Cyber Essentials renewal: when to start and what changes

Cyber Essentials certification lasts 12 months from the date it's issued, and it doesn't roll over automatically. Renewing means submitting a fresh self-assessment against whatever the current question set requires, not just confirming last year's answers still stand.

It's worth starting the renewal process well before the certificate expires, rather than waiting for the deadline. If a contract, tender, or insurance policy requires continuous certification, a gap between one certificate lapsing and the next being issued can matter, even if it's only a few weeks.

A business that passed comfortably last year can still fail this year's assessment if the rules moved and nobody checked what changed.

The requirements themselves can also change between versions, as they did with the April 2026 "Danzell" update to v3.3. A business that passed comfortably last year can still fail this year's assessment if the rules moved and nobody checked what changed.

On top of that, the environment being assessed has usually moved too: new starters, new devices, new cloud tools the team picked up over the year that were never formally approved. Renewal is a genuine re-check of where things actually stand, not a rubber-stamp. Run the free 5-minute readiness check to see where you'd land against the current rules before your renewal is due.