Cyber Essentials: Renew on Time

Cyber Essentials (CE) and Cyber Essentials Plus (CE+) certificates last 12 months. Renewal needs a new assessment of current systems and practices.

Plan Your RenewalAll CE and CE+ Guides

Your Renewal Cycle

Name an owner and work back from each certificate’s expiry. CE and Plus may have different dates.

After Certification
Record applicant, level, scope, issue date, expiry and certificate link. Keep the assessment version and approved answers in authorised records.
Throughout the Year
Your organisation and provider maintain the five protections: review access, remove unnecessary settings, keep software supported and updated, and maintain firewall and malware protection. Address necessary fixes promptly.
Ahead of Expiry
Review changes, gaps and the buyer’s continuing requirement. Confirm the new account’s question set with the certification body. Allow time for fixes, applicant approval, assessment questions and Plus testing where needed.
On Reassessment
Submit accurate current answers with authorised approval. For Plus, arrange a fresh technical audit after the CE prerequisite, with matching scope and a body-confirmed completion date.
After the New Pass
Check the issued record, replace certificate links and follow the new badge instructions. Record the next expiry; payment or a booking alone does not renew certification.

Changes That Deserve an Earlier Check

These practical triggers call for review. Ask the body how a changed scope affects certification.

New People or Access
The IT owner checks starters, leavers, changed privileges and separate administrator accounts, including provider access.
New Devices or Software
The provider checks controls before work use, tracks support end dates and verifies required updates across affected devices.
Cloud or Sign-In Changes
Review new cloud services, providers and changes to extra sign-in checks (MFA). Confirm who manages accounts and verify their settings. A supplier’s certificate does not prove your setup.
Business Changes
The business owner compares the new entity, location or work with the certified boundary and asks the body whether a new assessment is needed.

Check What the Certificate Says

Use IASME’s Certificate Search by organisation name or certificate number. Check CE versus Plus, dates and the actual certificate’s scope; confirm assessment-version questions with the issuing body.

It Has Expired

There is a gap before a new certificate is issued.

What to Do

Do not claim current certification or keep displaying an expired mark. Arrange reassessment and have your contract owner check any buyer obligations. Renewal in progress is not a current certificate.

The Record Does Not Match

The name, level, scope or dates differ, or you cannot find the expected record.

What to Do

Ask the issuing body or IASME to verify the record. Use only the badge you are authorised to use for the actual certified level and scope. For other marketing uses, follow IASME’s instructions.

Fictional Example: A New Cloud App

A charity is renewing CE. Staff now use a cloud case-management app missing from last year’s answers, and nobody knows who controls sign-in.

Next Action
The internal IT owner asks the supplier who manages accounts and MFA, records the responsibilities and obtains evidence before approving answers.
What This Settles
The renewal answers cover current systems. The question stays open with a named owner until the charity verifies the settings.

Insurance Checks

Check eligibility and the actual policy separately from certification.

Eligibility
IASME’s included cover requires whole-organisation certification, UK or Crown Dependencies domicile, annual turnover under £20m, and opting in.
Policy and Dates
Check your Evidence of Insurance, cover dates, terms, exclusions and conditions. A certificate or badge alone does not prove cover.
Renewal or a Gap
Ask the broker how renewal or a gap affects your policy.

Continue With Your Next Question

Understand the Five ProtectionsSet Your ScopePrepare and Apply

Record the Date and the Owner

Find each certificate’s expiry, name the renewal owner and list changes since assessment. Hemanth can personally review readiness and evidence under an agreed advisory scope; your organisation and provider maintain controls and the independent body decides certification.

Find Your CertificateDiscuss Readiness With Hemanth