The renewal planner
Cyber Essentials lasts twelve months, and renewal is a full reassessment against whatever the rules are then — not a form. Enter your expiry date and get the timeline back from it: what to do six weeks out, a month out, a fortnight out. Dates stay in your browser.
Plan your renewal
Why work backwards
Renewal fails for calendar reasons as often as technical ones. The assessment itself is an afternoon; what needs lead time is everything the year quietly changed — a new cloud tool nobody switched MFA on for, a laptop that fell out of support, a leaver whose accounts outlived them — plus the assessor’s review at the end, whose length is set by your certification body, not you. Working back from the expiry date turns all of that into five dated steps instead of one bad week.
The shape of the plan
Six weeks out, refresh the asset register — it is the source for a third of the questionnaire. Five weeks out, re-check the automatic fails (MFA everywhere, supported operating systems, the 14-day update rule), because those decide the result and take the longest to fix. Four weeks out, fix what you found. Three weeks out, re-read your policies and last year’s answers — anything answered “we plan to” must be true now. Two weeks out, buy the assessment and submit, keeping the margin for review. If the rules changed since you last certified — and in 2026 they did — the 2026 changes guide lists exactly what moved.
If you are already inside the window
Compress, don’t panic: the automatic fails first, everything else after. Most MFA and update fixes are same-day; the genuinely slow item is an unsupported device, which needs a decision rather than a setting. Tell your certification body the timeline you are working to, and if a client depends on continuous certification, tell them too — a known one-week gap handled openly is a smaller problem than a surprise.
Frequently asked questions
When should I start my Cyber Essentials renewal?
About six weeks before the expiry date: a week to update your asset list and re-check the automatic fails, time to fix what the year introduced, and a two-week margin for the assessor’s review. Ask your certification body how long their review typically takes.
Where do I find my certificate expiry date?
On the certificate itself — it is valid for twelve months from issue. Your certification body’s emails will also state it.
What happens if my certificate expires before the new one is issued?
There is a gap in your certification. Whether that matters depends on your clients and contracts, so if a contract relies on continuous certification, plan to have the new certificate issued before the old date and tell the client if it will be tight.
Is renewal easier than the first certification?
It is a full reassessment against the current question set, so the work is the same in kind. It is easier in practice only if you kept the controls live during the year — MFA on new tools, leavers removed, updates automatic — which is what the timeline in this planner checks.