Cyber Essentials Renewal 2026: Expiry, Early Renewal and Lapses

How renewal works

You complete the current version of the self-assessment, an assessor at an IASME-licensed Certification Body reviews it, and a new 12-month certificate is issued. Your new expiry runs from the new issue date, so certifying slightly early does not cost you coverage.

What trips organisations up at renewal

• New starters and new devices without MFA or outside the patching regime.
• Devices that fell out of support during the year – this is the single most common renewal failure.
• New cloud services adopted since the last assessment and never added to scope.
• Question set changes – the assessment is updated periodically, so last year's answers are not automatically still correct.
• Home and hybrid working changes, including personal devices now used for work. See BYOD rules.

A sensible renewal timeline

1. 8 weeks out – diarise the expiry date and book your assessment slot.
2. 6 weeks out – refresh the asset list, check every operating system is still supported.
3. 4 weeks out – confirm MFA on all accounts including new starters, pull a patch status report.
4. 2 weeks out – complete the self-assessment and have it reviewed before submission.
5. Before expiry – certificate issued, new expiry date diarised for next year.

What if it has already expired?

You do not lose anything permanently, but you are uncertified in the meantime, and buyers who check the registry will see it. Re-certification is the same process as renewal. If a contract or tender is riding on it, our fast-track is designed for exactly this situation.

Should you renew, or step up?

• Buyers now asking for audited evidence – consider Cyber Essentials Plus, which requires a current Cyber Essentials certificate first.
• Buyers asking about governance, risk and continuity – consider IASME Cyber Assurance.
• Unhappy with your current provider – you can renew with a different Certification Body.

Pricing for renewals is the same as new certification, £320 + VAT depending on organisation size. See Cyber Essentials cost.