Don't lose contracts over cyber security
Advanced email security that protects small businesses from sophisticated cyber threats – with 99.91% malware detection, GDPR compliance and zero business disruption
When a client asks for Cyber Essentials, it is not just admin. It is a trust test.
More buyers, insurers, public sector bodies and larger companies are asking suppliers to prove they have basic cyber security controls in place. Cyber Essentials helps you answer that question with confidence.
If you are bidding for work, renewing a contract, joining a supplier list or being asked awkward security questions by a larger client, we can help you get certified without turning it into a painful project.
You might be perfectly capable of doing the work. But without the certificate, you may not get the chance.
Supply chain security has become a bigger part of procurement. Buyers do not just want to know whether you can deliver the service. They want to know whether working with you creates avoidable cyber risk.
That can feel frustrating, especially for smaller businesses. You may have the skills, the experience and the team, but one missing certification can slow down onboarding, delay payment, block tenders or remove you from the shortlist.
What we often see
- A client asks for Cyber Essentials with very little notice, and you need a clear route through the process. Our how to pass Cyber Essentials guide explains the practical steps.
- A supplier questionnaire asks about MFA, patching, malware protection and access control.
- A business assumes its IT provider has everything covered, then finds gaps during certification.
- Directors are unsure who should answer the technical questions.
- A tender looks promising, but security evidence is weak.
- Certification is treated as a box-tick rather than a useful sales asset.
Cyber Essentials helps you stay in the conversation.
Cyber Essentials is a UK government-backed certification scheme focused on practical controls that protect against common cyber threats. For supply chain work, it can also become proof that you take basic security seriously.
Win trust faster
Certification gives clients, brokers and procurement teams a recognised signal that your business has key security basics in place.
Reduce tender friction
When security questions appear in supplier forms, Cyber Essentials gives you clearer evidence rather than vague answers.
Protect your own business
The process can expose common risks around passwords, MFA, updates, devices and software before attackers exploit them.
In simple terms: get the basics right, prove it clearly, and make it easier for buyers to say yes.
Where Cyber Essentials commonly appears.
| Where it appears | What the buyer is really asking | Why it matters to you |
|---|---|---|
| Public sector tenders | Can you meet a recognised security baseline? | Without certification, some opportunities may be harder to access. |
| Construction supply chains | Can you be trusted with project data, portals and shared systems? If you use external labour, our guide on whether contractors and subcontractors are in scope for Cyber Essentials may help. | Contractors and subcontractors are increasingly being asked for evidence. |
| Professional services | Can you protect client data, documents and financial information? | Cyber Essentials can support client assurance and proposal responses. |
| Finance and insurance clients | Do you have basic controls around access, devices and malware? | Certification can help remove friction during supplier onboarding. |
| Schools, charities and care providers | Can you handle sensitive data and systems responsibly? | It helps demonstrate that cyber security is being taken seriously. |
Cyber Essentials focuses on five practical areas.
Firewalls and internet gateways
Making sure devices and networks are not left unnecessarily exposed to the internet.
Secure configuration
Removing risky defaults, unnecessary accounts and settings that make compromise easier.
Access control
Ensuring people only have the access they need, with sensible account and admin controls.
Malware protection
Checking that devices have appropriate protection against malware and harmful files.
Security updates
Making sure operating systems, apps and devices are patched within required timescales.
Evidence and confidence
Turning “we think we are fine” into answers that stand up to certification and client checks.
We help you get certified without tying you to one delivery partner.
Black Swan can support Cyber Essentials through a range of trusted partners and certification routes. That means we can help you choose the right route for your business rather than forcing every organisation into the same package.
Some businesses just need guidance through the assessment. Others need help fixing gaps first. We will tell you which camp you are in before you waste time on a failed submission. If you are unsure what kit needs to be included, our guide to what devices are in scope for Cyber Essentials is a useful starting point.
How it usually works
- We review your current position and certification deadline.
