Cyber Essentials Supplier Check Tool: How Buyers Verify Your Certification
Published 12 October 2026
What is the Cyber Essentials Supplier Check Tool?
It is an IASME service for organisations that want to verify Cyber Essentials and Cyber Essentials Plus certification across their supply chain. A buyer uploads a CSV of supplier company names or certificate numbers (up to 5,000 entries per search) and gets the results back as a downloadable spreadsheet. Certificates that expired in the previous 12 months are shown too (IASME Supplier Check FAQ).
Access is approved by IASME, and the tool may only be used to check certification within a supply chain, not for marketing. IASME now directs new organisations to its newer Supplier Assurance Tool, and the original Supplier Check Tool no longer accepts new registrations (IASME Supplier Check). For a supplier, the effect is the same: your certificate record is what the buyer sees.
Who uses it, and why
The NCSC encourages large organisations to embed Cyber Essentials in their supply chains, and names the IASME tool as the way to check adoption (NCSC: secure your supply chain; NCSC Cyber Essentials Supply Chain Playbook).
Organisations that sign the Government's Cyber Resilience Pledge commit to registering for the Supplier Check Tool within two months and auditing Cyber Essentials coverage across their supply chain (GOV.UK Cyber Resilience Pledge declaration). If you supply one of those organisations, expect to be looked up. You can read our own signed pledge.
How certificate verification works in practice
- The buyer builds a list of suppliers, usually from its supplier or contract register.
- It searches the tool by company name or certificate number.
- Each supplier comes back as certified (CE or CE Plus), recently expired, or not found.
- The buyer follows up on gaps, often through procurement, contract renewal or a supplier assurance questionnaire.
"Not found" does not always mean "not certified". It often means the name on the certificate does not match the name on the buyer's list. Avoiding that is the most useful thing you can do.
CE or CE Plus: which will the buyer look for?
The buyer sets the level. Cyber Essentials is a verified self-assessment against five technical controls. Cyber Essentials Plus adds an independent technical audit of a sample of your devices, and must be completed within three months of your Cyber Essentials certificate. If a contract or framework names CE Plus, a standard CE certificate will not meet it. For example, G-Cloud 15 sets the level by lot: see G-Cloud 15 Cyber Essentials requirements by lot.
What to check before a buyer looks you up
| Check | Why it matters | What to do |
|---|---|---|
| Legal entity name | Buyers search by the name in their contract register | Certify in your registered legal name, and tell buyers your certificate number |
| Trading names and group companies | A parent's certificate may not cover the subsidiary that holds the contract | Confirm which entity is in scope, and certify each contracting entity where needed |
| Scope | A certificate for part of the organisation may not cover the service being bought | Check your scope statement covers the people, devices and cloud services that deliver the contract |
| Level | CE does not satisfy a CE Plus requirement | Match the level the buyer or framework names |
| Expiry date | Certificates are valid for 12 months; lapsed certificates appear as expired | Renew before expiry, and well ahead of a contract renewal or tender deadline |
| Certificate number to hand | Speeds up matching and follow-up questions | Put it in tender responses and supplier portals |
If your certificate has expired
A recently expired certificate is visible to the buyer as expired, so the gap is obvious. There is no grace period that keeps it valid. Recertify as soon as you can and tell the buyer your expected date. Our renewal guide covers timing, and reinstating a lapsed certificate covers the fastest route back.
If you are not certified yet
Start with standard Cyber Essentials unless the buyer has named CE Plus. Prepared organisations with MFA enforced and supported software can often certify quickly. Organisations that still need MFA rollout or patching should allow a few weeks. If a buyer needs CE Plus, plan both: CE first, then the CE Plus audit within three months. See Cyber Essentials for government contracts and Cyber Essentials for tenders for how buyers typically phrase the requirement.
Subcontractors and your own supply chain
Some buyers ask you to flow a Cyber Essentials requirement down to subcontractors who handle their data or systems. Others take a risk-based approach and accept other assurance for some suppliers. There is no single rule that every subcontractor must be certified. Read the contract wording, and if you rely on subcontractors for the service, find out early whether they are certified and in which legal name.
Certification is evidence, not a guarantee
A valid certificate answers one question in supplier assurance. It does not by itself make you eligible for a contract, and buyers can set other security, data protection or insurance requirements alongside it.