What does each certification evidence?
Cyber Essentials, the NCSC-backed baseline, evidences foundational cyber hygiene: firewalls, secure configuration, access control, malware protection, and patching, verified by self-assessment or audited Plus level. ISO 27001 evidences a managed information security management system: broader, audited, and slower to obtain. A pack naming one does not accept the other by default; a pack naming either may accept demonstrated equivalence, decided by the buyer against the requirement, never assumed by the bidder. Check the current cyber policy note’s number and date per claim rather than citing a remembered PPN; policy-note currency is exactly what moves.
The certification, equivalence, evidence, and timing matrix
| Pack asks | Evidence that answers | Timing question |
|---|---|---|
| Cyber Essentials | Current certificate at the required level, or equivalence dossier the buyer accepts | Held at the pack’s date, or committable before award per participation timing |
| ISO 27001 | Current certificate covering the delivery scope; scope matters as much as validity | Recertification windows must not straddle the award date uncovered |
| Buyer-schedule controls | Control-by-control response with evidence pointers: policies, configs, audit trails | Operating at mobilisation, evidenced at evaluation; intentions score nothing |
Where does this sit in the wider evidence?
Inside participation evidence (what to prove and when) timed to the buyer’s request, with the insurance-timing logic applying by analogy: committed and evidenced beats unheld, but commitment has a price and a date. General compliance reading is on certifications, ISO, SOC 2 and DISP; data-handling questions that travel with security evidence are on data handling across AU, NZ and the UK. Certifications never substitute for the buyer’s contractual controls; the schedule’s clauses still need reading line by line.
What does this mean for the bid/no-bid call?
Unheld certification at a pack date that demands it held is a no-bid, unless equivalence the buyer will accept can be evidenced in time, decided with the buyer’s wording, not the room’s optimism. Committable cover is priced before the gate: certification cost, audit time, and control implementation all land before first revenue.