More tenders, supply chain checks and insurance renewals now ask the same question: can you prove your business keeps data safe?
For many small firms, the answer decides whether they get shortlisted. A certificate gives buyers a simple, trusted sign that the basics are in place. Without one, you can lose out before anyone reads your proposal.
Here are the certificates worth knowing about, what each one involves, and what it can open up for your business.
1. Cyber Essentials
Cyber Essentials is the UK government-backed scheme, run by IASME with the National Cyber Security Centre. It is the most common starting point for small firms and the one buyers ask for most often.
It covers five areas:
- Firewalls
- Secure settings
- User access control
- Malware protection
- Security updates
What it opens up
- Many central government contracts require it, mainly where personal or sensitive data is handled.
- It is common in wider public sector tenders. It is also growing in private supply chains, where main contractors send security checks down to their suppliers.
- Law firms are often asked for it on panels and in referral deals.
- Eligible UK businesses can get cyber insurance included with it.
What changed in 2026
The current version, v3.3, came into effect on 27 April 2026. Two changes matter for most businesses:
- Multi-factor authentication (MFA) must be switched on for every cloud service where it is available, even where it is a paid extra. Not having it is an automatic fail.
- High-risk and critical security updates must be installed within 14 days of release. This covers operating systems, apps, firewalls and routers.
If your certificate is due for renewal, check both of these before you start. Many firms that passed before will not pass under the new rules without changes. Our free Cyber Essentials readiness checker takes a few minutes and shows where you stand.
2. Cyber Essentials Plus
Cyber Essentials Plus covers the same five areas, but an independent assessor tests your systems instead of relying on your own answers.
What it opens up
- Higher-value public sector and defence supply chain work often asks for Plus.
- It carries more weight in tender scoring because the controls have been checked.
Worth knowing
Under v3.3, if the assessor finds problems on the devices they test, a fresh random sample must be drawn to show the fix has worked. Getting your devices properly managed before the audit saves time and cost.
3. ISO 27001
ISO 27001 is the international standard for managing information security. It goes beyond technical controls. It covers risk, policies, suppliers and regular reviews across the business.
What it opens up
- Larger corporate clients, financial firms and overseas buyers often expect it.
- It can shorten or replace long security questionnaires.
- It shows long-term maturity, which helps in bigger multi-year contracts.
Worth knowing
ISO 27001 is a big job, with external and yearly audits. For most small firms, Cyber Essentials comes first. Holding ISO 27001 does not exempt you from Cyber Essentials where a contract asks for it by name.
4. Data Security and Protection Toolkit (DSPT)
The DSPT is a yearly self-assessment set by the Department of Health and Social Care. It is not a certificate in the usual sense, but for health and care providers it plays the same role.
Who needs it:
- CQC-registered adult social care providers in England
- Anyone with access to NHS patient data or systems
- Suppliers working directly for an NHS body
What it opens up
- Access to NHS.net Connect secure email, GP Connect, shared care records and Proxy Access
- Evidence for CQC under the Well Led key question
- Commissioners are advised to write DSPT at Standards Met into provider contracts. So it now affects who wins local authority and NHS work.
Worth knowing
The DSPT covers far more than IT. Paper records, staff training, verbal sharing and data sharing are all included. Your IT provider can supply the technical evidence, but the submission needs input from across the business. At least 95% of staff must complete yearly data protection training. Our Spot the Phish quiz is a quick way to test where your team is starting from.
5. Other standards to know about
Depending on your sector and clients, you may also come across:
- IASME Cyber Assurance: a step up from Cyber Essentials. It follows the same ideas as ISO 27001 but is built to be easier for small firms to reach.
- PCI DSS: needed if you take, store or process card payments.
- Lexcel: the Law Society’s practice management standard, which includes rules on handling information.
- ICO registration: not a certificate, but a legal must for almost every business that handles personal data. Buyers do check the public register. This matters for accountancy practices and anyone else holding client financial data.
How certificates help you win work
You pass the first filter. Many tenders are pass or fail on certificates. Without one, your pricing and experience never get read.
You score higher. Where security is scored, a recognised certificate earns marks a written answer cannot.
You answer security checks faster. Supply chain questionnaires can run to dozens of questions. A certificate covers many of them in one line.
You make insurance easier. Insurers now ask about MFA, patching and backups. A certificate gives you written answers. You can also check your email security in a few seconds.
You lower your real risk. The controls these schemes need, such as MFA, fast patching and malware protection, block the most common attacks on small businesses. Use our cyber risk cost calculator to see what an incident could cost your business.
Where to start
For most small firms the sensible order is:
- Check you are registered with the ICO.
- Get Cyber Essentials in place, and make sure MFA and 14-day patching are covered under v3.3. If you are not sure you will pass, start with a readiness assessment.
- If you are in health or care, complete the DSPT to Standards Met.
- Move to Cyber Essentials Plus once you are going after higher-value or public sector contracts.
- Look at IASME Cyber Assurance or ISO 27001 when larger clients start asking for it.
The hardest part is not the assessment. It is keeping the controls in place all year, so renewal is routine and your evidence is ready when a tender lands. That is what Managed Cyber Essentials is for.
Guard IQ helps regulated businesses across London and Hertfordshire get certified and stay audit-ready all year. Book a free consultation.