Certificate validity and renewal

A Cyber Essentials certificate is valid for 12 months from the date it is issued. There is no automatic renewal: to stay certified you complete a fresh assessment before the certificate lapses. The renewal is a full assessment, marked against whichever question set is current when you create the renewal account, not the one you passed last year.

What "valid" means

The certificate is a statement that, on the day it was issued, your answers showed the five controls were in place. It does not guarantee your systems stayed that way, so the controls need to be kept up for the whole year. Customers checking your status can look you up on IASME's register, and the digital badge on your website stops displaying once the certificate expires.

Why renewal is a full assessment

The requirements change every year. A renewal in 2026 or later is marked against Requirements v3.3 and the Danzell question set, even if last year's certificate was issued under Willow. Things that passed last year can fail now, for example:

• an operating system or application that has reached end of support since your last assessment, such as Windows 10 without Extended Security Updates
• a cloud service that offers MFA but does not have it switched on, which is now an automatic fail
• critical or high-risk updates that took longer than 14 days to install, which is also an automatic fail under Danzell
• new cloud services, devices, offices or staff that were not in scope last time

See What changed in Danzell and v3.3.

When to start

Start early enough that you can pass before the old certificate lapses, allowing for preparation, marking and a possible resubmission.

• Marking normally takes up to 3 working days, and each resubmission is reviewed in the same time.
• If anything is queried or fails, you have 2 working days to respond when certifying directly with IASME, or until the end of the six-month assessment window with Apexward Group.
• If you find gaps during preparation, such as unsupported devices to replace, you may need weeks rather than days.

A sensible approach is to begin preparing two to three months before expiry and submit with a few weeks to spare. Your new certificate will carry its own issue date and run for 12 months from then.

If your certificate lapses

If you miss the date, you are simply not certified until you pass a new assessment. The process is the same as the first time. The practical consequences can matter more:

• contracts or tenders that require a current certificate may be affected
• the digital badge stops showing
• the included cyber insurance is tied to certification, so check your policy documents for the cover dates

Renewing Cyber Essentials Plus

Cyber Essentials Plus also lasts 12 months, but it always depends on a Cyber Essentials certificate with the same scope. To renew Plus you:

1. Renew Cyber Essentials first.
2. Complete the Plus audit within three months of the new Cyber Essentials certificate. This window cannot be extended.

Plan both together, and book the audit before you submit the self-assessment. See The three-month window for Plus.

Renewal checklist

• Note the issue date on your current certificate and set a reminder three months before
• Re-check scope: new sites, staff, devices and cloud services
• Check every operating system and application is still vendor-supported
• Confirm MFA on every cloud service, including new ones
• Review update records against the 14-day rule
• Remove leavers and unused accounts
• Make sure the person who will sign the declaration has time to review the answers

Keeping compliant between renewals

The easiest renewal is one where nothing has drifted. Keep automatic updates on, review accounts when people join or leave, and add MFA as soon as a new cloud service is adopted. A quick review every few months keeps renewal straightforward.

To check where you stand before renewing, use the readiness checker.