Certificate expiry
Certificate expiry is the date, 12 months after issue, when a Cyber Essentials or Cyber Essentials Plus certificate stops being current. After that date the organisation is no longer certified, whatever its PDF says. Legal entities included at A1.6.1 share the primary entity's expiry date. To stay certified without a gap, recertify before the date passes.
- Term
- Certificate expiry
- Also known as
- expiry date, certificate validity
- Category
- Scheme and certification
- Requirement area
- Scheme vocabulary
- Questions
- A1.6.1
- Reviewed against
- Requirements v3.3
What does the term certificate expiry mean in Cyber Essentials?
Certificate expiry is the date, 12 months after issue, when a Cyber Essentials certificate stops being current.
How does certificate expiry apply to Cyber Essentials?
In plain terms
It is the use-by date. A certificate proves you met the standard when you were assessed, and the scheme treats that proof as good for a year. IASME's FAQ puts it plainly: "Cyber Essentials and Cyber Essentials Plus certificates expire after 12 months."
What the scheme says
- Validity: Both levels expire 12 months after issue. IASME removes organisations from its list of certified organisations once they have not been certified in the past year.
- Included entities: A1.6.1 says legal entities added to your certificate "will share the same certification expiry date" as the primary entity, and that if the primary certificate is revoked, theirs are revoked too.
- Renewal: There is no short renewal form. IASME's FAQ says you enter all the information again each time you certify, and that IASME emails a reminder roughly a month before you need to recertify.
- Plus timing: Cyber Essentials Plus builds on a self-assessment certificate. IASME's FAQ says that if your self-assessment certificate is less than 3 months old when you certify to Plus, you do not need to repeat the self-assessment. Leave it longer and you answer the question set again first.
How to avoid a gap
| When | What to do |
|---|---|
| 3 months before expiry | Check what changed in the question set and re-run your device and software list against vendor support dates. |
| 6 to 8 weeks before | Open the new assessment and start the answers. You have 6 months from application to submit. |
| Before expiry | Submit early enough to allow for marking and, if needed, one round of fixes. |
Common mistakes
Letting the certificate lapse during a live contract. Under PPN 014, suppliers on relevant central government contracts renew annually for the life of the contract. Another is assuming the reminder email will reach the right person. Put the expiry date in a shared diary with a named owner.
See Cyber Essentials renewal, how to verify a certificate, recertification and the IASME Cyber Essentials FAQ.
Related terms
- PPN 014 (Procurement Policy Note 014)PPN 014 is the Cabinet Office procurement policy note that tells central government bodies to require Cyber Essentials from suppliers in relevant contracts.
- RecertificationRecertification is the yearly renewal of Cyber Essentials, done by completing a full new self-assessment before the current certificate expires.
- Certificate registerThe certificate register is the public online record of Cyber Essentials certificates, where anyone can check whether an organisation is currently certified.
- Certification BodyA Certification Body is an organisation licensed by IASME, the NCSC's Delivery Partner, to assess and certify applicants for Cyber Essentials and Cyber Essentials Plus.
- CRESTCREST is an international not-for-profit body that accredits companies providing technical security services, such as penetration testing and security operations centres.
- Cyber AdvisorA Cyber Advisor is a person assured by the NCSC to advise organisations on how to implement the Cyber Essentials controls.
Frequently asked questions
Certificate expiry is the date, 12 months after issue, when a Cyber Essentials certificate stops being current.
In the 2026 Danzell question set, certificate expiry comes up at A1.6.1. Read those questions against the definition above so your answers use the term the way the assessor will.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.