Cyber Essentials guide

Renewing Cyber Essentials

A Cyber Essentials certificate lasts 12 months. There is no light‑touch renewal: each year you buy a new assessment, answer the current question set again, and an assessor marks it as if it were your first. This guide sets out how renewal works, which question set you will meet, what a lapsed certificate costs you, how Cyber Essentials Plus fits in, and a timeline that gets the new certificate issued before the old one expires.

Last checked 9 November 2026 against IASME's Cyber Essentials pages, its frequently asked questions and its insurance page, the NCSC's Requirements for IT Infrastructure v3.3 and Cyber Essentials Plus Test Specification v3.2, Procurement Policy Note 014 and Defence Standard 05-138 Issue 4. This is general information. Tagnator is not part of, approved by or endorsed by the NCSC or IASME.

1. The short answer

2. How renewal works

IASME emails a reminder "roughly a month before you have to be recertified". A month is enough to answer the questions, but not always enough to fix what they uncover, so put your own reminder in the diary for three months before the expiry date on your certificate.

To renew, you buy a new assessment from IASME or through a certification body, at the price for your number of employees: £320 plus VAT for 0 to 9, £440 for 10 to 49, £500 for 50 to 249 and £600 for 250 or more. The 75% First Step Fund discount does not help most renewals: it is for UK micro and SME organisations that have "not held Cyber Essentials in the last four years", bought by 31 March 2027.

Once you have paid you get access to the assessment portal. IASME gives you "6 months from the date of application to complete and submit your assessment"; after that "your account may be closed and you would have to apply and pay again". Buying early is therefore safe, as long as you submit within the six months.

Answers do not carry over. IASME's FAQ is direct: "You do need to enter all the information each time you certify. This serves as an annual review of your cyber security." One question in section A1 asks whether this is a renewal or a first application; the rest of the set is the same for both. A board member or the owner signs the declaration again.

Marking runs to the same timetable as a first assessment. IASME says most assessors "aim to get the results back to you within 3 days". If you are not successful you have 2 working days to fix the issues and resubmit, the assessor aims to remark within another 3 days, and "if you still fail after these two days you will have to reapply and pay the assessment fee again". Allow two weeks from submission to certificate if anything needs correcting.

3. Which question set you renew on

IASME and the NCSC update the scheme from time to time, and the version that applies depends on when you bought the assessment, not on when you first certified. The current question set is Danzell (version 16), used for every assessment bought from 27 April 2026, with version 3.3 of the NCSC's Requirements for IT Infrastructure. The set before it, Willow, went with Requirements v3.2 and was introduced in April 2025.

Assessments started on Willow before 27 April 2026 were given six months to finish, so that window has now closed. Anyone renewing from now on answers Danzell, even if last year's answers were written for Willow. Do not copy last year's answers across without reading each question again: numbering, wording and marking have changed.

4. What changed in Danzell and v3.3

The five technical controls are the same: firewalls, secure configuration, security update management, user access control and malware protection. What changed is the detail of the requirements and how strictly some answers are marked. The NCSC lists these changes in "What's new in this version" of Requirements v3.3:

In the question set, Danzell marks five answers as automatic fails, whatever else you answer: the two 14‑day update questions (A6.4 for operating systems and router and firewall firmware, A6.5 for applications) and three questions on multi‑factor authentication for cloud services (A7.15 to A7.17). LRQA, a certification body, described the update questions as new questions that "will also result in an automatic failure if not compliant", and MFA for cloud services as "now a strict requirement". Danzell also asks more detailed questions about scope. Our guide to the Danzell question set goes through each section and quotes the automatic‑fail wording.

For a renewal, the practical effect is that a device that misses an update for three weeks, or one cloud service where a single user has no MFA, now fails the whole assessment. If last year's answers relied on "mostly", fix the gaps before you buy.

5. What a lapse costs you

Your listing. Customers check suppliers in IASME's certificate search. IASME says: "We remove companies from our 'certified organisations' list if they have not been certified in the past year." A buyer who checks the day after your expiry date sees no certificate.

Your insurance. Organisations that certify their whole organisation, with their head office in the UK or Crown Dependencies and a turnover under £20m, get cyber insurance with the certificate. IASME's insurance page says the policy "starts from your certification and lasts 12 months", is "connected to your Cyber Essentials Certification and cannot be renewed on its own", and that "to maintain cover, you will need to renew your Certification or take a separate stand‑alone cyber insurance policy". A gap between certificates is a gap in cover.

Your contracts. Procurement Policy Note 014 tells central government and NHS buyers to require Cyber Essentials or Cyber Essentials Plus for contracts that handle personal data or OFFICIAL information, "renewed annually by the supplier for the duration of the contract". For defence work, Defence Standard 05-138 control 0001 says the supplier shall "commit to maintaining this for the duration of the contract". A lapsed certificate can put you in breach of a contract you already hold, not only out of the next tender.

Your money. A lapse does not save the fee: you still pay full price to certify again, and any time spent without a certificate is time without the listing and the cover. Waiting four years to qualify for the first‑certificate discount would cost far more in lost contracts than the £240 to £375 it saves.

6. Renewing Cyber Essentials Plus

Cyber Essentials Plus also expires after 12 months, and it sits on top of a current Cyber Essentials certificate. The Plus test specification requires the assessor to verify "that the scope of the Cyber Essentials Plus assessment matches the scope described by the valid Cyber Essentials self‑assessment certificate". So the order each year is: renew Cyber Essentials first, then the Plus audit.

Timing matters. IASME's FAQ says that if you achieved Cyber Essentials "less than 3 months before certifying to Cyber Essentials Plus you will not need to repeat the self‑assessment questions stage". Book the audit with your certification body when you buy the basic renewal, so that it falls inside those three months. If testing cannot finish on the day, the specification lets IASME, as the delivery partner, allow tests to be deferred, and recommends no more than one month. Our guide to Cyber Essentials and Cyber Essentials Plus sets out the five Plus test cases.

7. A renewal timeline

WhenWhat to do
12 weeks before expiryDownload the current question set from IASME and read the NCSC's "What's new" list. Update your asset list: new devices, new cloud services, staff who joined or left.
10 to 7 weeks beforeFix the gaps: devices on unsupported operating systems, updates that take more than 14 days, cloud services without MFA for every user and every administrator, old accounts.
6 weeks beforeDraft every answer offline against the new set. Get the owner or a director to read them.
4 to 3 weeks beforeIASME's reminder arrives. Buy the assessment, enter the answers and submit. Plus: book the audit now.
The last 3 weeksAnswer the assessor's feedback within 2 working days if anything fails. Save the new certificate and insurance documents, and send them to any customer who asks for them each year.

8. What to keep for next year

IASME asks you to "keep a copy of your answers when you submit so you can refer to them when you recertify the following year". Keep more than that: the asset list as it stood on the day you submitted, the dated firewall rules review, the account approval records for joiners and leavers, the admin account list with its review date, and a screenshot of each cloud service's MFA setting. These are the records a renewal asks you to describe again, and the evidence a Plus assessor or a customer will ask to see.

Our Cyber Essentials Preparation Kit gives you that set: the asset register, a walkthrough of every Danzell question number with the evidence to keep, and the policies and approval forms behind the processes the questions ask you to describe. It works for a first assessment and for each renewal.

Related guides: Cyber Essentials for small UK businesses · The Cyber Essentials question set, section by section · Cyber Essentials or Cyber Essentials Plus?

9. Sources