Is Your Cyber Security Winning Or Losing You Contracts?

• Content
• Smart Buildings & Technology
• Is Your Cyber Security Winning Or Losing You Contracts?

12 November 2026

Facilities management has changed. The buildings you look after now run on networks, from building management systems and access control to CCTV, smart meters and remote monitoring. That connectivity brings efficiency, and it also brings risk.

The numbers back this up. In its Digital Risks in Buildings paper, RICS reported that 27% of facilities management respondents said their building had suffered a cyber attack in the previous 12 months, up from 16% the year before. RICS warned that UK businesses risk "sleepwalking into cyber attacks."

For FM providers there is a second, quieter risk: losing work you never knew you could have won.

Cyber Security A Tender Requirement

Central government's Procurement Policy Note 014 sets out when suppliers must hold Cyber Essentials or Cyber Essentials Plus. It applies to central government departments, their agencies and NHS bodies, and covers contracts where a supplier handles personal information, such as staff or citizen details, or works with government data and systems. Certification must be renewed every year for the life of the contract, and evidence is expected before the contract is awarded.

Many FM contracts touch exactly this kind of data. Think of visitor management, access control records, staff rotas, helpdesk systems and the contractor portals that link you to your client. Large private sector clients increasingly ask the same question of their supply chains, because they know attackers often get in through a trusted supplier.

If you cannot show the certificate, your bid may be marked non-compliant before anyone reads your service proposal.

Only 5% of UK businesses hold Cyber Essentials, according to the government's Cyber Security Breaches Survey 2025/26. Getting certified now puts you ahead of the field, rather than playing catch-up when a key client makes it mandatory.

The April 2026 Updates

Cyber Essentials was updated on 27 April 2026. Two changes matter most:

• Multi-factor authentication (MFA)
  Must be switched on for every cloud service that offers it. If it is available and not enabled, that is now an automatic fail.

• Critical and High-Risk Security Updates
  Must be applied within 14 days, including firmware and browser extensions. Missing this is also an automatic fail.

For Cyber Essentials Plus, the scope rules were also tightened, so more devices, including those that connect automatically, may now fall into testing. For FM teams with connected equipment across multiple sites, that is worth checking early.

Five Questions To Ask Before Your Next Tender

1. Do we hold Cyber Essentials, and when does it expire?
Put the renewal date in the diary at least three months ahead.

2. Which upcoming bids require it, or Cyber Essentials Plus?
Check the tender documents now, not in the final week.

3. Is MFA switched on for email, finance, CAFM and every other cloud system?
Under the new rules this is one of the easiest ways to fail.

4. Who patches our laptops, phones and building systems?
Can we prove it happens within 14 days?

5. Do we know every device on our network?
Old BMS controllers and unmanaged site PCs are often the weak spot.

If you answered "not sure" to any of these, you are not alone. Most organisations find gaps the first time they look properly, and it is far better to find them yourself than to have a client, or an attacker, find them for you.

A Business Advantage, Not A Box-Tick

Cyber Essentials will not stop every attack, but the National Cyber Security Centre designed it to protect against the most common ones. More importantly for FM leaders, it shows clients that you take their data and their buildings seriously. In a competitive tender, that confidence can be the difference between shortlisted and screened out.

Sources:
RICS, Digital Risks in Buildings (June 2025)
Cabinet Office, PPN 014 Cyber Essentials Scheme (February 2025)
IASME/NCSC Cyber Essentials Requirements v3.3 (April 2026)
DSIT and Home Office, Cyber Security Breaches Survey 2025/26

Picture: An image of someone working on a laptop with cyber security symbols floating above their typing hands.

Article written by Security Everywhere | Published 12 November 2026

Share

---

---

Related Articles

---