Cyber Essentials renewal: the annual cycle

What does a renewal involve?

A Cyber Essentials renewal is a full self-assessment against the current question set, signed by a board member and marked by an assessor. It must be passed before the existing 12-month certificate expires to avoid a gap.

A renewal is a full self-assessment, not a shorter form. You complete the question set again in the IASME portal, a board member signs the declaration and an assessor marks it. A1.9 asks whether the application is a renewal of an existing certificate or a first application; the answer does not change the marking, but it tells the assessor to expect an existing set of controls.

What makes a renewal faster is the evidence from last year: the device inventory, the software version list, the administrator register and the MFA enforcement report. Update those rather than rebuild them, and the answers follow.

What changes from year to year?

Two things change between renewals: the scheme version you are marked against, and your own estate of devices, users and cloud services.

Two things move: the scheme and your estate. The NCSC and IASME revise the requirements and the question set periodically; the current version is Requirements v3.3 (April 2026) with the Danzell question set, effective 27 April 2026. Answers copied from a previous version may no longer match the question asked, so read the 2026 change log before reusing them.

Your estate moves too. Operating systems reach end of support, staff join and leave, new cloud services appear, and firewall rules accumulate. A renewal is the point at which those changes are checked against the controls.

What should you re-check before resubmitting?

Before a renewal, re-check the five areas that drift most in a year: supported software, MFA coverage, patching, accounts and firewall rules.

• Supported software. Re-run the inventory for A6.1 to A6.2.4 and confirm nothing has left vendor support since last year. A Yes to A6.3 means the licensed-and-supported requirement is not met.
• MFA coverage. List every cloud service at A2.9 including any added during the year, and confirm MFA is enforced for every user and administrator (A7.16AUTO-FAIL, A7.17AUTO-FAIL).
• Patching. Pull a fresh update compliance report showing nothing critical or high-risk older than 14 days (A6.4AUTO-FAIL, A6.5AUTO-FAIL).
• Accounts. Cross-check the leavers log against the directory and each cloud service (A7.3), and review who still holds administrator access (A7.9).
• Firewall rules. Complete the annual rule review that A4.6 asks about and remove rules no longer needed.

How does Cyber Essentials Plus renewal work?

Cyber Essentials Plus has no separate renewal route: you pass a new self-assessment, then complete the Plus audit within 3 months.

Each year you pass the self-assessment first, then complete the Plus assessment within 3 months of that certification on the same scope. Book both at once so the audit date lands inside the window. The Plus tests are the same each year: external scan, authenticated patch scan of a sample, malware protection tests, MFA on every cloud service and account separation.