Cyber Essentials Renewal: When to Start and What to Check

Check the date and the requirement

IASME says Cyber Essentials and Plus certificates expire after 12 months. Check the certificate itself, including the organisation name and scope, and confirm what your customer or insurer currently asks for.

Put the expiry date in a shared calendar with a named owner. Our planning suggestion is to start the review six to eight weeks ahead, with more time where systems need changing. That is a planning allowance, not a scheme rule or a guaranteed turnaround.

If you need Plus, discuss assessment availability at the start. Read our Plus preparation checklist alongside this one.

Make a list of changes

Ask the people responsible for your IT and business operations to review a single list:

This list is a preparation aid. Use the current question set and assessor guidance to establish the actual assessment scope.

Read the current questions

Download the current resources from IASME’s help and resources page. Compare your existing evidence with the questions you will be assessed against.

The April 2026 update applies requirements version 3.3 to assessment accounts created after 27 April 2026. In particular, review cloud services and MFA carefully. An old spreadsheet may omit changes that matter to your renewal.

Record uncertainty instead of guessing. “Our provider is checking this” is a useful internal task; it is not evidence that a requirement has been met.

Give each gap an owner

Use four columns: issue, responsible person, target date and evidence of completion. For example, a missing device record needs a completed inventory entry; an update task needs a check that the update actually installed.

Agree potentially disruptive changes with the people using the systems. Keep the review focused on work that is needed, and ask for a separate price where remediation is outside your support agreement.

Prepare the submission and ongoing checks

Have the responsible person check the answers against the actual setup before submission. Keep a copy of your answers, supporting records and the resulting certificate in a restricted business folder.

After renewal, keep ownership clear when new devices, staff or services are introduced. A certificate does not replace ongoing maintenance. Our requirements guide explains the main controls in plain English.

Ask for renewal help

Tell us the certificate you hold, its expiry date, your team size and any major changes. We can explain the preparation work, what the package includes and which fixes would need a separate agreement.

Ask about your Cyber Essentials renewal. Our cost guide separates assessment fees, supported packages and remediation so you can compare the work included.