How long does Cyber Essentials certification remain valid?

Cyber Essentials certification is a time-limited assessment outcome, not a permanent accreditation. Its status is determined by the expiry date shown on the certificate, so an organisation should treat that date as a formal compliance milestone and plan its next assessment before the existing certificate lapses.

What happens when certification expires?

Once the expiry date has passed, the organisation must not present itself as holding current Cyber Essentials certification. The expired certificate can still demonstrate that the organisation completed an assessment in the past, but it does not confirm that the organisation’s current systems, users, devices and security controls meet the scheme’s requirements.

This distinction matters where certification is used for supplier due diligence, tender submissions, contracts or internal governance. A customer or contracting authority may require evidence of current certification rather than an historical certificate. An expired certificate may therefore be rejected even if the organisation has not experienced any known security incident or major technical problem.

Why renewal is more than an administrative exercise

Cyber Essentials assesses the organisation’s position at a particular point in time. The assessment does not provide continuous certification throughout the validity period. Systems and risks can change after certification, including:

• new laptops, servers, mobile devices or network equipment being introduced;
• staff, contractors or administrators gaining access to business systems;
• cloud services, remote access arrangements or software platforms changing;
• support arrangements altering how security updates and malware protection are managed; and
• the organisation’s certification scope expanding to include additional sites, devices or users.

These changes should be recorded and managed as part of normal security governance. Before submitting a new assessment, the organisation should confirm that its defined scope is accurate and that the five technical control areas remain properly implemented: firewalls, secure configuration, security update management, user access control and malware protection.

How to prepare for the next assessment

1. Check the certificate details. Confirm the expiry date, the organisation named on the certificate and the scope covered by the assessment.
2. Review changes since certification. Compare the current estate with the previous assessment, including devices, operating systems, cloud services, remote connections and user accounts.
3. Reconcile the scope. Make sure systems that should be included have not been omitted and that retired or transferred assets are no longer treated as part of the active estate.
4. Test the controls. Check that updates are being applied, administrator access is restricted, security software is active where required, and secure configuration standards are still in use.
5. Resolve gaps before submission. Address technical or administrative weaknesses first, rather than relying on the assessment to identify them after the renewal process has begun.

Keeping evidence during the certification period can make this review more reliable. Useful records may include asset inventories, update reports, user-access reviews, configuration standards and details of how unsupported software or devices are handled. The exact evidence requested depends on the assessment route and the answers provided.

What if the organisation misses the expiry date?

A missed expiry date does not automatically mean that every security control has failed. It does mean that the organisation no longer has current certification until it completes the relevant process successfully. It should stop using the expired status in proposals, policies, websites and supplier communications, then establish what assessment or renewal steps are required.

If the organisation has undergone significant technical or structural changes, it should not assume that repeating previous answers will be appropriate. The scope and responses need to describe the current environment. Where the organisation is uncertain about how changes affect its assessment, independent guidance can help clarify the position before submission.

S2 Technology Group can help organisations review their technology estate, identify changes since the previous assessment and prepare the underlying controls for certification. This support is intended to make the organisation’s security position easier to understand and maintain; certification itself remains dependent on meeting the scheme’s assessment requirements.