A supplier has sent over their Cyber Essentials certificate, or a tender wants proof your subcontractors hold one. Checking a business is on the official register takes about two minutes. Working out whether the certificate covers the thing you’re actually buying from them takes a bit longer, and it’s the step most people skip.
How do you check whether a supplier really holds Cyber Essentials?
IASME is the NCSC’s delivery partner for Cyber Essentials and runs the official certificate search. The NCSC’s own Cyber Essentials page links straight to it. Several IT providers have built checker tools of their own, but we’d go to the source.
- Open the IASME certificate search.
- Type the supplier’s registered company name or its certificate number.
- Find the correct company in the results.
- Read the level, the certification date and the expiry date.
- Compare the company name with the name on your contract.
The search only shows certificates issued in the last 12 months. Cyber Essentials renews every year, so if a business doesn’t appear, it has most likely let its certificate lapse, never held one, or been certified under a different name.
Treat a PDF or a website badge as a claim
A PDF certificate or a logo on a website only shows what the supplier is telling you, so check it against the register anyway. Website badges are the least reliable, mostly because nobody remembers to take them down when a certificate expires.
Checking a long list of suppliers
If you’ve got dozens of suppliers to review, IASME offers a free Supplier Assurance Tool for checking them in bulk. You register, IASME verifies your organisation, and you can then check suppliers in batches. Both the tool and the public search are restricted to checking certification, so they can’t be used for marketing or research.
For most SMBs, the public search is plenty. The bulk tool earns its keep if you run a formal annual supplier review.
What does the register tell you, and what can’t it tell you?
A result shows the company name, certificate reference, level (Cyber Essentials or Cyber Essentials Plus), certification date and expiry date. That answers three of the four questions that matter. The fourth, scope, isn’t on the register at all.
Scope: the part that’s easy to miss
The current Cyber Essentials requirements (v3.3, published by the NCSC in April 2026) expect a certificate to cover all the IT a business uses to operate, or a clearly defined part of it that’s managed separately. Two things can’t be carved out. On devices, the requirements say plainly: “A scope that doesn’t include end-user devices isn’t acceptable.” Cloud services that hold the organisation’s data must be included too.
That still leaves room for a partial scope. A group could certify its head office and leave out a separately run studio or a subsidiary. If the work you’re buying happens in the excluded part, the certificate doesn’t cover your service.
The register won’t show any of this, so ask the supplier for their scope statement, which devices it covers, and whether staff’s own phones and laptops are included. Under the requirements, personal devices that access company data or services are in scope.
The certified company has to match your contract
Groups often run several companies with near-identical names. A certificate held by Halden & Pike Ltd says nothing about Halden & Pike Holdings Ltd, if that’s the one you’ve signed with. In Dr Logic’s experience, this is the mismatch that turns up most often in supplier reviews: a genuine, current certificate that belongs to a sister company.
What should you do when the answer isn’t what you expected?
Most surprises fall into one of four buckets.
- Not on the register. Search the trading name as well as the registered name, then ask for the certificate number. It’s often just a naming difference.
- Lapsed. Ask whether renewal is underway and when they expect the new certificate. A short gap at renewal time happens; a gap of several months needs a proper conversation.
- Wrong level. If your contract specifies Cyber Essentials Plus and they hold Cyber Essentials, raise it with whoever owns the contract. Our Cyber Essentials vs Cyber Essentials Plus guide explains the difference.
- Scope excludes your service. Ask which controls apply to the part of the business doing your work, and get the answer in writing.
Your own clients will be running the same check on you
Everything above works in reverse. When a client sends you a security questionnaire, they’ll want your certificate number, level, expiry and scope. Keep all four somewhere you can find in a minute, and the questionnaire gets a lot shorter.
The scope is the bit that drifts. Teams take on freelancers, and more people check email on personal phones. If your renewal is coming up and you’re not sure the scope still matches how the team works, we’re happy to take a look. If you run an all-Mac office, our guide to Cyber Essentials on a Mac-first team covers the specifics.
Would your own certificate pass this check?
We’ll look over your Cyber Essentials scope and tell you plainly whether it still matches how your team works today.
A four-point check for the next certificate you receive
Run this on the next supplier certificate that lands in your inbox. It takes about five minutes.
- Search the IASME register. Confirm that the business is on it.
- Read the expiry date. Confirm that the certificate is current.
- Read the level. Confirm that it is the level your contract needs.
- Get the scope statement. Confirm that it includes the service you use.
If any of the four fails, send this:
Thanks for sending your Cyber Essentials certificate. Before we sign off, could you send your current certificate number and scope statement, and confirm the certified company is [contracting entity name]?
Related articles
- The difference between Cyber Essentials and Cyber Essentials Plus
- Why most UK businesses are failing Cyber Essentials Control 3
- Cyber Essentials has changed. Here’s what the April 2026 Danzell update means for your Mac fleet
FAQs
Is the IASME Cyber Essentials certificate search free?
Yes. You can search the public register by company name or certificate number without paying or signing up. For checking lots of suppliers at once, IASME offers a free Supplier Assurance Tool, which needs registration and verification first. Both are restricted to checking certification, so you can’t use them for marketing or research.
How long does a Cyber Essentials certificate last?
A Cyber Essentials certificate lasts 12 months, and the business has to recertify every year to keep it. The IASME register shows certificates issued in the last 12 months, each with an expiry date. If a supplier’s date has passed, ask when their renewal is due before you treat them as certified.
Can a business leave laptops or cloud services out of its Cyber Essentials scope?
No. Under the current requirements (v3.3), a scope that leaves out end-user devices isn’t acceptable, and cloud services holding the organisation’s data must be in scope. A business can still certify a separately managed part of itself, which is why it’s worth asking for the scope statement.
Is a Cyber Essentials logo on a website proof of certification?
A logo shows the supplier is telling you they’re certified, and that’s all. Badges often stay on websites after a certificate expires. Look the business up on the IASME register by its registered name or certificate number, and check the level and expiry date match what your contract needs.
Does the register show whether a supplier holds Cyber Essentials or Cyber Essentials Plus?
Yes, each result lists the certificate level alongside the dates. Cyber Essentials Plus covers the same five controls with independent technical testing on top. If your contract or tender names Plus specifically, a standard Cyber Essentials certificate won’t meet it, so raise it with the supplier early.
