How to verify a Cyber Essentials certificate
Check any organisation on the IASME register in under a minute, and know what a genuine, current certificate looks like.
- Organisation
- The registered legal name, which may differ from the trading name on the supplier's website
- Level
- Cyber Essentials or Cyber Essentials Plus
- Certification date and expiry
- 12 months apart; both shown in the IASME search
- Certificate reference
- A unique reference, shown in the search, that you can quote back to the supplier
- Scope
- On the certificate, not in the search: whole organisation, or a described partial scope
- Included entities
- Any additional legal entities declared at A1.6.1, sharing the primary certificate's expiry
Current Cyber Essentials and Cyber Essentials Plus certificates can be checked on the IASME certificate search by organisation name or certificate reference. Each result shows the legal name, reference, level and the certification and expiry dates. Confirm they match the certificate you were given, then read its scope. A PDF alone proves nothing.
Search current certificates
Opens the official IASME search in a new tab. No account needed.
- 01Legal name matches
- 02Level: CE or CE+
- 03Expiry date not passed
- 04Reference matches the PDF
How do you check a certificate, step by step?
Open the IASME certificate search
Go to the Cyber Essentials certificate search on iasme.co.uk. It finds organisations holding a Cyber Essentials or Cyber Essentials Plus certificate issued in the last 12 months, whichever Certification Body issued it.
Search by organisation name or certificate number
Enter the legal name, or the certificate reference if you have been given one. Results list the company name, certificate reference, level, certification date and expiry. Trading names may not match; try the registered company name.
Check the level
The level column shows CE or CE+. A contract that requires Cyber Essentials Plus is not satisfied by a CE entry. An organisation holding both appears twice, once per level.
Check the dates
Certificates expire 12 months after the certification date, and the search only returns certificates issued in the last 12 months. No result, or an expiry date in the past, means the organisation is not currently certified, whatever the PDF they sent you says.
Check the scope on the certificate itself
The search does not show scope. Ask for the certificate and read its scope: whole organisation is the strongest answer, and a partial scope should say what is covered. Any subsidiaries should be named as included legal entities.
Match it to the certificate you were shown
The company name, certificate reference, level and dates in the search should match the document. If they do not, ask the supplier to explain before you rely on it.
Checking many suppliers at once
If you manage a supply chain, checking one certificate at a time does not scale. IASME provides the Supplier Assurance Tool, which it describes as a free platform for checking the Cyber Essentials and Cyber Essentials Plus certification of suppliers and contractors. You register from the certificate search page, and IASME's terms limit it to checking certification within a supply chain, not marketing or research. The Danzell question set guidance also refers to a Cyber Essentials Supply Check Tool, to which included legal entities are added.
What a certificate does not prove
Cyber Essentials is a point-in-time self-assessment (or, for Plus, a point-in-time audit of a sample). It shows the organisation met the five controls when assessed, for the scope declared. It does not cover systems outside that scope, and it says nothing about what happened after the issue date. For higher-risk suppliers, ask for Plus, ask for whole-organisation scope, and ask for the renewal date.
Frequently asked questions
Search the Cyber Essentials certificate search on iasme.co.uk by organisation name or certificate reference. Each result shows the company name, certificate reference, level (CE or CE+), certification date and expiry date, for certificates issued in the last 12 months. A PDF certificate on its own is not proof, because it can be out of date or edited.
Twelve months from the issue date. Renewal means a fresh self-assessment (and a fresh audit for Plus). Most contracts and frameworks require a certificate that is current on the day it is checked, so ask suppliers for their renewal date.
Use the IASME Supplier Assurance Tool. IASME describes it as a free platform for organisations to check the Cyber Essentials and Cyber Essentials Plus certification of their suppliers and contractors. You register for it from the certificate search page, and its terms allow use only for checking certification within a supply chain.
Try the registered legal name rather than the trading name, and ask the supplier for the certificate reference. If it still does not appear, the certificate may have been issued more than 12 months ago and expired, been issued to a different legal entity, or not exist. Ask the supplier which Certification Body issued it and when.
Only if they were declared. The question set asks (A1.6) whether more than one legal entity is within scope and requires each one to be named with its company number (A1.6.1). IASME's guidance says included entities are listed on the primary entity's certificate, share its expiry date and are added to the certificate search. A subsidiary that was not declared is not covered.
Related pages
- IASMEIASME, Cyber Essentials certificate search and Supplier Assurance ToolRead on iasme.co.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials frequently asked questionsRead on iasme.co.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials Danzell Question Set 2026Read on iasme.co.uk (opens in a new tab)
Get certified at a fixed price
Precursor is an IASME Certification Body: Cyber Essentials from £1,500 and Cyber Essentials Plus from £3,000, with the IASME fee included, a free re-test if gaps are found and a written fixed price after a 20-minute scoping call.
- IASME Certification Body
- CREST accredited
- UK offices in Leeds, Newcastle, London and Edinburgh