Cyber Essentials Plus Renewal: What Changes on Year Two

What renewal actually involves

• Fresh Cyber Essentials submission (CE is the prerequisite, every year).
• New sample of devices – the assessor will not reuse last year's list.
• Fresh authenticated vulnerability scan, email test and web-download test.
• Updated evidence pack: MFA screenshots, patch reports, admin list, joiners/leavers.

The four drift areas that catch everyone

• New SaaS. Every tool added in the last twelve months is in scope. Every one needs MFA.
• New starters and leavers. The joiners/leavers list will be checked against your identity provider.
• OS versions. Anything that has slipped past end-of-life since the last audit must be retired or removed from scope.
• BYOD growth. A remote-work expansion often means more BYOD than last year – sample sizes reflect that.

Cost delta at renewal

For a stable estate, year-two CE Plus is typically the same fee as year one, sometimes slightly less because the evidence pack templates exist and the MDM is already tuned. Cost goes up if you have grown into a larger IASME band, added significant cloud sprawl, or introduced BYOD at scale. Full detail in the CE Plus cost guide.

Insurance continuity

The free £25,000 IASME cyber insurance is tied to a valid CE or CE Plus certificate. Let the certificate lapse and cover drops on the same day. Diary the renewal so the new certificate is issued at least seven days before the old one expires. See free CE cyber insurance explained.

The renewal calendar

1. T-90 days: book the renewal audit window.
2. T-60 days: run internal drift check (MFA, patch, admin separation, cloud inventory).
3. T-30 days: begin CE renewal submission and start refreshing evidence pack.
4. T-14 days: pre-audit scan, remediate anything flagged.
5. T-7 days: formal audit runs, remediation window opens if needed.
6. T-0: new certificate issued, insurance rolls forward.

Should you switch assessor at renewal?

You can. A different assessor may find things the incumbent missed, which is why some buyers request rotation. Weigh that against the continuity a returning assessor gives on scope statements, historical remediation notes and known quirks in your estate. Either is legitimate.

The "no time" scenario

If a tender lands and your certificate is about to lapse, the fast-track renewal is two weeks for a well-prepared estate. See the CE Plus timelineand the readiness checklist.