Recertification
Recertification is the yearly renewal of Cyber Essentials, done by completing a full new self-assessment before the current certificate expires. Certificates last 12 months with no automatic extension. A1.9 asks whether you are renewing. Renewals use the current question set, now Danzell, and Plus renewal needs a current self-assessment pass, less than three months old, before the audit.
- Term
- Recertification
- Also known as
- renewal, Cyber Essentials renewal
- Category
- Scheme and certification
- Requirement area
- Scheme vocabulary
- Questions
- A1.9
- Reviewed against
- Requirements v3.3
What does the term recertification mean in Cyber Essentials?
Recertification is the yearly renewal of Cyber Essentials, done by completing a full new self-assessment before the current certificate expires.
How does recertification apply to Cyber Essentials?
In plain terms
Think of an annual boiler safety check. The engineer does not extend last year's certificate. They check the boiler as it is today. Recertification works the same way: the new certificate reflects how your IT looks now.
How long does a certificate last?
The IASME FAQ is direct: "Cyber Essentials and Cyber Essentials Plus certificates expire after 12 months." Clause 2.4 of the scheme terms says a certificate is "valid for 12 months from the date of issue". IASME also removes organisations from its certified list once they have not been certified in the past year.
What does a renewal involve?
A renewal is a full self-assessment, not a shorter form. IASME says "You do need to enter all the information each time you certify. This serves as an annual review of your cyber security." A1.9 asks you to select "Renewal" if you have previously achieved Cyber Essentials, or "First Time Application" if not. Your answers are marked against the question set in force when you apply, so a renewal today uses Danzell and the NCSC requirements v3.3 even if last year's certificate was issued under Willow. A board-level person signs the declaration again.
When should you start renewing?
| When | What to do |
|---|---|
| About a month before expiry | IASME emails a reminder "roughly a month before you have to be recertified". Book the renewal now. |
| Before you start answering | Check every device against vendor support dates (A6.1) and every cloud service for MFA (A7.14 to A7.17). |
| Within 6 months of applying | Submit. IASME gives "6 months from the date of application to complete and submit your assessment". |
| Before the old certificate expires | Aim to pass, so the new 12 months starts before the old one ends. |
| Within 3 months of the self-assessment certificate | If you also hold Plus, book the audit. IASME says that with a self-assessment certificate "less than 3 months" old you do not repeat the questions stage. |
Common mistakes
Copying last year's answers into the new set. Devices get replaced, staff leave, operating systems go out of support and cloud services get added, and any of those can turn a Yes into a No. IASME advises keeping a copy of your answers when you submit so you can refer to them next year, but read each question again, because "some of the questions may have been updated and changed."
See Cyber Essentials renewal, certificate expiry and question set versions.
Related terms
- Board declarationThe board declaration is the confirmation, given by a director or board-level person, that every answer in a Cyber Essentials self-assessment is accurate.
- Certificate expiryCertificate expiry is the date, 12 months after issue, when a Cyber Essentials certificate stops being current.
- Question set versionsQuestion set versions are the named releases of the Cyber Essentials question set, which IASME updates when the NCSC revises the requirements.
- RemediationRemediation is the work of fixing security gaps, such as replacing unsupported software or turning on MFA, so a control meets the standard.
- Requirements for IT InfrastructureCyber Essentials: Requirements for IT Infrastructure is the NCSC document that sets out exactly what an organisation must do to meet Cyber Essentials.
- RetestA retest is a repeat of failed Cyber Essentials Plus tests, carried out after the organisation has fixed the problems the assessor found.
Frequently asked questions
Recertification is the yearly renewal of Cyber Essentials, done by completing a full new self-assessment before the current certificate expires.
In the 2026 Danzell question set, recertification comes up at A1.9. Read those questions against the definition above so your answers use the term the way the assessor will.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.