Cyber Essentials renewal season: why this year's renewal is not last year's form

Most of the Cyber Essentials certificates we look after come up for renewal between November and March. That's not a scheme rule, it's just when businesses tend to sort these things out: tender season, insurance renewals, and the year-end tidy-up all land in the same window. This year that window matters more than usual, because anyone who certified before 27 April 2026 was assessed against the old requirements, and their renewal will be the first one marked against the new ones.

The new version is not a rewrite. The five controls are the same. But the marking has changed in a way that catches businesses who passed comfortably last year, and it's worth being specific about where.

What actually changed on 27 April 2026

The current technical standard is version 3.3 of the Requirements for IT Infrastructure, and the matching question set is called Danzell. Any assessment account created from 27 April onwards is marked against it. Accounts opened before that date could carry on under the previous version for up to six months, which is why some businesses renewed in the summer without noticing a difference. That grace period has now run out, so every renewal from here is on the new set.

The changes IASME announced fall into two groups. The first is clarification: a proper definition of what counts as a cloud service, a definitive statement that cloud services cannot be excluded from scope, passwordless sign-in explicitly recognised, and a stronger emphasis on backups. None of that is a problem for a well-run business.

The second group is marking, and this is the one that matters. Three questions are now automatic fails:

• Multi-factor authentication on cloud services. If a cloud service offers MFA, whether free, included or a paid extra, it has to be on for every user. One account without it fails the whole assessment.
• Question A6.4. All high-risk or critical security updates for operating systems and for router and firewall firmware installed within 14 days of release.
• Question A6.5. The same 14-day rule for applications, including browser extensions and associated files.

Under the old marking, a weak answer on patching could be compensated for by strong answers elsewhere. It can't now. The scheme has also made explicit that the "point in time" for support status is the date the certificate is issued. If something in scope goes out of support between you submitting and the assessor marking, that's your problem, not a technicality.

The three things that fail renewals this winter

We've been running renewal gap checks since the summer, and the same three issues keep appearing. In order of how often we find them:

One, a cloud service nobody thought of as IT. The accounts package, the recruitment CRM, the booking system, the company's social media logins. Last year these were often left out of scope on the grounds that "it's just a website we log into". The new definition closes that door. If it holds business data and you sign in to it over the internet, it's in scope, and if it offers MFA then MFA has to be on. The practical job is a list: every service, every user, MFA status. It takes an afternoon and it finds things.

Two, Windows 10. Microsoft stopped supporting Windows 10 on 14 October 2025. IASME's position is that any Windows 10 machine still in use must be enrolled in the Extended Security Update programme to remain compliant, and that machine must be on version 22H2 to enrol. A business that renewed in early 2025 could legitimately have had a dozen Windows 10 laptops in scope. Twelve months on, each of those is either upgraded, enrolled in ESU with the subscription active, or an automatic fail. We're finding the third more often than you'd expect, usually on the machine that sits in the corner running the label printer.

Three, firmware on the firewall and router. A6.4 names router and firewall firmware specifically. Most small businesses patch laptops reasonably well because the laptops nag them. The firewall doesn't nag anyone. We regularly open a renewal and find a perimeter device that hasn't had a firmware update in eighteen months, sometimes because the support contract that entitled it to updates lapsed and nobody noticed. Under the old marking that was a conversation with the assessor. Under A6.4 it's a fail.

The mistake that shortens your certificate

This one isn't about failing. It's about timing, and it costs businesses weeks of coverage every year.

Your new certificate runs for twelve months from the date it's issued, not from the expiry date of the old one. IASME says this plainly, and it has a consequence people don't expect: if you renew six weeks early because the tender needs it, you've just moved your renewal date six weeks earlier, permanently. Do that for three years running and your "annual" renewal is now coming round every ten months.

The other side of the same coin is leaving it late. You have six months from opening an assessment account to submit, but the certificate is only issued when you pass. If you open the account three weeks before expiry and the first attempt throws up a Windows 10 machine and an un-MFA'd CRM, you lapse. IASME removes businesses from the certified list if they haven't recertified within twelve months of the last certificate, and a tender portal checking that list on the wrong day doesn't care why.

The sensible pattern is to do the preparation work early and the submission close to the expiry date. That's what we do for clients: the gap check happens eight weeks out, the fixes happen in weeks six to three, and the questionnaire goes in during the last fortnight so the new certificate starts as close to the old one ending as possible.

