Cyber Essentials for Suppliers: Proven Safe Contract Terms
Most organisations ask for Cyber Essentials during the tender and never mention it again, which leaves the requirement sitting in a questionnaire with no expiry date, no evidence obligation and no consequence attached. This guide shows how to write it into the contract instead: which suppliers belong in scope and at what level, model clause wording for the certification obligation, how to define scope so a certificate for somewhere else cannot satisfy it, what evidence to demand and how to verify it against the register, how the obligation flows down to subcontractors, what happens when certification lapses mid-term, and a proportionate remedy ladder that runs from a rectification plan to termination without ending a workable relationship.
