Cyber Essentials renewal: what changes, what it costs, and how not to fail the second time

Renewal is a new assessment, not a top-up

There is no “renewal form”. When your certificate reaches twelve months you complete the self-assessment again, pay the assessment fee again, and an assessor reviews your answers again — against the current version of the requirements and question set. The questionnaire asks whether this is a renewal rather than a first application (question A1.9); everything else is judged fresh.

That matters because the scheme changes roughly once a year. The 2026 set, IASME’s “Danzell” (aligned to version 3.3 of the NCSC requirements), came into force on 27 April 2026, replacing the “Willow” set many businesses last certified under. Even if your setup hasn’t changed, answer against the current wording.

What renewal costs

The same assessment fee as the first time, set by IASME according to your organisation size and paid to your certification body — see the cost guide for the tiers. It is simply the fee again. The time cost should be lower than the first year if you kept your asset list and policies current, and higher if you didn’t.

When to start

Work back from the expiry date on your certificate. Give yourself four to six weeks: a week to re-check scope and the automatic fails, time to fix anything the year has introduced — a new cloud tool nobody switched MFA on for, a new starter with a shared login, a laptop that fell out of support — and a margin for the assessor’s review. If a client contract depends on the certificate being continuous, do not leave it to the last fortnight. Ask your certification body how long their review typically takes.

The rules most likely to catch you at renewal

Only one of these is new in v3.3 — the definitive statement that cloud services cannot be excluded from scope — but all of them are worth re-checking before you submit. The 2026 changes guide has the detail.

• MFA is an automatic fail across three questions (A7.15 to A7.17). Every user and every admin of every cloud service that offers MFA must have it on. One account without it fails the whole user-access section.
• The 14-day update rule is an automatic fail (A6.4, A6.5) and covers firmware, browsers and plug-ins as well as operating systems.
• Unsupported operating systems fail outright. Windows 10 without an active Extended Security Updates subscription is the common one — see the unsupported software guide.
• Cloud services cannot be excluded from scope, and business social-media accounts count as cloud services.
• Personal phones used for work email are in scope.
• Password rules are simpler than many old policies. MFA, 12 characters, or 8 plus a deny list; no expiry, no complexity. If your policy still forces quarterly changes, update it.

The renewal checklist

1. Update the asset register. Devices bought and retired, operating-system versions now, new cloud services, leavers and joiners. The interactive checklist and the asset register template cover it.
2. Re-check the automatic fails first. MFA on every account of every service, every device supported, updates within 14 days.
3. Re-read your policies. Do they still describe what you do? A policy that says “we review admin accounts quarterly” needs to have happened.
4. Re-read last year’s answers. Anything you answered with “we plan to” needs to be true now.
5. Buy the assessment and submit with a few weeks in hand.

Staying ready all year instead

The businesses that find renewal easy are the ones that never let the controls lapse: MFA is switched on the day a new tool is adopted, accounts are disabled the day someone leaves, automatic updates stay on, and the asset list is a living document. A quarterly ten-minute re-check catches drift while it is small. That is the difference between renewal as a tick-box and renewal as a scramble.