- We identify gaps around MFA, devices, software, patching and admin access.
- We help you fix the issues that could block certification.
- We guide you through the questionnaire and evidence.
- We help you use the certification in tenders, supplier forms and client conversations.
Cyber Essentials is especially useful if your business supplies larger organisations.
A good fit if...
- You have been asked for Cyber Essentials by a client or tender.
- You supply larger companies, schools, councils, charities or regulated sectors.
- You handle client data, project files, personal information or financial records.
- You want a recognised trust signal before competitors catch up.
- You need clearer answers for supplier questionnaires.
Not the right fit if...
- You want a certificate but have no intention of fixing basic security gaps.
- You need ISO 27001-level assurance for a specific enterprise requirement.
- You are looking for a one-off tick box and will ignore renewal next year.
- You need Cyber Essentials Plus immediately and have not checked whether your basics are ready.
Which one do you need for supply chain work?
| Certification | What it involves | Best suited to |
|---|---|---|
| Cyber Essentials | A self-assessment certification covering key security controls. | Most small businesses, suppliers, contractors and organisations responding to basic assurance requests. |
| Cyber Essentials Plus | Includes technical testing by an external assessor to verify controls. | Higher-risk contracts, sensitive environments, defence/public sector work or clients asking for stronger assurance. |
Not sure which one your client expects?
Send us the wording from the tender or supplier form and we can help you understand what they are really asking for.
We make Cyber Essentials practical, not painful.
You do not need scare tactics or a mountain of jargon. You need someone who understands small businesses, schools, care providers, trades and professional firms, and can turn the certification process into a sensible plan.
- Vendor-neutral support using the right partner route for your needs.
- Plain English advice before, during and after certification.
- Support for businesses in Chesterfield, Derbyshire, Sheffield and across the UK.
- Help aligning Cyber Essentials with cyber insurance and supplier assurance.
- Options to strengthen protection with MFA, backups, EDR, email security and staff training.
Cyber Essentials supply chain FAQs
Why are clients asking suppliers for Cyber Essentials?
Clients want proof that suppliers have basic security controls in place. If a supplier is compromised, it can affect data, systems, operations and trust across the wider supply chain.
Is Cyber Essentials mandatory for all suppliers?
No, not for every supplier. It depends on the buyer, contract, sector and type of data or systems involved. It is common in public sector work and increasingly appears in private sector supplier assurance.
How long does Cyber Essentials certification take?
It depends on how ready your business is. Some organisations can move quickly. Others need to fix issues around MFA, patching, unsupported software, device control or admin accounts before submitting.
Can you help if we have already been asked for certification?
Yes. We can review the requirement, check your current position, identify blockers and help you move towards certification as quickly and sensibly as possible.
Do we need Cyber Essentials Plus?
Not always. Many supply chain requests ask for Cyber Essentials only. Cyber Essentials Plus may be needed for higher-risk work, public sector contracts, defence-related requirements or clients that want technical verification.
Can Black Swan work with our existing IT provider?
Yes. We can work alongside your IT provider to help gather information, fix gaps and guide the certification process without replacing your current support.
Stay ahead of cyber threats - Subscribe to the Black Swan newsletter
Protect your school or business with expert advice tailored to schools and small businesses. Get the latest cyber threat insights, practical data protection tips, and guidance on password security, ransomware prevention, and compliance – all delivered straight to your inbox.
Join the Black Swan community today and take charge of your cyber security.
Click here to preview an example newsletter and see what you’ll gain by subscribing!
Meet Kevin: Founder of Black Swan
Concerned about cyber security? Need advice or a tailor-made quote? Kevin is here to help you!
From actionable advice to helping you to see where you could be at risk, Kevin will help you to get your business on a path that is secure-by-design and ready for the unthinkable.
Ready to replace sleepless nights with peace of mind? It all starts with an informal chat!
Either schedule a call by selecting a suitable date and time on the calendar or by clicking the button below to send us a message.