Why Scottish buyers ask for Cyber Essentials
Cyber Essentials is a UK-wide scheme, but the pressure to hold it comes from the organisations you sell to. In Scotland that pressure is well organised.
Public sector procurement
The Scottish Government's supplier cyber security guidance asks public bodies to assess cyber risk in every procurement and to require Cyber Essentials, or Plus for higher-risk contracts, from suppliers. If you bid through Public Contracts Scotland, expect the question.
NHS Scotland, councils and universities
Health boards, the 32 local authorities and the universities all run supplier assurance questionnaires. A current certificate answers most of the technical section in one line and keeps you on the approved list.
Charities and the third sector
OSCR-registered charities are asked for Cyber Essentials by funders, by Scottish Government grant schemes and by the local authorities that commission their services. It also protects the personal data that makes charities a target.
Supply chains and insurers
Larger Scottish firms in construction, energy, finance and professional services increasingly require it from their subcontractors, and cyber insurers ask about it on the proposal form.
Scotland-wide, all done remotely
The self-assessment and the Cyber Essentials Plus audit are both carried out remotely: the assessment through the certification portal, the Plus audit over a screen-sharing session with a member of your team at each sampled device. That means the same service and the same price whether you are in Livingston or Lerwick.
Where our clients are
Two levels, one process
Cyber Essentials
A verified self-assessment against the five controls. Fixed fee set by IASME, based on your organisation size. Most prepared organisations certify within two weeks.
£320 to £600 + VATCyber Essentials in detail →
Cyber Essentials Plus
The same controls, tested by an assessor on your real systems within three months of the Cyber Essentials certificate. Carried out remotely.
From £1,050 + VATWhat the Plus audit tests →
- 1
Scoping call
Twenty minutes to agree what is in scope and which contract or deadline is driving it.
- 2
Gap analysis
A plain-English list of what would fail today, with the fixes, in priority order.
- 3
Remediation
Fix the gaps yourself, with your existing IT provider, or have us do it.
- 4
Certification
We verify the self-assessment and issue the certificate. Plus audit booked inside the window if you need it.
Ready to get certified?
Tell us which contract, insurer or customer is asking, and when they need it by. We will tell you honestly how far away you are.
Cyber Essentials in Scotland: common questions
Is Cyber Essentials required for Scottish public sector contracts?
Not by law, but in practice very often. Scottish Government guidance asks public bodies to assess cyber risk in each procurement and to require Cyber Essentials or Cyber Essentials Plus from suppliers where the risk justifies it. Contracts that involve personal data, network access or critical services usually specify it, and having the certificate in hand before the tender saves weeks.
Do you need to visit us for the Cyber Essentials Plus audit?
No. The Plus audit is carried out remotely over a screen-sharing session, with a member of your team at each device the assessor samples. It works exactly the same whether you are in Edinburgh, Glasgow, Dundee or Shetland, and there is no travel time or cost.
Does Cyber Essentials cost more in Scotland?
No. The Cyber Essentials fee is fixed by IASME across the UK: £320 for micro organisations, £440 for small, £500 for medium and £600 for large, excluding VAT. Our Cyber Essentials Plus audit starts from £1,050 excluding VAT, with no travel charges because the audit is remote.
We already have an IT provider. Can you still certify us?
Yes. Many of the organisations we certify have their own IT team or another support company. We run the assessment and the Plus audit independently and give your provider the list of anything that needs fixing. Being certified by someone other than the firm that runs your IT is often what a buyer prefers.
Do Scottish charities need Cyber Essentials?
Increasingly, yes. Funders, Scottish Government grant schemes and the councils that commission charity services ask for it, and the free cyber liability insurance that comes with certification for small organisations is worth having on its own. We work with OSCR-registered charities across Scotland and can advise on the discounted Microsoft 365 licensing that makes the controls easier to meet.