Cyber Security for Recruitment Agencies
Protect candidate data, client payments and your place on the preferred supplier list.
Your agency holds passports, right to work documents and bank details for thousands of people who will never work for you. That is what makes it worth attacking. We help UK recruitment firms close the gaps that cost real money, and evidence it to the clients who ask.
You Hold More Personal Data Than Firms Ten Times Your Size
A 40 person agency can be holding records on tens of thousands of candidates. Passports, addresses, employment history, and bank details submitted for payroll. Most of it sits in an ATS and in email, and a lot of it has been there for years because nobody ever set a rule for deleting it.
Research across 584 UK recruitment agencies, carried out by Atlas Cloud with APSCo in 2022 and 2023, found that 76 per cent had stolen passwords already circulating on the dark web, and that two in three had no phishing protection in place. Nothing since has made candidate data less valuable.
Where Recruitment Agencies Actually Get Hit
In 30 years working with recruitment companies, the same handful of problems cause almost all of the damage. None of them are exotic, and all of them are preventable.
What costs you money
- Invoice and payroll redirection, where a criminal reads your mailbox and sends your client new bank details at exactly the right moment
- Ransomware on the applicant tracking system, which stops placements and stops billing at the same time
- Candidate identity theft, because a passport scan is worth more per record than a card number
- Payroll fraud against temps and contractors, using bank detail changes that look routine
- Downtime in your busiest weeks, when consultants cannot reach candidates or clients
What costs you contracts
- A client security questionnaire you cannot answer without guessing
- No Cyber Essentials certificate when a preferred supplier list (PSL), framework or enterprise client asks for one
- A breach you have to report to the ICO within 72 hours of becoming aware of it
- A client asking what happened to the CVs they sent you, and no clear answer
- Losing a renewal to an agency that can show its certification
The two lists are connected. The same weak controls that let money out are the ones that fail a client audit.
Who This Is For
We work with UK recruitment firms that have grown past the point where one person can keep an eye on everything, and that now have clients asking questions about security. Typically 20 or more staff, and often between 50 and 250 users.
Agencies Asked for Security Evidence by Clients
A client, framework or insurer has sent you a questionnaire, and you would rather answer it properly than guess.
Agencies Holding Large Volumes of Candidate Data
You run an ATS and a candidate portal, you hold right to work documents, and you know retention has never really been dealt with.
Agencies Bidding for Public Sector or Enterprise Work
You need Cyber Essentials or Cyber Essentials Plus to get onto a supplier list, and you need it without derailing the quarter.
Why Recruitment Firms Work With Us
Francis West has spent 30 years working with recruitment companies, and has given over 500 talks on cyber security in the last six years. The conversation starts with how your agency actually runs, not with a product list.
We Speak Recruitment, Not Just Security:
We understand PSLs, temp payroll runs, candidate portals and the pressure of a placement deadline. The advice is built around that, not around a generic SME checklist.
We Start With What Is Already Exposed:
Before recommending anything, we look at what is already out there: a spoofable domain, credentials circulating on the dark web, and the gaps a client audit would find.
We Evidence It, Not Just Fix It:
Closing a gap is only half the job. You need something you can send to a client. Cyber Essentials and Cyber Essentials Plus give you exactly that.
We Stay With It After the Certificate:
Renewals, re-scoping when you grow or acquire, and the questions that come up when a new client sends a new questionnaire.
If that fits the way you want to work, we would be glad to have a conversation.
Cyber Essentials or Cyber Essentials Plus for a Recruitment Agency
Most agencies start with Cyber Essentials. You move to Cyber Essentials Plus when a client, a framework or a public sector contract asks for independent verification rather than your own assessment. Cyber Essentials is mandatory for certain public sector contracts under Procurement Policy Note 014, where it is relevant and proportionate to the work.
Cyber Essentials
For most agencies this is the right entry point. It covers the five technical controls set out by the National Cyber Security Centre: firewalls, secure configuration, security update management, user access control and malware protection.
Cyber Essentials Plus
CE Plus covers the same five controls, but a qualified assessor verifies them through hands-on testing. This is usually what larger clients and public sector buyers mean when they ask for verified certification.
| Cyber Essentials | Cyber Essentials Plus | |
|---|---|---|
| Assessment type | Self-assessment questionnaire (SAQ) | Independent technical audit |
| Evidence | Your answers, reviewed by an assessor | Hands-on testing on a sample of user devices |
| External vulnerability scan | Not required | Included |
| Time once submitted | ~24 hours to certificate via CyberSmart | ~2 weeks if controls match the SAQ |
| Cost level | Lower | Higher |
| Best for | First-time certification, most SMEs | Government suppliers, regulated sectors, higher-assurance use cases |
Start With a Free Score, Not a Sales Call
The Recruitment Agency Cyber Resilience Scorecard is 20 questions and takes about three minutes. It covers email security, candidate and client data, access controls, procurement readiness, incident response and AI-driven fraud. You get a personalised report with the priorities in order. No call required.
Read Next
Written for recruitment agencies, not for a general audience.
FAQs
Do recruitment agencies need Cyber Essentials?
There is no blanket legal requirement. In practice it is often a commercial one. Cyber Essentials is mandatory for certain public sector contracts under Procurement Policy Note 014, where it is relevant and proportionate to the contract, and a growing number of private clients and insurers now ask suppliers to hold it before adding them to a supplier list.
How quickly do we have to report a candidate data breach?
The ICO requires a notifiable personal data breach to be reported without undue delay, and not later than 72 hours after you become aware of it. Failing to notify when you should have can attract a penalty of up to 8.7 million pounds or 2 per cent of global turnover, whichever is higher. In most agencies the hard part is not the reporting, it is being able to say what was actually taken.
What size recruitment agency do you work with?
We focus on UK firms with 20 or more staff, and most of our work sits between 50 and 250 users. Below that, an agency can usually get a long way with the basics on its own. Above that, there is normally an internal security function already in place.
Will this stop invoice and payroll fraud on client payments?
No single control stops it, because the last step is a human one. What works is a combination: email authentication so your domain cannot be spoofed, multi-factor authentication so a mailbox cannot be quietly read, and a written rule that any bank detail change is confirmed by phone on a number you already held. The technology narrows the opportunity, the process closes it.
How long does Cyber Essentials take for a recruitment agency?
It depends on how much has to be fixed before you submit. Once your answers are submitted through the CyberSmart platform, certification typically comes back within about 24 hours. Cyber Essentials Plus takes around two weeks once your controls match what you declared, because an assessor tests them directly.
What is the first thing you look at?
What is already exposed. Whether your domain can be spoofed by anyone, whether staff credentials are already circulating on the dark web, and how long you have been holding candidate data you no longer need. Those three answers usually show where the real risk sits, before anyone talks about products.
Talk to Someone Who Knows Recruitment
Whether a client has just sent you a security questionnaire, you are worried about invoice fraud on a payroll run, or you simply want to know what is already exposed, we can help you take a practical next step. No pressure, and no jargon.
Contact Us
