Cyber Essentials passes 61,000 certificates, mostly renewals
Government figures show certificate numbers up by a fifth in a year, but nearly three in four basic certificates went to organizations renewing rather than joining for the first time
- Certificates are valid for 12 months, so holders must recertify each year to stay certified.
- The data counts certificates, not organizations: every Cyber Essentials Plus certificate comes with a basic one, and DSIT notes that some large organizations hold more than one.
- Cyber Essentials Plus rose about 22% year on year in the quarterly breakdown, slightly faster than the basic level.
- The government says organizations with Cyber Essentials are 92% less likely to make a claim on their cyber insurance.
- The figures are management information, not Official Statistics.
If your certificate is due for renewal, book the assessment early so a lapse does not put a customer contract or tender out of reach. Organizations that sell to larger firms or the public sector and have never certified should check which level their buyers ask for; Cyber Essentials Plus, with its independent check, looks likely to become the expected tier. Ask your own suppliers whether they hold a current certificate, and make it a condition for those with access to your systems.
The government’s Cyber Essentials management information, updated on 16 September, shows 61,430 certificates awarded in the 12 months to June 2026. Of those, 46,245 were at the basic level and 15,185 at Cyber Essentials Plus, which adds an independent technical check.
The quarterly tables in the underlying data, compiled by the Department for Science, Innovation and Technology (DSIT) from figures supplied by IASME, which delivers the scheme under contract, put the rise at about 20% on the previous 12 months. Infosecurity Magazine reported it as a record year. Renewals still dominate: 33,745 of the basic certificates in the quarterly breakdown were recertifications and 12,402 were first-time issues. The new issues are growing faster, up 29% from 9,595 a year earlier, but from a small base.
Micro and small organizations accounted for 32,792 of the basic certificates. The most common reason applicants gave was to give confidence to their customers, cited on 18,301 certificates, followed by a general wish to improve security (13,765). Commercial contracts (5,736) and government contracts (5,291) trailed well behind, and insurers were named on just 894.
Sources
- Department for Science, Innovation and Technology and Department for Culture, Media and Sport, “Cyber Essentials management information”, statistical data set, updated 16 September 2026. https://www.gov.uk/government/statistical-data-sets/cyber-essentials-management-information
- DSIT, “Cyber Essentials certificates management information (April 2026 to June 2026)”, ODS data file, September 2026. https://assets.publishing.service.gov.uk/media/6aa2845862ec7fe7bedf5304/Cyber_essential_certificates_management_information_April2026-June2026.ods
- Infosecurity Magazine, “Cyber Essentials Has Record Year but Takeup Remains Low”, 17 September 2026. https://www.infosecurity-magazine.com/news/cyber-essentials-has-record-year/
