Home / Insights / Cyber Essentials for Construction Tenders: What Contractors Need to Know

Cyber Essentials for Construction Tenders: What Contractors Need to Know

For many construction firms, Cyber Essentials first comes up in a pre-qualification questionnaire, often with a deadline attached. A tender asks whether you hold the certificate, and suddenly a cyber security scheme becomes a commercial question. Cyber Essentials for construction businesses is less about ticking a box and more about getting a handful of basic controls right across offices, site cabins and a mobile workforce.

This article explains what the scheme is, why it shows up in tenders, and how contractors can prepare in good time.

What Cyber Essentials is

Cyber Essentials is a UK government-backed certification scheme developed by the National Cyber Security Centre (NCSC). The NCSC describes it as the minimum standard of cyber security recommended by the government for organisations of all sizes. It is built around five technical controls:

• Firewalls between your devices and the internet.
• Secure configuration, so computers and devices are set up to reduce the ways in.
• Security update management, keeping software and devices patched.
• User access control, so people only have the access they need.
• Malware protection on the devices that need it.

There are two levels. Cyber Essentials is a verified self-assessment: your answers are signed off by a board member or equivalent and then marked by an assessor. Cyber Essentials Plus covers the same five controls but adds independent technical testing to check they work in practice. Certification is handled through IASME, the NCSC’s delivery partner, and anyone can check whether a supplier holds a current certificate using IASME’s public certificate search.

Why it appears in construction tenders

In 2014 the Cabinet Office made Cyber Essentials mandatory for central government contracts advertised after 1 October 2014 that involve handling personal information and providing certain ICT products and services. Beyond that, the NCSC notes that a growing number of organisations require suppliers to be certified before they can bid for work.

For contractors, the reason is easy to see. Main contractors, clients and public bodies share drawings, site data, personal details of workers and payment information across long supply chains. A weak link anywhere in that chain is a risk to everyone, so asking suppliers for a recognised baseline is a simple way to set expectations. The exact requirement varies by client and contract, so always read what each tender actually asks for, including whether it specifies the Plus level.

The construction-specific challenges

The five controls sound straightforward, but construction has some features that make them harder to apply consistently:

• Devices spread across sites. Laptops in site cabins, tablets used for snagging and inspections, and shared PCs can easily fall behind on updates or drift from standard settings.
• Temporary site connectivity. 4G and 5G routers, temporary broadband and site Wi-Fi all need proper firewall settings and changed default passwords.
• A changing workforce. Subcontractors, agency staff and project teams come and go. Without a reliable process for joiners, movers and leavers, old accounts and shared logins build up.
• Personal phones. Staff often use their own phones for email and project apps. The scheme’s requirements include how bring-your-own devices that access company data are handled, so you need a clear policy.
• Cloud project tools. Document management, common data environments and collaboration platforms hold sensitive project information, so they need strong sign-in protection and properly managed admin accounts.

How to prepare without the panic

1. Start before the tender. Preparing under deadline pressure leads to rushed answers. Treat certification as a planned project.
2. Know what you have. An up-to-date IT asset register covering office and site devices makes it far easier to decide what is in scope and to prove it is managed.
3. Read the free materials. The NCSC and IASME publish the question set, the requirements document and a free readiness tool, so you can see exactly what will be asked before you pay for anything.
4. Fix the basics first. Patching, removing unused accounts, changing default passwords on site routers and turning on multi-factor authentication for cloud services usually make the biggest difference.
5. Decide on scope carefully. Certifying the whole organisation is usually simplest to explain to clients. If you do limit scope, make sure it still covers the systems the tender cares about.
6. Plan for renewal. Certificates are renewed every year, so build the checks into normal IT routines rather than starting from scratch each time.

Takeaway

Cyber Essentials is increasingly part of winning work, not just an IT exercise. For construction firms, the hard part is applying five sensible controls consistently across offices, sites, subcontractors and personal devices. Start early, use the free NCSC and IASME resources, and treat the certificate as evidence of good everyday habits rather than a once-a-year scramble.

If you’d like help getting ready for Cyber Essentials or keeping site and office IT consistent, KPCR’s managed IT services and IT consultancy can help. Get in touch for a no-pressure chat.

External references: NCSC Cyber Essentials overview; Cabinet Office Procurement Policy Note 09/14.