Cyber Essentials renewal: what to do before your certificate expires

A Cyber Essentials certificate does not renew itself. It lasts 12 months, and keeping it means passing a fresh assessment each year. Customers, councils and insurers often want to see a current certificate, so the date matters.

This guide explains what renewal involves, when to start, what changed from April 2026, and how to avoid a gap.

The short version

• Renewal is a new assessment, not a form that confirms last year's answers.
• Start 6 to 8 weeks before your expiry date. That is our suggestion, it leaves room to fix anything you find.
• Once the date passes, the old certificate is no longer valid. You cannot show it to a customer or in a tender.
• If you hold Cyber Essentials Plus, the technical test is repeated each year too.

What renewal involves

Think of it as a check on the same five areas you were assessed on before:

1. 1Firewalls: boundary firewalls or equivalent settings on every device.
2. 2Secure configuration: unused software and accounts removed, sensible defaults changed.
3. 3Security update management: supported software, with critical and high-risk security updates applied within 14 days of release.
4. 4User access control: people have only the access they need, and administrator accounts are used only when required.
5. 5Malware protection: working protection on devices that need it.

In practice that means:

• Re-confirm your scope: which people, devices, cloud services and locations are covered.
• Update your list of devices and software. This is where most surprises appear, a laptop nobody remembered or an old tool still running.
• Fix anything that no longer meets the requirements.
• Complete the questionnaire. A director or board member signs it off.

What changed from April 2026

IASME, the body that runs the scheme, published a new question set called Danzell in February 2026. It applies to assessments opened after 26 April 2026. Businesses that opened their assessment before that date had six months to finish under the old rules, so from now on you should expect the new version. Three changes catch businesses out:

• Cloud services are always in scope. Microsoft 365, Google Workspace and similar services cannot be left out of your assessment.
• Multi-factor authentication is mandatory wherever a cloud service offers it. That includes free and included options, not just paid ones. If it is available and you have not switched it on, the assessment fails automatically.
• Patching is an automatic fail point. If critical or high-risk updates for your routers or your applications are not installed within 14 days of release, you fail, whatever else you score.

Backups also get more prominence. IASME has moved the backup guidance earlier in the requirements to stress that it helps you recover quickly after an incident.

If you hold Cyber Essentials Plus, there is one more change. If the update check fails, the retest covers your original sample plus a new random sample of devices. A second failure revokes the self-assessment certificate. Your self-assessment also has to be finished and unchanged before the Plus testing starts, so you cannot tweak your answers based on what the tester finds.

If you were certified before April 2026, read the current requirements before you start. Do not rely on how last year went.

Why renewals get delayed

These are the usual causes:

• Devices or software that nobody had on the list.
• Operating systems or applications that have reached end of life.
• Security updates older than 14 days.
• Shared or admin accounts used for everyday work.
• MFA missing on one or two cloud services.
• Nobody senior available to sign off the questionnaire.

Most of these take days to fix, not months. The problem is finding them in the last week.

What happens if it lapses

You cannot present an expired certificate. If a customer, council or insurer asks for a current one at the point of tender, award or renewal of their own contract, a gap can cost you the contract or delay a payment. You would need a new assessment, and the new certificate only starts when it is issued.

If a tender deadline is coming, tell your certification body early. They can often help you plan the timing.

How to make next year easier

• Keep a live list of devices and software, updated whenever someone joins or leaves.
• Check for missing updates monthly, not once a year.
• Review admin accounts and cloud MFA each quarter.
• Diarise the renewal date and the date you will start.

This is what we build into our managed service. Instead of a rush before the certificate expires, we check your devices and vulnerabilities all year, so renewal is a short review and not a clean-up.

Common questions

Can I renew early? Often you can start before the expiry date, but the rules on how the new certificate dates run are set by your certification body. Ask them before you begin.

Do I need Cyber Essentials Plus every year? If you hold Plus, it is renewed each year with the basic certification. Whether you need Plus at all depends on who you sell to.

How long does renewal take? For a small business with tidy devices it can be a matter of days. The time is driven by what you need to fix, not by the form.

Who signs it off? A director or board member, who confirms they are responsible for keeping the controls in place.

Need a second pair of eyes?

If your renewal is coming up and you would like someone to look at it with you, book a short call. We will tell you what we would check first, and whether you need any help at all.