NHS Trust contract renewal naming Cyber Essentials Plus as a condition? Framework deadline this Friday?
Net Sec Group is an IASME Certification Body. We have delivered CE Plus from a cold-start enquiry to certificate-on-the-wall inside one working week for Welsh NHS suppliers. Same playbook applies to your contract.
A supplier to the Welsh NHS contacted us on a Tuesday morning. The Trust's procurement team had named Cyber Essentials Plus as a condition of contract renewal. The contract was due to be signed the following Monday, with the certificate expected in hand before Friday close of business. The supplier had Cyber Essentials Basic. They did not have CE Plus.
By Tuesday afternoon we had walked the estate, scoped the controls, and identified the gaps. By Wednesday end-of-day, the gaps were closed: missing patches applied, account-management policies documented, the specific control evidence the assessor would ask for already collected. Thursday was the formal CE Plus assessment day. Friday morning the certificate was issued.
The contract was signed on the Monday. Renewals are now handled annually under the Cyber 365 programme so the next deadline does not start with a Tuesday-morning panic.
The recurring pattern across NHS framework renewals: procurement raises Cyber Essentials Plus as a condition midway through the renewal cycle, the supplier has Basic but not Plus, and the deadline arrives before the supplier's IT team can engage a separate assessor. The conventional CE+ booking timeline is 3 to 5 weeks. The contract timeline is 5 working days.
We have closed that gap before. The conditions that make it possible are below.
NetSec scopes, remediates, assesses, and issues. No second supplier to schedule, no handover delay between consultancy and assessor.
The first day of a deadline engagement is always the estate walk. We map devices, identity layer, SaaS estate, firewalls, and supplier surface against the five Cyber Essentials controls.
As an IASME Certification Body the same operator that named the gaps also runs the assessment. The evidence the assessor asks for is the evidence we already collected during remediation.
This is the day-by-day shape of a NHS supplier engagement that has to land by Friday. Not every engagement runs this fast (it depends on the gap list and on your IT team's availability) but this is the template.
30-minute call. We confirm scope, deadline, and CE level. Engagement letter signed same day. Daniel as lead assessor confirmed for the assessment slot.
Remote or on-site walk of devices, identity, SaaS, firewalls, supplier list, patching cadence. Written gap list out by end of day, mapped to the five Cyber Essentials controls.
Patching applied, MFA enrolled, account hygiene, MDM rollout where missing, policy authoring. We work alongside your IT team or directly with your suppliers under a delegated change window.
Hands-on technical verification on a sampled set of devices. Internal vulnerability scan, malware test, account-management spot-check. Same day write-up.
CE Plus certificate issued in your organisation's name, valid for 12 months. PDF and digital badge in your inbox before Friday close. Procurement team can sign the contract on Monday.
We do not promise 5 days where the gap list cannot close in 5 days. The honest version of that conversation happens on the scoping call, not after the engagement letter is signed.
For situations like these we usually run the engagement across 2 to 3 weeks rather than 5 days, and tell you straight on the scoping call.
Yes. The certificate carries the same scheme rules and the same 12-month validity regardless of how quickly the engagement ran. NHS procurement teams check the IASME registry for current certificate status, not the engagement length. A CE Plus certificate issued under a 5-day engagement is identical in standing to one issued under a 5-week engagement.
Sometimes. The Welsh NHS supplier above was a 4-working-day engagement (Tuesday to Friday). Anything tighter than that depends on the gap list being almost empty at the start. The scoping call is where we tell you whether your estate can land it.
The CE Plus certificate price is the same as the published booking page figure for your organisation size. The remediation work that compresses the timeline scales with the gap list and is scoped on the call. Most 5-day engagements add a half-day to one full day of consultancy on top of the CE Plus price. Try the cost calculator for a back-of-envelope figure.
Across the UK. The Welsh NHS case is the documented one. The same playbook works for English NHS Trusts, Scottish Health Boards, and any framework where Cyber Essentials Plus shows up as a contract condition with a tight deadline. See locations for our delivery footprint.
Most NHS-supplier clients move onto the CE+ Assured Programme or Cyber 365 after the first engagement so the next renewal is handled on a rolling basis rather than another deadline-driven sprint.
Send us the date the contract needs the certificate by, the size of your estate, and the CE level you need. We come back inside 4 hours with whether 5 days is realistic and what the engagement looks like.
Want the broader hands-off path? See Hands-Off Cyber Essentials.