked something suspicious or think an account has been compromised, tell your IT support provider straight away.

Reporting an incident early can make an enormous difference.

There are benefits beyond winning contracts

Cyber Essentials isn't simply another compliance cost.

It can also help reduce the likelihood of a cyber incident and demonstrate to customers that you take their information seriously.

IASME reports that organisations with Cyber Essentials certification are 92% less likely to make a cyber insurance claim than those without certification, based on insurance industry research.

Eligible UK organisations with turnover below £20 million can also opt into £25,000 of cyber liability insurance when they achieve certification covering their entire organisation, subject to the policy terms and eligibility requirements.

Source: IASME — Benefits of Cyber Essentials

Source: IASME — Cyber Liability Insurance

The bottom line

Cyber Essentials is heading in a familiar direction for the construction industry.

Much like health and safety accreditations, what started as an additional credential is increasingly becoming an expectation during supplier approval and tendering.

For directors, it's about protecting the business and remaining competitive.

For office staff and site teams, it's about keeping company information secure and recognising the everyday risks.

And for customers, it's about knowing the businesses they work with take cyber security seriously.

Don't wait until a tender deadline to discover that you need certification.

Need help getting Cyber Essentials ready?

At LinkedUp Communications, we help construction companies and other businesses across the North of England improve their IT security and prepare for Cyber Essentials certification.

From reviewing existing systems and implementing multi-factor authentication to securing laptops, Microsoft 365, networks and remote access, we can help you identify what needs attention.

Whether you're preparing for your first assessment or approaching your annual renewal, we're here to help.

Talk to LinkedUp about Cyber Essentials readiness.

Contact LinkedUp Communications

LinkedUp Communications — Smart IT. Reliable Support.