Do You Need Cyber Essentials? Ask the Client Who Just Asked You

Somewhere in the last few months, a client's procurement team sent you a questionnaire. Or asked for your Cyber Essentials certificate. Or said, almost in passing, that they'd need to see your security policy before the contract could be signed. And somewhere in that moment, you realised nobody had actually looked.

If that's happened to you, you're not behind. You're just the business your client's own risk team decided to check — which, increasingly, is every business they buy from.

Why this is happening more

Larger clients, regulated clients, and public sector buyers are all under the same pressure: they have to answer for their supply chain, not just their own four walls. A law firm's insurer wants to know who handles their case files. A private healthcare group's auditor wants assurance about every system touching patient data. A corporate client's own security team has a policy that says every supplier gets checked, no exceptions — yours included, however small the contract.

None of that is really about you. It's about them needing to show their own regulator, insurer or board that they've done the checking. You're just the business standing in front of the questionnaire this quarter.

What these requests actually look like

They rarely arrive labelled as a security review. More often it's one of these, landing in an inbox with a deadline attached:

• A due diligence or vendor security questionnaire — MFA, encryption, patching, backup, incident response, all asked in a spreadsheet you've never filled in before
• A direct request to see a Cyber Essentials certificate, sometimes as a condition of the contract rather than a nice-to-have
• A data processing agreement that assumes controls you may or may not actually have
• A one-line ask from a contact who may not know the full weight of what they're asking for — "can you just confirm your IT is secure?" — which is its own kind of hard question to answer honestly

Whatever form it takes, the uncomfortable part is the same: you're being asked to describe your security posture to someone else before you've described it to yourself.

The real risk isn't failing the questionnaire

It's answering it under pressure. A security review done in a panic, against a deadline, with a contract hanging over it, tends to produce one of two outcomes: a rushed, overstated answer that comes back to bite you later, or an honest one that costs you the deal this time. Neither is a position you should be negotiating from for the first time when a client is already watching.

The gap is rarely dishonesty — it's that nobody had looked yet. Until a client asks, there's no obvious moment to check what your IT actually does against what an auditor expects it to do, so it doesn't get checked. The questionnaire isn't the problem. Finding out the hard way is.

Turn it into an advantage, not a scramble

The businesses that handle this well treat the first questionnaire as the wake-up call, and make sure there's never a second one that catches them flat. That means having an honest, independent answer ready before the next client asks — not built from scratch under deadline, the third time it happens.

That's exactly what a Technology Resilience Score™ is for. It's a benchmarked, independent view of your environment — covering the areas a client's due diligence actually probes: security protection, passwords and access control, data and compliance, monitoring and incident response, backup and continuity. You get a credible, benchmarked number to put in front of a client or auditor, a clear view of exactly what to close first, and — once it's closed — evidence of where your score is heading. That's the difference between surviving a questionnaire and using one to win the contract.

If the certificate itself is what's being asked for, Cyber Essentials is something we take firms through as a project alongside the managed service — and we hold the certification ourselves, so we're not selling you a questionnaire we've never had to pass. We build the environment to meet the five controls first, so the certificate reflects real security rather than a paper exercise. After that, keeping the controls current is part of the managed service, which is what makes annual renewal straightforward rather than a fresh project every year.

Know the answer before the next questionnaire

You won't get asked once. The businesses that stop finding this stressful are the ones that did the work after the first questionnaire, not the third. Take the free Technology Resilience Assessment — under 10 minutes, and an indicative score and report land straight in your inbox. Next time a client asks, you're sending an answer, not building one.

Frequently asked questions

Do I need Cyber Essentials certification?

Not every business is required to hold it by law, but a growing number of buyers now require it as a condition of doing business with them — central government contracts involving personal data or ICT services mandate it, and corporate procurement teams routinely ask for it even where it isn't a formal requirement. If a client has asked, the honest answer is that you need it for that client — and the firms that get ahead of it stop losing time to the next questionnaire and start using the certificate as a reason to be chosen.

Is Cyber Essentials enough for a small business, or just a tick-box exercise?

It's a genuine baseline, not paperwork — the five controls it assesses (firewalls, secure configuration, user access control, malware protection and patch management) are the ones that, between them, protect against the most common cyber attacks. For most SMEs it's proportionate: enough to close the obvious gaps and answer most client questions, without the overhead of a much larger framework. If your risk is genuinely higher — regulated data, a larger attack surface — your Technology Resilience Score™ shows where you sit across all five dimensions, what to close first beyond the certificate, and where your score is heading once you do.

Why do bigger clients suddenly care about our IT?

Because their own risk, insurance or regulatory obligations now extend down their supply chain. It's rarely personal — it's that the questionnaire gets sent to every supplier above a certain contract value, and this time that's you.

What if nothing's actually gone wrong — do we still need to look at this?

That's the most common version of this we hear, and it's exactly the right moment to look. You don't need an incident to justify getting ahead of a question a client is already asking. Better you find the gaps than they do.

We don't have a dedicated IT or security person — where do we even start?

With an honest baseline. A free Technology Resilience Assessment takes under 10 minutes and gives you an indicative score and report, so you know what you're actually dealing with before the next questionnaire lands.

How quickly can we get certified or get a credible answer ready?

It depends on the gap between where you are and what's being asked for, which is exactly what the assessment tells you. Some businesses are closer than they think; others need a short, focused project first. Either way, you'll know the shape of it after the first conversation, not after the deadline.