Staying ready between renewals

Passing once is a good result, but Cyber Essentials is not a one-off task. Your business changes, staff come and go, and the requirements are updated. This article explains why renewal is annual in many contracts and which habits keep you ready without a yearly scramble.

Why renewal matters

The Cabinet Office’s PPN 014 says that where Cyber Essentials certification is required for a public contract, the supplier must renew it annually for the duration of the contract.

The NCSC’s resources page also says the requirements are reviewed and updated regularly to ensure they remain relevant. Version 3.3 took effect on 27 April 2026, so the rules you met last year may not be exactly the rules you meet at renewal.

There is a further reason to renew on time. The NCSC overview says that UK organisations with turnover under £20 million that certify their whole organisation are entitled to cyber liability insurance arranged by IASME. That entitlement follows certification, so a lapse is worth avoiding.

The habits that keep you ready

The requirements describe several things you must do regularly, and most of what keeps you ready is simply doing those things as a routine.

Weekly: updates

Security updates for critical and high risk issues must be installed within 14 days of release, so a weekly check is the natural rhythm. Confirm that automatic updates have landed on every device, including laptops that were switched off or travelling. Our article on the 14-day rule explains the details.

When someone joins: accounts and devices

The control on user access asks for a process to create and approve accounts, unique credentials for each user and MFA wherever it is available, always for cloud services. Make this a short checklist for new starters: create the account, turn on MFA, give the access they need, record the device they use.

When someone leaves: remove access

The requirements say accounts must be removed or disabled when they are no longer required, for example when a user leaves, or after a defined period of inactivity. Treat that as part of your leaving process on the last day, not a later clean-up. Special access privileges should also be removed when a member of staff changes role.

Monthly: look at your list

Asset management is not a Cyber Essentials control, but the document says it helps with all five. It means keeping accurate information you actually use. Once a month, check that your list of devices, software and cloud services still matches reality.

Look for:

• new cloud services someone signed up to, which must be in scope and use MFA
• personal devices now reading work email
• software approaching the end of vendor support, which must be removed or isolated
• firewall rules that are no longer needed, which the requirements say to remove or disable

When you buy or change something

New laptops, a new router or a new cloud service all change your scope. The document says default passwords must be changed, unneeded accounts and software removed, and firewalls configured. Do these at set-up, when it is easiest.

Quarterly: check administrator accounts

The requirements say administrative accounts should be used only for administration, with no emailing or web browsing, and that special access privileges should be removed when no longer needed. Every few months, list who holds an administrator role, confirm each person still needs it, and check that they use a separate account for everyday work.

Keep backups tested

Backups are not a technical requirement, but the document highly recommends them and emphasises their importance. Check now and then that your backups run and that you can restore something from them.

Keep a short change log

A single page noting what changed and when, such as a new supplier with access to your systems or a new office, makes your answers at renewal quicker. If a supplier manages part of your infrastructure, you must be able to confirm that the controls are met.

Preparing for renewal itself

A few weeks before the renewal date:

1. Read the current requirements and question set again, in case anything has changed. The NCSC points to the free question set download and a Readiness Tool.
2. Check your scope still matches the business. Agree changes with your certification body.
3. Run through the five controls using the list you have kept.
4. Make sure the person who signs off your answers, a board member or equivalent, is available.

If you hold Cyber Essentials Plus, remember that the assessor verifies your scope against your self-assessment certificate. Keeping the standard certificate current matters.

In short

Where contracts require it, Cyber Essentials must be renewed every year, and the requirements themselves are reviewed regularly. Keep ready by checking updates weekly, handling joiners and leavers properly, reviewing your asset list monthly and noting changes as they happen. Renewal then becomes a review rather than a rebuild.

How Vigil CE helps

Vigil CE keeps your Cyber Essentials position up to date through the year, with reminders for the regular checks and a running record of your devices, accounts and decisions. When renewal comes round, your evidence is already in one place and you can see what has changed since last time.