Cyber Essentials Renewal

Cyber Essentials renewal means passing a fresh assessment every 12 months. Nothing rolls over and there is no grace period: the day your certificate expires, you are no longer certified. Start four to six weeks before the expiry date, answer the current question set and submit in the last fortnight. You can renew with your current certification body or switch. Sovereign Secure is an IASME-licensed Cyber Essentials certification body, so we assess and issue your renewed certificate ourselves.

How long does Cyber Essentials certification last?

Both Cyber Essentials and Cyber Essentials Plus certificates last 12 months. After that, the only way to stay certified is a new assessment.

Two details catch people out:

• The new 12 months starts when you submit, not when the old certificate ends. IASME confirms that a renewed certificate is valid for 12 months from the date of submission (IASME: the importance of renewing). Renew three months early and your next expiry date moves three months earlier.
• Your answers describe your IT on the day you submit. New laptops, a new cloud service or an operating system that has lost vendor support are all assessed at renewal.

What happens when a Cyber Essentials certificate expires?

You lose certified status on the expiry date, and anyone who checks can see it.

Already expired? The fix is a new assessment, run and priced exactly like a renewal, so start now.

When should you start your Cyber Essentials renewal?

Start four to six weeks before your expiry date and submit in the final one to two weeks. That leaves time to fix anything the assessor queries without bringing your next expiry date forward. Your expiry date is on your certificate and in the public certificate search.

How much does Cyber Essentials renewal cost?

A renewal with us costs the same as a first certification: from £320 + VAT for 0 to 9 employees on Bronze to £750 + VAT for 250+ employees on Gold. Every package includes the certification and assessment fee, portal access, a pre-assessment check, a support call of up to an hour and access to our guide.

All prices exclude VAT. Bronze matches the fee bands IASME publishes for each organisation size. Bronze includes one resubmission and 10 working days to pass, Silver three resubmissions and a month, Gold unlimited resubmissions and three months. Extra resubmissions cost £100 + VAT each.

Recount your staff before you order, because growing into a new size band changes the price. Multi-year bundles sold by some providers fix the price, not the certificate: you still pass a new assessment every 12 months. See the full Cyber Essentials price list.

Can you switch certification body when you renew?

Yes. You can renew with any IASME-licensed certification body, and there is no transfer process. A renewal is a new assessment either way, so switching takes no longer than staying put.

To switch to Sovereign Secure:

1. Note your expiry date and your organisation’s details as they appear on your current certificate.
2. Save last year’s answers from your current provider’s portal before your access ends. They are a starting point; you still answer the current questions.
3. Check for auto-renewal. Some providers sell Cyber Essentials as an annual subscription that renews automatically. Cancel it if you are moving.
4. Choose your package by company size and speed, and order through the form on this page.
5. Answer the current question set in the portal we set up, use the pre-assessment check and book your support call.
6. Submit. When you pass, we issue your new certificate and it appears in the public certificate search.

How does Cyber Essentials Plus renewal work?

A Cyber Essentials Plus certificate also lasts 12 months, and renewing it means repeating both stages: pass the basic Cyber Essentials assessment again, then complete the Cyber Essentials Plus audit within three months of the new basic certificate.

To avoid a gap in your Plus certification:

• Renew the basic certificate first, six to eight weeks before your Plus certificate expires.
• Book the audit straight away, and send your asset declaration at least two weeks before it. The device sample reflects what you use now, not last year.
• Leave room for a retest. Remote retests of up to an hour within a month are free; other retests cost from £400 + VAT.

Every Cyber Essentials Plus quote from us includes the basic assessment, so both stages sit in one order. Plus is quoted on devices, sites and cloud services: see Cyber Essentials Plus cost or complete the Cyber Essentials Plus scoping questionnaire for a fixed quote.

What has changed since your last certificate?

The question set is updated regularly, usually in April, so a renewal is rarely a copy of last year. Any renewal started now uses the Danzell question set, which is based on version 3.3 of the NCSC’s requirements for IT infrastructure (NCSC Cyber Essentials resources).

If you last certified on Willow, check these before you answer:

• MFA on cloud services is mandatory wherever the service offers it. Missing it is an automatic fail.
• High-risk and critical updates must be installed within 14 days across operating systems, firmware and applications, now checked by automatic-fail questions.
• Scope needs more detail, including what is excluded and every legal entity covered.

Our guide to the Danzell question set changes goes further, and our Cyber Essentials questionnaire page shows how to prepare your answers. If your next renewal falls in 2027, see Cyber Essentials 2027 for what has and has not been announced about the next update.

Why renew with Sovereign Secure?

• We are the certification body. The team that supports your renewal assesses it and issues your certificate, with no reseller in the middle.
• Fast when time is short. Gold renewals are assessed within one working day and Silver within two.
• Help before you submit. The pre-assessment check and support call cover where renewals most often trip: the new MFA rules, unsupported software and scope changes.
• More than Cyber Essentials. Sovereign Secure Ltd was incorporated in 2012 (Companies House 08334453) and is ISO 27001 certified. We are a PCI SSC Qualified Security Assessor (QSA) company and a member of the PCI SSC Global Executive Assessor Roundtable for 2026 to 2028. We also deliver Cyber Essentials Plus and penetration testing, so your Cyber Essentials certification can grow with you.

Ready to renew?

If your certificate expires within two months, send us your certificate details through the form below and choose “Cyber Essentials renewal”. We will confirm your package and set up your portal. Not due yet? Send your expiry date through the same form and we will contact you before it runs out. Last certified under the old question set? Our free Cyber Essentials readiness check takes about five minutes and flags the April 2026 automatic fails before you start. Or call +44 161 523 5276.