How to check a supplier’s Cyber Essentials certificate

A supplier ticks “Cyber Essentials: yes” on your questionnaire, or shows the badge on its website. Neither tells you whether a certificate exists, whether it is current, or whether it covers the part of the business you deal with.

The check takes a couple of minutes, because there is an official search. This guide covers where to look, what to match, how long a certificate lasts and what changed in 2025 and 2026.

The short version

1. Ask for the certificate. You need the certified organisation’s name and the certificate number.
2. Search for it. Use the Cyber Essentials Certificate Search, by organisation name or certificate number.
3. Match the details. Check the legal entity, the level, the date and the scope against what the supplier sent.
4. Check the date. Certification is renewed every year. If the certificate is not in the search, which lists certificates issued in the last 12 months, treat it as expired until the supplier shows a renewal.
5. Record the check. Keep the search result, or a screenshot, with the date you checked.

What Cyber Essentials is

Cyber Essentials is a UK government-backed certification scheme run under the National Cyber Security Centre (NCSC). It covers five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. IASME is the NCSC’s official delivery partner and manages the certification bodies that assess organisations.

There are two levels:

• Cyber Essentials. A self-assessment against the requirements, checked by an independent certification body.
• Cyber Essentials Plus. The same requirements, with independent technical testing that checks the controls work in practice.

If your requirement says “Cyber Essentials Plus”, a Cyber Essentials certificate does not meet it.

Where to check

The Cyber Essentials Certificate Search finds organisations holding a Cyber Essentials or Cyber Essentials Plus certificate issued in the last 12 months. You can search by organisation name or certificate number. IASME restricts the search to checking certification; it must not be used for marketing or data research.

If you check many suppliers, IASME also offers a free Supplier Assurance Tool for organisations checking the certification of their suppliers and contractors. It requires registration and has its own terms of use.

What to match

The scope matters more than it looks. An organisation can certify the whole business or a defined part of it. If the part that hosts your data or supports your service is outside the scope, the certificate does not speak to it.

How long a certificate lasts

Cyber Essentials certification is renewed every year. Government contracts in scope of PPN 014 say so explicitly: the certificate must be renewed annually for the duration of the contract. In practice, put the renewal date in your supplier record and ask for the new certificate a month before it falls due. The search will show the renewed certificate once it is issued.

Government contracts and PPN 014

Procurement Policy Note 014 applies to central government departments, their executive agencies and non-departmental public bodies, and NHS bodies. It took effect on 24 February 2025 and replaced PPN 09/14 and PPN 09/23.

For contracts with certain characteristics, such as handling citizens’ personal data, government employee information, or ICT systems that process OFFICIAL information, the supplier must hold Cyber Essentials or Cyber Essentials Plus, or demonstrate equivalent controls by other means. The evidence is needed at the point data is passed to the supplier, and certification must be renewed annually for the life of the contract.

If you supply government yourself, your own suppliers may fall within these requirements through your contract. Check what your contract passes down.

What changed in April 2026

The NCSC and IASME review the requirements every year. Version 3.3 of the Cyber Essentials Requirements for IT Infrastructure, with the Danzell question set, applies to assessments created on or after 27 April 2026; assessments created before that date continue on the previous Willow question set.

The changes are mostly about clarity: updated terminology, revised scoping rules, and guidance on cloud services, multi-factor authentication, application development and backups. Two points are now automatic fails: multi-factor authentication must be enabled wherever a cloud service offers it, and security updates must be managed as the requirements set out.

For a buyer, the practical point is simple. A certificate issued after late April 2026 was assessed against the newer, stricter requirements. A certificate issued before then is still valid until its renewal falls due.

Red flags

• The supplier says it is “Cyber Essentials compliant” or “working towards” it. That is not certification.
• The certificate cannot be found in the search, and the supplier cannot explain why.
• The name on the certificate is a trading name, or a different company in the group.
• The scope excludes the systems that handle your data.
• The badge on the website is the only evidence offered.

Where DataStruct fits

DataStruct reads a supplier file against your requirements. For a Cyber Essentials requirement, it finds the certificate or questionnaire passages that support it, links each one to the file and page it came from, shows the level, date and scope those passages state, and says so when nothing on file supports the requirement.

It does not query the Cyber Essentials Certificate Search, and it does not decide whether a certificate is current. That check, and the decision, stay with your reviewer. The wider process is in how to review supplier compliance evidence, and the equivalent check for management-system certificates is in how to verify a supplier’s ISO certificate.