In this guide · 7 sections
Short answer
A Cyber Essentials certificate lasts two years. To renew, you re-apply: complete CSA's current self-assessment template and go through a certification body's desktop review again. Refresh your asset list, patching, MFA and backup evidence first. CSA's funding applies only to the first successful certification.
How Cyber Essentials renewal works
CSA's Certification for the Cyber Essentials mark page (last updated 7 October 2026) states the mark is valid for two years, assessed by desktop review and verification of your self-assessment by an independent assessor from a CSA-appointed certification body.
The Cyber Essentials (2025) certification document describes the life cycle in section 4.7: after the two-year period, the organisation may re-apply for the Cyber Essentials mark, or consider the Cyber Trust mark if its risk profile has changed. In practice, renewal is a new certification.
Note your expiry date
Find it on your certificate. Start about three months before, so fixes and evidence are ready in time.
Download the current self-assessment template
Use the Cyber Essentials (2025) template from CSA's page, not the one you used two years ago. The requirement wording and numbering may differ.
Complete the self-assessment
The standard says you must complete it before engaging a certification body, marking which requirements and recommendations are in place.
Choose a certification body
You can return to the same body or pick another CSA-appointed one. Ask for its fee for your number of end-points.
Independent assessment
The assessor reviews documents and evidence and may apply professional judgement for your business. You must meet all requirements to be certified.
What changed in Cyber Essentials (2025)
If you were certified under the 2022 edition, the main differences are in scope. The 2025 document is the second edition, published in April 2025, and CSA's page notes its documents were last updated in April 2026.
| Area | What it means at renewal |
|---|---|
| Classical cybersecurity | The core set every organisation is assessed on, as before |
| Cloud security (optional) | Extra statements for cloud-specific risks, such as keeping business-critical cloud data backed up separately |
| OT security (optional) | For businesses running operational technology, such as factory or building systems |
| AI security (optional) | For example, the asset inventory should include free or public AI services and enterprise AI tools |
| Sector sub-schemes | Separate versions for ICT vendors under SMEs Go Digital, HIA entities and HIMS vendors |
CSA lists separate funding amounts for each extra digital technology pillar, which shows they are treated as additions to classical scope rather than replacements. Decide with your certification body which scope fits your business before you start.
Evidence assessors check again
Two years is a long time in a small office: people join and leave, laptops are replaced, new cloud tools appear. The standard itself recommends several reviews within the certification period, which is why stale records show up at renewal.
Renewal evidence checklist
Our Cyber Essentials checklist explains each requirement area for a small office in more detail.
Funding and cost: renewal is not subsidised
CSA's funding support for the Cyber Essentials mark is deducted from the certification body's fee, but CSA states it applies only to the first successful Cyber Essentials certification per organisation, and only for SMEs and non-profits incorporated in Singapore. It is listed as available until 6 February 2028.
| End-points | Maximum CSA funding, classical scope (first certification only) |
|---|---|
| 1 to 10 | S$250 |
| 11 to 20 | S$350 |
| 21 to 50 | S$450 |
| 51 to 100 | S$600 |
| 101 to 200 | S$650 |
So budget for the full certification body fee at renewal. Fees are set by each certification body and depend on scope; CSA does not publish them. Our guide to Cyber Essentials and Cyber Trust funding covers other support schemes.
Renew Cyber Essentials or move to Cyber Trust?
Renew Cyber Essentials if
- Your business and IT set-up are similar to two years ago
- Clients or tenders ask only for Cyber Essentials
- You have no in-house security staff
- Your main risks are everyday ones: phishing, ransomware, lost laptops
Consider Cyber Trust if
- You now handle more sensitive data or larger contracts
- A major client asks for a risk-based certification
- You have grown into many more systems or sites
- You supply critical sectors with stricter requirements
The standard itself points to Cyber Trust when your risk profile has changed. If you are unsure, ask the certification body or a consultant to compare the two against your current situation; our guide to choosing a Cyber Essentials consultant lists what to ask.
Do it yourself or get help?
If your first certification went smoothly and someone kept the evidence up to date, renewal is mostly paperwork: a fresh self-assessment and a refreshed evidence folder. If records lapsed, start early.
Our CSA Cyber Essentials Readiness (S$990, up to 15 users) runs a gap check against the current requirements, builds the hardware and software asset list, assembles the policies and evidence pack, drafts the self-assessment answers for your review, and helps you choose a certification body. Fixes from our catalogue are quoted separately if needed. IT Sorted is a Singapore-based team of developers with over 10 years of experience; you pay upfront, send the brief in writing and follow progress on your order page.
Frequently asked questions
Two years. CSA's certification page and the Cyber Essentials (2025) document both state that certification remains valid for two years. After that period, the organisation may re-apply for the Cyber Essentials mark or consider moving to the Cyber Trust mark if its risk profile has changed.
CSA's documents describe renewal as re-applying. You complete the current self-assessment template and a CSA-appointed certification body carries out a desktop review and verification again. Keeping evidence up to date during the two years makes this much faster, but the assessment itself is a full one.
No. CSA states that its funding support for the Cyber Essentials mark applies only to an organisation's first successful certification, and only to SMEs and non-profits incorporated in Singapore. At renewal you pay the certification body's full fee.
The Cyber Essentials (2025) document presents cloud, OT and AI security as areas an organisation may add to its scope as it adopts those technologies. Classical cybersecurity remains the core. Agree the scope with your certification body before you complete the self-assessment, as each added area brings its own statements to meet.
Yes. CSA's page says organisations may approach any of the certification bodies it has appointed. Fees and timelines differ between bodies and depend on the scope of certification, so it is reasonable to ask two or three for a quote before renewing.