Cyber Essentials Check: How to Look Up and Verify a Certificate

A Cyber Essentials check takes a couple of minutes and costs nothing. Search the organisation’s registered name or certificate number on the IASME Cyber Essentials certificate search, the official register for the NCSC’s Cyber Essentials scheme. A current certificate appears with its level (Cyber Essentials or Cyber Essentials Plus), its certification date and an expiry date 12 months later. If nothing appears, treat the supplier as uncertified until they show you otherwise.

This guide is for procurement teams verifying a supplier, and for suppliers who want to see what their customers see. Sovereign Secure is an IASME-licensed Cyber Essentials certification body, so we issue certificates that appear on this register.

How do you check if a company has Cyber Essentials?

Search the company on the IASME certificate search and confirm that the name matches your contracting entity, the level meets your requirement and the expiry date is in the future. Whatever you call it (a Cyber Essentials checker, lookup or certification check), this register is the only official source.

1. Get the supplier’s registered name and certificate reference. Ask for the certificate itself, usually a PDF, and note the registered company name and number from Companies House. Trading names often differ from the name on the certificate.
2. Open the IASME certificate search. It is free, needs no account and covers certificates from every IASME-licensed certification body in one place.
3. Search by name or certificate reference. Start with the most distinctive part of the name and leave out “Ltd” or “Limited”. If you have the certificate reference, search for that instead: it points to one certificate.
4. Read the result. Check the company name, certificate reference, certificate level, certification date and certification expiry. The certificate itself shows the scope and the certification body.
5. Compare it with the certificate and record it. The reference and dates on the PDF should match the register. Save a dated screenshot of your check and put the expiry date in your contract or supplier-management system.

The register only lists certificates issued in the last 12 months, so a matching entry tells you the certificate is recent. Whether it covers the part of the business you buy from depends on the scope, covered below.

What is the Cyber Essentials register (certificate search, checker and lookup)?

The Cyber Essentials register is the IASME Cyber Essentials certificate search: the free, public list of organisations holding a Cyber Essentials or Cyber Essentials Plus certificate issued in the last 12 months. IASME runs it as the NCSC’s Cyber Essentials Delivery Partner, and the NCSC’s Cyber Essentials overview points buyers to it to check whether an organisation is certified. It covers certificates from every IASME-licensed certification body, so there is one place to look whoever issued the certificate.

If you start from the NCSC website, you reach the same register. The “Check if an organisation is certified” link on the NCSC’s Cyber Essentials overview opens this IASME search, which IASME publishes as the NCSC certificate search, and older links to a certificate search on ncsc.gov.uk now redirect to that overview. There is no second register to check, whichever Cyber Essentials lookup or checker you use.

The supplier cannot edit the register, which makes it a stronger check than a PDF certificate or a badge on a website. For how certified organisations may display the badge, see our guide to the Cyber Essentials logo.

Cyber Essentials check: what does each field on the register mean?

Each search result is one certificate.

IASME states that the search is solely for checking certification and must not be used for marketing, data research or any other purpose.

What should a Cyber Essentials certificate show?

A Cyber Essentials certificate is issued by an IASME-licensed certification body and confirms that the organisation met the NCSC’s Cyber Essentials requirements when it was assessed. The register proves the certificate exists; the scope tells you what it covers. Check both.

Scope is the item most often missed. An organisation can certify the whole organisation or a defined part of it, such as one office, one subsidiary or one network. The government’s procurement policy note PPN 014 advises organisations to check the scope of a Cyber Essentials certificate before relying on it. If the people and systems that will handle your data sit outside the scope, the certificate does not cover your contract.

You can confirm that a certification body is licensed on IASME’s “Find a Certification Body” list. If the certificate names Sovereign Secure, see how to verify a certificate we issued.

How can you tell Cyber Essentials from Cyber Essentials Plus on the register?

Look at the Certificate Level column: it shows either “Cyber Essentials” or “Cyber Essentials Plus”, and each certificate has its own reference and dates. Every Plus holder also has a basic certificate, because Plus builds on it, so check the expiry date on the entry you are relying on.

Sources: the IASME Cyber Essentials FAQ and the NCSC’s Cyber Essentials Plus Test Specification. If your contract asks for Plus, a basic entry does not meet it, however recent it is. Our Cyber Essentials Plus page explains what the audit involves.

How long is a Cyber Essentials certificate valid?