What we check in the eight weeks before a renewal

For a fifteen-to-fifty person business, this is the sequence, and it's deliberately boring.

Week eight: scope and inventory. Every device that touches business data, including phones and anything personal that reads company email. Every cloud service, using last year's submission as a starting point and the finance system's subscriptions list as a cross-check. Every user account. This is also where we find the leaver whose account is still enabled.

Week seven: the automatic-fail sweep. MFA status on every cloud service for every user. Operating system versions and support status on every device, with Windows 10 machines flagged for upgrade or ESU. Firmware version and support contract on the firewall and router. Browser extensions, because A6.5 now names them.

Weeks six to three: fixes. In practice this is enforcing MFA on the stragglers, replacing or upgrading the Windows 10 estate, bringing the firewall firmware current and renewing its support if needed, and removing software that's out of support rather than trying to justify it. If the business has a managed device policy in place this is usually days. If the fleet is unmanaged it's the bulk of the project, and it's the reason some businesses end up moving to managed IT support off the back of a renewal.

Week two: the questionnaire. We fill it in against the evidence, not from memory. IASME's own advice is to keep a copy of last year's answers, and it's good advice, but the answers get re-entered from scratch every year and the questions have changed, so last year's copy is a reference, not a template.

Week one: sign-off and submit. A board-level person or the business owner signs the declaration. That signature means something under the new marking: it's a statement that the automatic-fail controls are in place, and the assessor is entitled to take it at face value.

If you're also renewing Cyber Essentials Plus, the audit needs to happen within three months of the base certificate being issued, so the two get planned as one project. Brett wrote up what the audit day actually looks like in September and nothing in it has changed since.

Why this is worth doing properly rather than quickly

It would be easy to read all of this as a scheme getting fussier for the sake of it. I don't think that's right. The three automatic fails are the three things that, in our own incident work, most reliably separate the businesses that have a bad morning from the businesses that have a bad month. MFA off on one account is how mailboxes get taken over. A firewall on old firmware is how attackers get into a network without anyone clicking anything. An unpatched application is how ransomware moves once it's in.

The renewal is a once-a-year forcing function to go and look at those three things with fresh eyes. The businesses that treat it that way find the renewal itself is straightforward, because the work has been done in the other eleven months. The ones that treat it as a form to get through find that the form has got harder, and that's rather the point.

If your certificate expires between now and March and you're not sure which version you were last assessed against, the quickest way to find out is to check the date on the certificate. Before 27 April 2026 means your renewal is on the new set. We run a renewal gap check as a fixed piece of work, it takes a couple of hours of your time, and it tells you in writing whether you're a fortnight away or two months away. Get in touch if that would be useful.

FAQ

How do I know whether my renewal is on the new question set?

If your assessment account was opened on or after 27 April 2026, it's on the Danzell question set and version 3.3 of the requirements. Accounts opened before that date could use the previous version for up to six months, and that window has now closed. Any renewal you start from here will be on the new set.

What are the automatic-fail questions in Cyber Essentials now?

Three areas fail the assessment outright regardless of other answers: multi-factor authentication not enabled on a cloud service that offers it; high-risk or critical updates for operating systems and router or firewall firmware not installed within 14 days (A6.4); and the same for applications and extensions (A6.5). Unsupported software in scope has always been a fail and still is.

We still have Windows 10 machines. Will we fail?

Not automatically, but only if each one is on version 22H2 and enrolled in Microsoft's Extended Security Update programme with the subscription active at the date of certification. A Windows 10 machine that isn't enrolled is unsupported software in scope, which fails. For most businesses it's cheaper and simpler to replace the handful that can't run Windows 11 than to manage ESU for a year.

When should we start the renewal?

Start the preparation about eight weeks before the certificate expires and submit in the last fortnight. The new certificate runs twelve months from the date it's issued, so submitting early shortens your coverage, and submitting too late risks a lapse if the first attempt finds a problem.

Does Cyber Essentials cost more now?

The scheme fees haven't changed with the April update: tiered pricing from £320 plus VAT for micro organisations, rising with headcount, with Cyber Essentials Plus quoted separately. Where businesses see extra cost at renewal it's remediation, most often replacing Windows 10 hardware or renewing a firewall support contract, rather than the certification itself.

Do we have to answer every question again?

Yes. The information is re-entered each year and treated as an annual review, and the questions change between versions. Keep a copy of what you submitted last year as a reference, but check each answer against what's actually in place now rather than copying it across.