Cyber Essentials certification expires exactly 12 months after the date it was issued — there's no grace period, and no auto-renewal. This guide walks through the annual renewal process for Cyber Essentials and Cyber Essentials Plus, what changes each cycle, and how to avoid the last-minute scramble that catches most SMEs out.
Why this matters
A lapsed Cyber Essentials certificate isn't a paperwork problem — it's a lost-contract problem. Government and enterprise procurement teams check certification status before they'll even open your tender response, and many contracts specify Cyber Essentials Plus as a hard requirement.
The controls also drift. Firewalls get reconfigured, new SaaS tools get added, staff turn over, and by month 10 the environment you certified in 2025 doesn't match what you're running in 2026. Renewal forces a real re-check, not a formality.
What you'll need
- Your current Cyber Essentials certificate and the date it was issued
- An up-to-date asset inventory — every device, server, and cloud service in scope
- Current firewall and router configuration details
- A list of all admin accounts and who holds them
- Evidence of patch management over the past 12 months
- Malware protection status across every in-scope device
- If renewing Cyber Essentials Plus: time booked for the external technical audit
- Budget and a decision on which certifying body you're using this cycle — compare options on certification bodies compared if you're not locked in
The renewal steps
1. Check your expiry date and start early
Pull your certificate and confirm the exact expiry date — most certifying bodies will not backdate a lapsed certification. Start the renewal process 4-6 weeks out. Waiting until week 1 is the single most common mistake: assessor queues stack up in the final days before expiry, especially around Q1 and Q4 when government contract renewals cluster.
Common mistake: treating the 12-month window as flexible. It isn't — miss it and you restart from zero with a gap in your certification history.
2. Re-inventory your scope
List every device, server, laptop, and cloud service that falls inside your certification boundary. Businesses that added remote staff, new SaaS tools, or BYOD policies since last year need to widen scope accordingly. A boundary that's out of date is the fastest way to fail a Cyber Essentials Plus technical audit.
Expected outcome: a scope document that matches what's actually running today, not what was running 12 months ago.
3. Re-check firewall and secure configuration
Confirm firewall rules on every boundary device, remove any default admin passwords still in place, and disable unused services. This is one of the five control areas assessors check every single cycle — it doesn't get lighter because you passed last year.
Common mistake: assuming last year's firewall config still holds. New devices and remote-access rules added mid-year often introduce open ports nobody flagged.
4. Verify access control and admin accounts
Audit who holds administrator privileges, remove departed staff, and confirm multi-factor authentication is active on every account with access to sensitive data. Staff turnover is the most common cause of a failed access-control question on renewal.
Expected outcome: an access list where every admin account is justified and every ex-employee is removed.
5. Confirm malware protection and patch management
Check that every in-scope device runs current malware protection and that operating systems and applications are patched within the vendor's recommended window — typically 14 days for critical updates. This is where most renewal failures happen, because patching slips quietly over 12 months without anyone noticing. Full detail on keeping this current between cycles is in patch management for MSPs.
Common mistake: discovering unpatched legacy devices during the audit that nobody remembered were still in scope.
6. Resubmit the self-assessment (or book the Plus audit)
For Cyber Essentials, complete the self-assessment questionnaire fresh — you cannot roll over last year's answers. For Cyber Essentials Plus, book the external technical audit slot with your certifying body; these fill up fast in the weeks before contract renewal deadlines.
Expected outcome: a submitted questionnaire or a booked audit date, both inside your 12-month window.
7. Fix findings and get the certificate reissued
If the assessor or audit flags gaps, remediate and resubmit within the timeframe the certifying body gives you. Once cleared, your new certificate carries a fresh 12-month clock from the reissue date — not from your old expiry date.
Automate your Cyber Essentials renewal
Evidence collection, gap tracking, and resubmission handled end-to-end.
Troubleshooting
Certificate lapsed before renewal was finished. There's no grace window in 2026 — you're treated as newly applying. Submit as soon as possible and flag the gap to any client or procurement contact who requires continuous certification.
Cyber Essentials Plus audit found new devices out of scope. Widen the scope document immediately, patch and configure the new devices to standard, then request a re-check rather than a full restart.
Admin accounts still active for former staff. Remove them before submission — this is a guaranteed fail on the access control question if caught during audit.
Patch management evidence is patchy across 12 months. Assessors want to see a consistent pattern, not a snapshot. If your evidence is thin, tighten your process now so next year's renewal isn't the same fire drill — see security awareness training for remote teams for keeping staff-side controls consistent.
Certifying body queue is backed up near expiry. Book your slot 4-6 weeks ahead. If you're already inside the last two weeks, contact the certifying body directly — some offer expedited slots for a fee.
Tools and resources
- Asset inventory spreadsheet or automated discovery tool
- Firewall and router config export from your network provider
- Admin account audit log from your identity provider
- Patch management dashboard or manual patch log
- Best Cyber Essentials Plus certification bodies compared to pick your assessor this cycle
What to do next
Once Cyber Essentials is renewed, run a short internal drill to check your incident response process still works — most businesses discover it's out of date the year they need it. Walk through how to run a tabletop exercise for incident response as the natural next step after certification.
Frequently asked questions
One last thing
The businesses that fail renewal almost never fail on a new control — they fail on drift in the same five areas they passed last year. Patch cadence slips, an ex-employee still has admin rights, or a new SaaS tool never made it into scope. Treat renewal as a check on drift, not a repeat exam, and 2026's cycle takes a fraction of the time 2025's did.