Can I 'extend' a lapsed Cyber Essentials certificate?

No. Once expired, you submit a fresh assessment. There's no grace period or back-dating; the new certificate runs from the date it's issued.

How quickly can I be back to a valid certificate?

If your environment is in good shape and you pre-check before submitting, 3–5 working days end-to-end is realistic. Lapsed for several months? Plan 2–3 weeks to deal with environment drift first.

Does a lapse invalidate my cyber insurance?

If your insurance was tied to active Cyber Essentials (including the £25,000 IASME benefit), the cover ends with the certificate. Re-certify quickly to restore it.

Will tender bids reject me while I'm lapsed?

Yes – any bid that asks for current Cyber Essentials as a hard requirement will treat 'expired' as non-compliant. The faster route is usually a fresh assessment, not arguing the deadline.

Is the cost the same as a renewal?

Effectively yes – a new assessment carries the standard certification fee for your IASME band. Some assessors waive their advisory time if you're a returning client; the IASME fee itself doesn't change.

Cyber Essentials Lapsed: How to Reinstate Quickly

Why lapsing happens

The most common reason isn't disorganisation – it's a calendar gap. Cyber Essentials runs in 12-month cycles. The renewal email lands a month before expiry; if the original owner has left, or it routes to a shared inbox, it's easy to miss. By the time someone notices, the certificate is gone.

What "lapsed" actually means

You can no longer claim active certification.
The £25,000 cyber insurance benefit (for SMEs that took it through a UK accreditation body) ends with the certificate.
Tender bids that ask for current Cyber Essentials become non-compliant immediately.
You can't "extend" or "reactivate" – you have to submit a new assessment.

The fastest route back

Day 1: get the questionnaire reopened

Contact a UK certification body (any IASME-licensed assessor). Pay the assessment fee. The portal opens immediately and you can begin the question set the same day.

Days 1–3: refresh the evidence pack

Run an honest sweep on:

Operating systems still in support.
MFA enforced on every cloud user account (the most-changed item since the Danzell question set landed).
Asset list current, leavers removed.
Patching evidence within 14 days.
Anti-malware status across the fleet.

Day 3: pre-check, then submit

A pre-check by your assessor before submission is the difference between a 5-day turnaround and a 3-week one. Submit only when the pre-check is clean.

Days 4–5: assessor review, certificate issued

With a clean submission and no resubmission cycle, certificates are typically issued within two working days of submission.

How long it takes if it's been a while

If you've been lapsed for 3+ months, expect to spend the first week purely on environment drift – a couple of devices will have drifted out of support, MFA will have come off something, the asset list will need rebuilding. Plan 2–3 weeks total in that case.

Anything more than 12 months lapsed is effectively a fresh-start engagement. The five controls haven't changed dramatically, but evidence expectations have moved on.

Stop it lapsing again

Diary the renewal date in three places: the cert owner's calendar, a shared team calendar, and a finance reminder for the fee.
Set the renewal email to land at a shared, monitored inbox – not a single person.
Do an annual mid-cycle pre-check (around month 6) to surface drift before it becomes a re-submission gap.
If you're a NixInfinity-AI client we send you a renewal nudge two months before, one month before, and one week before. Most clients renew with no calendar drama.

What about Cyber Essentials Plus?

A lapsed CE means a lapsed CE+ – CE+ requires a current basic certificate as its baseline. Plan a fresh basic CE first, then schedule the Plus audit. Sequencing both efficiently is covered in CE vs CE Plus (where applicable) and our renewal page.