Getting Cyber Essentials certified is an important milestone for any organisation. It demonstrates, above all, that fundamental technical controls are in place to provide protection against the most common cybersecurity threats, reassuring customers and regulators that you take security seriously.
For some businesses, certification is initially driven by a tender, customer requirement or supply-chain opportunity. Once that immediate need has passed, however, there is still good reason to keep Cyber Essentials in place.
Like an MOT, certification gives you a regular check that the basics are still in order. People join and leave, devices change, software is updated and new risks emerge, so the controls that passed assessment last year still need attention today.
Cyber Essentials is therefore something to maintain, rather than complete once and forget about. Certification must be renewed annually, and recertification can be more challenging than the initial assessment if those changes have not been kept on top of.
In this guide, we’ll look at what Cyber Essentials renewal and recertification involves, why keeping your certification current is worthwhile and how your business can prepare for the process.
Getting Cyber Essentials certified: a recap
Cyber Essentials is a UK Government-backed scheme designed to help businesses safeguard their digital assets against the cybersecurity threats they’re most likely to encounter. It centres on five key pillars: firewalls, secure configuration, access control, malware protection and patch management.
There are two levels to Cyber Essentials: Cyber Essentials basic and Cyber Essentials Plus. Cyber Essentials candidates are required to complete a self-assessment questionnaire, while Cyber Essentials Plus involves an independent assessment to verify that controls are correctly implemented. The scope and requirements involved remain the same, however.
How often do you need to renew Cyber Essentials?
Cyber Essentials certification is valid for 12 months, after which it expires. If you want your organisation to remain certified, it will need to go through the assessment process again so that your certification can be renewed.
The reason for annual renewal is that cybersecurity threats are continually evolving, while organisations’ IT environments can also change significantly over a year with the addition of new users, devices, software and so on. Regular renewal ensures continued compliance.
If you allow your business’s certification to lapse, it’s likely to be ineligible for certain contracts where Cyber Essentials certification is a prerequisite, which is especially common in the public sector.
What does Cyber Essentials renewal require?
To renew Cyber Essentials certification, organisations must resubmit the self-assessment questionnaire to confirm that their controls still adhere to the relevant requirements. Firms looking to renew Cyber Essentials Plus must undergo independent testing again.
Changes that have occurred since the previous assessment must be accurately reflected. This may include, for example, the addition of new users, cloud platforms, remote working arrangements or alterations to how systems are managed. Such changes can result in weaknesses that were either not present or not noticeable at the previous assessment.
Common renewal challenges
There is a tendency in many organisations to assume that, in terms of technology and cybersecurity, little changes over the course of a year. However, modest changes soon add up. Inconsistent patching practices, new software tools or a few unmanaged devices can mean a failure to obtain renewal.
Policy drift is another common challenge. Everyday practices may no longer adhere to policies as put down on paper. Patching might not be as consistent as originally intended, asset inventories might have gaps in them, or access controls may have weakened. Often, these issues only come to light during the renewal process, giving organisations little time to resolve them.
How to make Cyber Essentials Renewal easier
The best way to approach Cyber Essentials renewal is to prepare well ahead of time. Don’t leave your preparations until your certification is on the verge of expiry; this often leads to rushed fixes which can cause further complications. Carry out an internal review or gap analysis at least a few weeks in advance, as this gives you more time to resolve any problems that crop up.
Your organisation should also review its policies, access controls, device and software inventories, and patching processes to see whether they accurate reflect day-to-day practice. Assessing potential vulnerabilities proactively, instead of waiting for the assessment to pick up on them, significantly increases the chances of renewing your certification successfully.
See our guide on completing the Cyber Essentials Questionnaire for a refresher of what you'll need to demonstrate to assessors.
Why renew if you no longer need Cyber Essentials for a contract?
A tender may have prompted you to get certified, but there is a good reason to keep Cyber Essentials in place once that tender is over.
Think of renewal in much the same way as an annual MOT. Passing last year confirmed that the essentials were in order at the time; another year of everyday use and change means they need checking again.
The same applies to your IT. New employees need access, old accounts need removing, devices are replaced and software receives security updates. Keeping on top of those changes throughout the year helps prevent small weaknesses from becoming bigger ones and makes recertification far less onerous.
There is a commercial benefit too. Keeping your certification current means you already have recognised evidence of your cyber controls when the next customer or tender asks for it, rather than having to start the process again under a deadline.
For businesses without dedicated cyber security resource, regular support can help maintain those controls between annual assessments. Vulnerability assessments and reviews of areas such as patching, access and devices can identify gaps while there is still time to address them.
Cyber Essentials then becomes part of the way you protect the business year after year, rather than something you revisit only when a customer asks for a certificate.
Renew your Cyber Essentials certification with Cyber Tec
We can help guide you through the renewal process, and ensure your recertification goes smoothly. Get in touch with our team today to book your recertification.
