What this guide covers
Do you need to renew Cyber Essentials every year?
Yes. IASME’s FAQ states: “Cyber Essentials and Cyber Essentials Plus certificates expire after 12 months.” (IASME FAQ)
For a government supplier the obligation is also contractual.
PPN 014, paragraph 14“Where Cyber Essentials certification is required, it must be renewed annually by the supplier for the duration of the contract.”
PPN 014, FAQ Q7
“Suppliers must recertify every 12 months in order to maintain a valid certificate.”
Source: PPN 014
How does the Cyber Essentials renewal cycle work?
The process is the same each year: a verified self-assessment against a named question set, followed by a certificate valid for 12 months.
When does the new certificate start?
IASME’s renewal article says the new certificate is valid for 12 months from the date of submission, not from the expiry date of the previous one. That suggests renewing early gives up the remaining days on the old certificate. Renewing in the final month still works, but the new certificate dates from submission.
IASME sends reminders about a month before expiry. Applicants have six months from the date of application to complete and submit the assessment.
Expiry
Counted from the date of application, to complete and submit the assessment.
Which question set will your renewal use?
IASME splits the question sets by purchase date. A renewal bought today is assessed on Danzell.
| Purchase date | Requirements version | Question set name |
|---|---|---|
| Before 27 April 2026 | v3.2 | Willow |
| From 27 April 2026 | v3.3 | Danzell |
IASME says the Requirements document and Question Set “may change each year”, and each version is named. That is what changes each year in practice. A Willow answer set is out of date for a purchase from 27 April 2026.
Check the date you bought the assessment against 27 April 2026, then open the matching question set on IASME’s download page.
Where does Cyber Essentials Plus fit?
Plus adds a technical audit by a certification body. IASME says a verified self-assessment certification obtained within three months before Plus lets you skip repeating the self-assessment questions at the Plus audit.
What changed in the Cyber Essentials scheme this year?
The version in force is Cyber Essentials: Requirements for IT Infrastructure v3.3, April 2026, effective 27 April 2026 according to NCSC. Danzell is IASME’s name for the question set. v3.2 was effective 28 April 2025.
Three items appear in the v3.3 “What’s new” list:
A definition of “cloud services” is provided.
The passwordless authentication definition is updated to include FIDO2.
A definitive statement that cloud services cannot be excluded from scope.
The document puts it this way: “Cloud services cannot be excluded from scope.”
Two other lines sit in the document but are not on that list, and this piece does not call them new.
“authentication to cloud services must always use MFA”
IASME’s April 2026 page describes this as an automatic fail.
“Publicly available commercial web applications (rather than apps developed in-house) are in scope by default. Bespoke and custom components of web applications are out of scope.”
Whether a given WordPress install falls inside is our reading and the assessor’s call.
Read the “What’s new” list in the v3.3 PDF itself before you rely on any summary of it, including this one.
What does Cyber Essentials certification cost at renewal?
IASME’s published fees for the basic assessment:
| Size | Employees | Fee |
|---|---|---|
| Micro | 0 to 9 employees | £320 + VAT |
| Small | 10 to 49 employees | £440 + VAT |
| Medium | 50 to 249 employees | £500 + VAT |
| Large | 250 and over | £600 + VAT |
Plus is quoted individually, based on the organisation, so no published figure exists. A supplier whose contract does not ask for Plus self-assesses at the basic level.
Can you keep a government contract if the certificate lapses?
That is the buyer’s decision. PPN 014 FAQ Q5 says that “under exceptional circumstances, in-scope organisations may wish to make a risk-based decision and allow a contract to commence” where certification has expired and is being renewed. The supplier must be able to demonstrate that it holds the appropriate certification at the point when data is passed over. It is not a grace period for the supplier, and IASME’s renewal article specifies none.
Ask the buyer in writing and keep the answer with the contract file.
What should you prepare before you submit the renewal?
Each step ends with something you can file.
Confirm the purchase date and the question set.
Artefact: the order date, noted against 27 April 2026, and the matching question set saved.
Re-read the five controls as they apply now.
Artefact: a note of which controls touch the public site.
Pull a dated update log for the public site. The question each year is when it was last patched. See the Cyber Essentials security update management guide.
Artefact: the log.
Check what the site is running before the assessment. The plugins and themes screens in WordPress admin are one way to do it.
Artefact: the list of plugins, themes and versions in use.
Put the scope question to the assessor in writing.
Artefact: the assessor’s written answer on the public site.
Every step leaves a dated file. If one is missing, the step is not done.
Someone has to own the patching between renewals.
NoDrama’s care plans keep WordPress, plugins and themes current on the public site, and each of the three plans is listed on NoDrama’s pricing page.
What this does not solve
NoDrama does not certify or assess anyone and cannot guarantee a pass. It supports compliance work: its care plans keep WordPress, plugins and themes current and include reporting. Certification stays with the supplier, and the judgement stays with the assessor. This piece does not read the v3.3 question set clause by clause, and it makes no claim about which questions changed.
Conclusion: renew on 12 months and know your question set
Renew every 12 months. The new certificate runs from submission, and a purchase from 27 April 2026 uses Danzell. Three changes are confirmed in the v3.3 list: the cloud services definition, FIDO2 in the passwordless definition, and the statement that cloud services cannot be excluded from scope. A Cyber Essentials renewal starts from knowing which of those applies to your purchase date.