Cyber Essentials renewal in 2026: what changes under v3.3

Renewal is a full assessment, not an update

A renewal is not a short form confirming nothing has changed. IASME’s guidance is that you enter all the information each time you certify, and since 27 April 2026 that information is answered against requirements v3.3 and the Danzell question set. If your certificate was issued before that date, your renewal is the first time your organisation is assessed under these rules.

The five control areas are the same as before. What changed is how strictly two of them are now scored, which is the subject of the next section, and how scope is drawn around cloud services, remote workers and personally owned devices, covered in our guide to the v3.3 requirements.

The three automatic fails

IASME’s April 2026 update made three items decisive. Non-compliance with any of them fails the assessment regardless of how well the rest of the answers score. The wording below is IASME’s own.

Two details catch renewing organisations out. The MFA rule applies even where the provider charges extra for it, so “it’s a paid add-on” is no longer an answer. And the patching questions cover firmware and applications as well as the operating system, so a fully patched Windows laptop running an out-of-date browser extension, or sitting behind a router that has not had a firmware update, can still fail.

A renewal timeline that leaves room to fix things

• 60 days before your certificate date. List every cloud service the business actually uses, not only the ones IT set up, and check MFA is on for every user of each one. This is usually the longest job, because the list is longer than anyone expects.
• 45 days before. Build or update your software inventory and confirm everything is still supported by its vendor. Anything past end of support cannot be patched, so it needs replacing or removing from scope.
• 30 days before. Check update history against the 14-day rule for operating systems, router and firewall firmware, and applications. Fix the process, not just the backlog, because the rule applies continuously.
• Renewal week. Re-read every answer against how the business works today, then submit.

Don’t start too early either. IASME notes that a new certificate is valid for 12 months from the date of submission, not from the expiry of the previous one, so submitting months ahead shortens your cover. Preparing early and submitting close to the date gets both.

If the assessment does fail, IASME’s guidance gives two working days to make suitable changes, update your answers and resubmit. That is enough time to switch on MFA for a forgotten service. It is not enough time to replace unsupported software, which is why the inventory comes first.

What last year’s answers usually miss

• Cloud services adopted during the year. A file-sharing tool for one client, a design app, a free trial that was never cancelled. Teams sign up for things directly, and those services rarely reach the central list.
• Personal devices that now open work email. Scope covers personally owned devices that can access organisational data or services, not only equipment the company bought.
• Home working. The NCSC requirements put a home worker’s router in scope only if the organisation supplied it. Otherwise, firewall controls such as a software firewall have to be applied on the device itself.
• People who joined or left. New starters, leavers and changed roles all affect user accounts and administrative access.

Why letting it lapse costs more than the fee

Government buyers using Procurement Policy Note 014 expect Cyber Essentials to be renewed every year, and the government’s Cyber Security Breaches Survey 2025/26 found that around a quarter of large UK businesses now require suppliers to hold it. The cyber liability insurance included with certification for eligible organisations is also tied to the certificate: IASME says the policy cannot be renewed on its own, so keeping the cover means renewing the certification or buying a separate policy.