Cyber Essentials in UK tenders: a scoreable evidence checklist

How do you prove Cyber Essentials in UK tenders?

In Cyber Essentials tenders, buyers want proof that you meet a recognised UK baseline, and they need it in a form that’s easy to verify and score.

Cyber Essentials is a UK Government-backed scheme that checks five core control areas (like access control, secure configuration, and patching). In tenders, it often sits at the selection stage (pass or fail) and also appears in scored method statements (how you manage risk in delivery).

This guide shows what procurement teams typically want to see, how to present evidence so it scores, and a practical evidence checklist you can drop into your bid plan.

Why this matters when you’re trying to win the work

If you’ve ever stared at a tender question thinking, “We do this, but how do I prove it?”, you’re in very good company.

Cyber Essentials is a classic area for losing easy marks, and the gap is usually in the evidence and how clearly it’s presented. Evaluators can only award points for what they can see, and they won’t hunt through attachments to join the dots.

In public sector procurement, cyber risk links directly to service continuity, data protection, and supply chain confidence. So even when Cyber Essentials is a compliance tick box, the tender often still asks you to explain how you’ll keep systems and information safe during delivery.

From a scoring point of view, this is simple:

If an evaluator can’t verify it quickly, it won’t score well, even if it’s true.

There’s also timing to consider. The scheme was updated for assessments from 27th April 2026 (requirements v3.3, known as the “Danzell” question set), with tighter expectations around cloud services and multi-factor authentication. If your certificate was issued before then, your next renewal will be assessed against the new requirements, so describe your current controls with that in mind. For a summary of the changes, see what’s changing in Cyber Essentials from 27th April 2026.

So the aim in your bid is twofold: show you meet the baseline now, and show you’re keeping up as the scheme changes.

What buyers ask for and what good looks like

Some tenders treat Cyber Essentials as selection stage evidence: upload a valid certificate, confirm the scope, move on. Others wrap it into scored questions about information governance, technical security, and mobilisation.

Either way, assessors tend to look for three things:

First, validity. Is the certificate in date, and does it match the legal entity bidding?

Next, scope fit. Does the certificate scope match the services, systems, and locations you’ll use to deliver the contract, including relevant cloud platforms?

Finally, delivery reality. Can you explain, in plain language, how your controls work day to day?

Many contracting bodies now expect Cyber Essentials (or equivalent) as a minimum for government-related work. If you need a quick view of how this standard shows up in tendering, this overview on how Cyber Essentials affects government tender bids is a useful reference.

Here’s a quick way to think about “scoreable” evidence versus “nice words”.

Tender prompt	What evaluators can score	What weak answers look like
“Provide Cyber Essentials evidence”	Certificate, date, scope statement, entity match	Out of date certificate, no scope clarity
“How do you secure cloud services?”	MFA in place, admin roles controlled, configuration ownership explained	“Our provider is secure” with no detail
“How do you manage vulnerabilities?”	Patch timeframes, exception handling, reporting	“We patch regularly” with no numbers
“How do you control user access?”	Joiner mover leaver process, least privilege, audit	Policies only, no operational detail

The takeaway is that buyers want proof your controls are real, current and relevant to the contract, and they can do without a cyber lecture.

A scoreable evidence checklist for your bid plan

Use this as your “evaluator-ready pack” for Cyber Essentials tenders. It’s written to reduce back-and-forth internally and stop last-minute attachment scrambles.

→ Cyber Essentials certificate (in date), with issuing body and expiry date clearly shown
→ Certificate scope statement, written in your own words (what systems, sites, and teams it covers)
→ Legal entity confirmation (certificate name matches bidder name, or explain the relationship)
→ Asset coverage summary (endpoints, servers, mobiles, and any internet-facing services relevant to delivery)
→ Cloud services list in scope (for example, Microsoft 365, Google Workspace, AWS, Azure) and who owns configuration
→ MFA evidence for cloud accounts, especially admin roles (short description plus screenshot extract if allowed)
→ Access control process (joiner mover leaver steps, role-based access, and how you review permissions)
→ Patching commitment with timeframes (include how you handle critical updates and exceptions)
→ Secure configuration approach (build standards, baseline settings, and how you stop drift)
→ Malware protection summary (what’s deployed, how updates happen, and how alerts are handled)
→ Firewall and boundary controls explanation (where traffic is filtered and who can change rules)
→ Incident response basics (how you detect, respond, and report, including supplier escalation routes)
→ Subcontractor and supplier assurance (what you require from them, and how you check it)
→ Bid mapping note (one line per tender question showing where each item above is evidenced)

A small but important detail: spell out how your cloud set-up is secured. The 2026 update brought clearer expectations on cloud configuration and MFA, so it’s wise to describe those controls plainly. This explainer on the Cyber Essentials 2026 update and MFA expectations sets out what changed.

Common mistakes in Cyber Essentials tenders

Plenty of organisations that are perfectly good at security still lose marks on Cyber Essentials, because the bid doesn’t make it easy to award them.

Treating the certificate like a magic shield

A certificate helps, but on its own it won’t answer “how will you protect our data during delivery?” Put the certificate in, then explain operational controls in a few lines.

Scope mismatch

If your certificate covers head office devices, but delivery happens on a separate platform or subsidiary, you must explain that clearly. Otherwise, the evaluator sees risk.

Cloud hand-waving

Saying “we use Microsoft so it’s secure” is a fast route to low confidence. Buyers want to know what you configured: MFA, conditional access, admin roles, and how you monitor.

Vague patching language

“Regular updates” gives the evaluator nothing to score, so give a number. Cyber Essentials expects high and critical security updates to be applied within 14 days of release, so say how you meet that and explain what happens when patching can’t happen quickly.

Confusing Cyber Essentials with ISO 27001

They’re related, but they prove different things. If you’re deciding what to prioritise for tenders, this comparison of Cyber Essentials vs ISO 27001 for UK SMEs helps frame what each one proves. In tender answers, be precise about which standard you hold and what it covers.

One practical fix is to write your response so it can be skim read, with short headings, direct evidence and a clear link between the question and the proof.

This is where Bidsmithery™ comes in. Most teams we work with put in plenty of effort, but they’re short on calm time and an evaluator’s perspective. When you’re writing bids around delivery, small “fixable” gaps slip through, and those are exactly the gaps that cost marks.

Frequently asked questions

Make it easy to mark

Cyber Essentials in tenders comes down to making your evidence obvious, relevant and quick to verify.

If you want a second pair of eyes before you submit, look at your draft the way an evaluator would. Tighten the mapping, cut the vague lines and make every claim provable. Our free Evaluator’s Eye Test is a good place to start.

If you’d like support building that habit across your team, take a look at our bid training, or keep expert feedback on standby with our bid and tender review service. You can also book a fit check call and sense-check what your next tender is asking for.