Twelve months, for both levels. The certificate expires on the date shown and there is no grace period: after that date the organisation is not certified. IASME says it removes organisations from its certified list if they have not been certified in the past year.

For government contracts that require it, PPN 014 says suppliers must renew Cyber Essentials every year for the duration of the contract, and that evidence of a certificate is essential at the point data is passed to the supplier. Build the check into your contract lifecycle:

A certificate is a point-in-time assessment: it shows the controls were in place when the organisation was certified, not that they have stayed in place since. For suppliers with access to sensitive data or your systems, ask for Plus.

What if a supplier isn’t listed on the register?

A missing entry usually has one of four explanations. Rule them out before you decide the supplier is uncertified.

Don’t accept “Cyber Essentials compliant”, “aligned with Cyber Essentials” or “working towards Cyber Essentials” as equivalent. None of these is certification.

How do you spot a fake or misleading Cyber Essentials claim?

The register is the source of truth, not a logo or a PDF. Watch for these warning signs:

• A badge on a website or email signature with no matching register entry. Badges are easy to copy and prove nothing on their own.
• A certificate whose reference, name or dates differ from the register. A PDF can be edited; the register cannot be edited by the supplier.
• A basic certificate offered where you asked for Plus.
• A certificate for a different legal entity, such as a parent, a subsidiary or a former company name.
• A narrow scope that leaves out the office, team or cloud service that will handle your data.
• A certification body you cannot find on IASME’s list of licensed certification bodies.

If you think a certificate is being misrepresented, contact the certification body named on it, or IASME, and don’t rely on it meanwhile.

Supplier-assurance checklist for procurement teams

Copy these checks into your supplier onboarding form or due-diligence record. Each check passes when its statement is true.

1. Legal entity. The certified name matches the contracting entity and its Companies House number.
2. Register entry. A matching entry appears on the IASME certificate search.
3. Certificate reference. The reference on the certificate matches the register.
4. Level. The level meets the contract: Cyber Essentials or Cyber Essentials Plus.
5. Expiry. The expiry date is after the date data is shared or the service starts.
6. Scope. The scope includes the people, sites and systems that will handle your data.
7. Certification body. The body named on the certificate is IASME-licensed.
8. Subcontractors. Subcontractors that handle your data are certified too, where the risk justifies it.
9. Renewal. The expiry date is in your contract calendar, with a re-check booked on that date.
10. Evidence. A dated record of the check is kept with the contract file.

Checking an IT provider? See how to check that an MSP is Cyber Essentials certified.

Checking hundreds of suppliers one at a time is slow. IASME runs a separate, free Supplier Assurance Tool for organisations that need to check the certification of their suppliers and contractors across a supply chain; you register to use it.

Checking your own Cyber Essentials certificate?

Search your own organisation the way a buyer would. If your entry is missing, look at your expiry date first, because an expired certificate drops off the register. If the details are wrong, contact the certification body that issued your certificate.

Not certified yet, or lapsed? Our Cyber Essentials certification packages start at £320 + VAT for organisations with up to 9 employees, and Gold submissions are assessed within one working day. The Cyber Essentials price list shows every package, and the Cyber Essentials readiness check shows how close you are before you pay. If your certificate is about to expire, read how Cyber Essentials renewal avoids a gap on the register.

Why Sovereign Secure

• We issue the certificates you are checking. Sovereign Secure is an IASME-licensed Cyber Essentials certification body. We assess and certify both Cyber Essentials and Cyber Essentials Plus.
• Published prices. Cyber Essentials costs from £320 + VAT (Bronze, 0-9 employees) to £750 + VAT (Gold, 250+ employees), with a pre-assessment check and a support call of up to an hour included.
• Assurance beyond Cyber Essentials. Sovereign Secure Ltd was incorporated in 2012 (Companies House 08334453), is ISO 27001 certified, is a PCI SSC Qualified Security Assessor (QSA) company and sits on the PCI SSC Global Executive Assessor Roundtable for 2026-2028.

Next step

Buyers: run your Cyber Essentials check on the IASME register now, then work through the checklist above. Suppliers: if a customer has asked for a certificate you don’t have, send us your company size through the form below and choose “First time Cyber Essentials (CE)”, or call +44 161 523 5276. For Cyber Essentials Plus, complete the Cyber Essentials Plus scoping questionnaire for a fixed quote.