In short: A Cyber Essentials certificate search is done on IASME's public certificate search, which lists certificates issued in the last 12 months and can be searched by organisation name or certificate number. Check the level, the legal entity, the scope and the issue date. Verified organisations can bulk-check suppliers with IASME Supplier Check.
Where to check a certificate
IASME, the NCSC's Cyber Essentials Delivery Partner, runs the scheme's public certificate search on its website, and the NCSC's own Cyber Essentials FAQ points there. You can search by organisation name or by certificate number.
A few points to keep in mind:
- The search covers certificates issued in the last 12 months, which matches the length of a certificate. If a supplier only appears with an older date, or not at all, ask them for their current certificate.
- It lists both levels, so you can see whether a supplier holds Cyber Essentials or Cyber Essentials Plus.
- IASME says the search must not be used for marketing purposes, such as building sales lists from certified organisations. It is there to verify certification.
The NCSC Cyber Essentials page also links to it, which is a useful way to make sure you are on the genuine search rather than a look-alike site.
What to check on a certificate
| Check | What to look for | Why it matters |
|---|---|---|
| Organisation and legal entity | The name and company number match the entity you are contracting with | A parent or sister company's certificate may not cover your supplier |
| Level | Cyber Essentials or Cyber Essentials Plus | Some contracts, and Defence Cyber Certification Levels 2 and 3, need Plus |
| Scope | Whole organisation, or a named sub-set | A sub-set certificate may not cover the part of the business that will handle your data |
| Issue date | Issued within the last 12 months | Certificates expire after 12 months; the issue date is the point in time it reflects |
| Certificate number | Matches the PDF or reference the supplier gave you | Confirms the document is genuine |
The Cyber Essentials logo on a supplier's website is a signal, not evidence. Always check the certificate itself.
Scope descriptions and legal entities under Danzell
The Danzell question set, used for all assessment accounts created from 27 April 2026, made certificates more informative for buyers:
- Every in-scope legal entity must be listed in the assessment with its name, address and company number.
- Individual certificates for each legal entity can be requested for a small extra fee, so a group can give each subsidiary its own certificate; each one shows that the entity is part of the wider scope.
- Detailed scope descriptions appear on the digital certificate platform, so you can see what was assessed. Descriptions of the areas that were left out of scope are not made public.
If the scope looks narrow, ask the supplier which systems will process your data and whether they fall inside it. Our scope guide explains what a valid scope looks like.
Checking many suppliers: IASME Supplier Check
If you manage a large supplier base, checking certificates one at a time does not scale. IASME Supplier Check, at supplier.iasme.co.uk, lets verified organisations upload a list of suppliers as a CSV file and check their certification status in bulk.
It suits procurement teams, public bodies applying PPN 014, and larger organisations that require Cyber Essentials across their supply chain. Checking regularly matters, because suppliers must renew each year and a certificate that was valid at contract award may since have lapsed.
Building checks into supplier due diligence
- Set the requirement. Decide which level you need for each type of contract, and say so in the tender.
- Verify before award. Check the certificate search, not just the PDF supplied. PPN 014 expects in-scope suppliers to show Cyber Essentials or Cyber Essentials Plus, or equivalent controls, before award.
- Match the entity and scope. Confirm the certificate covers the legal entity and the systems that will handle your data.
- Write renewal into the contract. PPN 014 contracts require annual renewal for the life of the contract; private buyers can use a similar clause.
- Recheck every year. Diary each supplier's expiry date, or use bulk checking.
The wider picture, including why government and the NCSC encourage large organisations to require Cyber Essentials from suppliers, is on Cyber Essentials for supply chain assurance.
Checking your own listing
Once you are certified, search for your own organisation to check the name, legal entity and scope are shown as you expect. If a customer asks for proof, give them your certificate number so they can verify it themselves. If your listing is missing or wrong, raise it with IASME or your Certification Body.
We help organisations get certified, keep their certificate current, and set up supplier assurance. Contact us to talk through either.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
How do I check if a company has Cyber Essentials?
Use IASME's public certificate search, linked from the NCSC's Cyber Essentials pages. Search by organisation name or certificate number. It shows certificates issued in the last 12 months, including the level held.
Is there a register of Cyber Essentials certified companies?
Yes, in effect. IASME publishes current certificates through its certificate search. It is for verifying certification and must not be used for marketing.
Can I check suppliers' Cyber Essentials in bulk?
Yes. IASME Supplier Check lets verified organisations upload a CSV list of suppliers and check their certification status in one go.
Why can I not find a supplier's certificate?
Their certificate may have expired, it may be held under a different legal entity name, or it may have been issued more than 12 months ago. Ask the supplier for their certificate number and current certificate.
Does a Cyber Essentials certificate cover the whole company?
Not always. A certificate can cover the whole organisation or a well-defined sub-set. Under Danzell, detailed scope descriptions appear on the digital certificate, so check that the part of the business working for you is included.