A customer asking for Cyber Essentials wants your own IT estate certified, and with contractors the work is accounts, not laptops. Under NCSC's v3.3 (April 2026), contractors' own devices are out of scope, but every account you own that they use is in, with MFA, and so is any device you lend them. Agree the scope with your Certification Body, the assessor that certifies you, before applying.
What does the customer actually require?
Read their wording first. Cyber Essentials and Cyber Essentials Plus cover the same five controls. Plus adds independent testing of your systems. Ask the customer in writing which level the contract or tender needs, because that decides everything downstream.
No statute makes the certificate mandatory. NCSC's overview says a growing number of organisations require suppliers to hold it to bid for work, so for you it's a contract term, not a legal duty. For the legal duties that do apply, see hiring developers in Europe: legal requirements for 2026.
Are contractors in scope for Cyber Essentials?
The default is the whole estate. The requirements document says the assessment should cover all your IT infrastructure, and a smaller scope has to be agreed with the Certification Body before assessment. A scope that leaves out end-user devices isn't acceptable, and since v3.3 cloud services can't be excluded either.
Accounts: always in
Every account your organisation owns is in scope, even when a supplier, contractor or managed service provider uses it. A contractor with a GitHub or Microsoft 365 login from you is inside your assessment, whatever laptop they sit at. Authentication to cloud services must always use MFA, and the account-control requirements cover third-party accounts too. This is the part that costs you work.
Devices: ownership decides
Table 2 in the same document sorts devices by who owns them.
| Role | Owned by your organisation | Owned by a third party | BYOD |
|---|---|---|---|
| Employee | In scope | N/A | In scope |
| Third party contractor | In scope | Out of scope | Out of scope |
A laptop you lend a contractor is yours, so it's in scope. We'd issue managed laptops to anyone who needs production-admin access, which takes the question off the table for the people who matter most.
The table doesn't define "third party contractor", and it doesn't say whether a contractor who works full-time in your team counts as one. If yours work like staff, ask your Certification Body in writing: "Do our contract engineers fall under third party contractor in Table 2?" Until you have the answer, treat their laptops as in scope.
What you still owe for out-of-scope devices
Out of scope doesn't mean unchecked. You remain responsible for confirming that devices touching your services and data are configured correctly, and the method is yours to choose. A signed device policy plus a periodic check (a screenshot of patch status and disk encryption) is a reasonable answer. Write it down before the assessor asks.
Why does the IASME guide say contractor devices are in scope?
IASME's contractors article, dated 31 January 2024, says contractors' devices are in scope, while NCSC's April 2026 table says they're out. We'd follow the newer NCSC requirements document. The old guide still earns a read for its three options: the contractor holds their own certificate, you bring their devices and accounts in as BYOD, or you issue managed devices, which it calls often the simplest solution.
Worked example: 14 people, 5 contractors
A startup has 14 people: 9 employees on company laptops, and 5 contract engineers on their own laptops, 2 in Poland and 3 in the UK. Everyone uses company-owned Microsoft 365 and GitHub accounts.
- In scope: the 9 laptops, all 14 company-owned accounts with MFA on the cloud services, and the cloud services themselves.
- Out of scope: the 5 contractor laptops, but you owe a configuration check on them.
What if some engineers are outside the UK?
Version 3.3 has no country rule. The only location it mentions is that your scope boundary must name the business unit, the network boundary and the physical location. Ownership and role set the scope, so the two Polish contractors in the example are treated like the three UK ones.
What does it cost?
NCSC's overview lists the standard certificate from GBP 320 plus VAT. Ask your Certification Body for the fee at your headcount. Cyber Essentials Plus is quoted according to the size and complexity of your network, so ask for a quote against your real setup.
What do you change before you apply?
Four changes cover most of the work:
- Put MFA on every cloud service, including accounts contractors use.
- Apply critical and high-severity fixes (CVSS v3 score of 7 or more) within 14 days.
- Remove software that's no longer supported.
- Write the device policy and the check routine for contractors on their own laptops.
Where does Cyber Essentials stop?
It's a baseline for the UK market, not a trust report. It doesn't replace a SOC 2 report, which enterprise buyers ask for in a different shape, as covered in SOC 2 Type 1 vs Type 2 when an enterprise customer asks. It isn't an information security management system either, which is what ISO 27001 for startups covers. And it won't answer a customer's own questionnaire.
What this means for the customer deal
The decision isn't whether to buy a certificate. It's who owns the scope, and how contractors get access from now on.
Without a CISO, give the scope decision to one named person, usually the CTO, and make the Certification Body conversation their first task. Then change how access is granted: every new contractor gets a company-owned account with MFA, and the laptop question is settled before they start.
Confirm the level in writing with the customer before you apply. If the same customer also sends a security review, answering the contractor rows in a security questionnaire is the next piece of work. The rest of our compliance coverage is in EU engineering hiring compliance: contracts, IP and GDPR.
FAQ
Is Cyber Essentials mandatory?
No statute requires it. A contract or tender decides, and NCSC notes a growing number of organisations require suppliers to be certified to bid for work.
Do contractors need their own Cyber Essentials certificate?
Not under NCSC's scope table, which puts contractors' own devices out of scope. Having the contractor hold their own certificate is one of IASME's older options for controlling the risk, and it's optional.
How much does Cyber Essentials cost?
NCSC lists the standard certificate from GBP 320 plus VAT. Cyber Essentials Plus is quoted according to the size and complexity of your network.
What is a Certification Body?
The organisation that assesses your application and certifies you. Agree your scope boundary with it before you apply.
Can overseas engineers be included?
Version 3.3 has no country rule. Ownership and role set the scope, and the boundary you submit names the physical location.