Quick Summary
- Where to check: IASME Certificate Search at iasme.co.uk
- What you can search: Company name or certificate number
- What it shows: Certificate type, when it started, when it ends, what's covered
- Why bother: Many contracts now need proof of certification
- Lots of suppliers?: There's a bulk tool for checking many at once
Want to check if a supplier is really Cyber Essentials certified? It takes 30 seconds. Here's how.
Anyone can say they're certified. But certificates expire. Some only cover part of a business. That's why you should check.
This matters more in 2026. More contracts now ask for proof.
How to Check a Company's Certificate
The NCSC runs the scheme with IASME. IASME keeps the list of all valid certificates.
Here's how to check:
- Go to the search page. Visit the IASME Certificate Search.
- Type the company name. Or use their certificate number if you have it.
- See the results. It shows if they have a valid certificate.
- Click the + for details. This shows the full info.
Direct link: The official IASME certificate search is at iasme.co.uk/cyber-essentials/ncsc-certificate-search
What the Search Shows You
When you find a company, you'll see:
| Field | What It Means |
|---|---|
| Level | Basic or Plus |
| Issue Date | When they got certified |
| Expiry Date | When it runs out (12 months from issue) |
| Scope | Which parts of the business were checked |
| Reference Number | The unique certificate ID |
Check the Scope
This is the bit people miss.
A company might be certified. But only for part of their business. The scope shows what was actually checked. Make sure it covers the service you're using.
No result? It might mean their certificate expired. Or the name is different. Or they were never certified. If in doubt, ask them for their certificate number and check that instead.
Why This Matters
You might need to check for a few reasons:
Checking Your Suppliers
If a supplier touches your data, their security matters. More firms now ask suppliers to prove they're certified before signing.
The Crown Commercial Service says it's expected for anyone working with government.
Winning Contracts
Government contracts with sensitive data need Cyber Essentials. Buyers will check you're certified. Being able to check suppliers fast helps everyone. If you need to get certified yourself, see my guide on how much Cyber Essentials costs.
Insurance
Some insurers check certification when they assess risk. A quick way to verify speeds things up. The new UK cyber laws are making this more common.
Can't Find a Certificate?
If nothing shows up, try this:
- Try other names. They might be under a parent company or trading name.
- Check the date. Certificates last 12 months. If they didn't renew, they won't show.
- Ask them. Get their certificate number and search for that instead.
- Call them. If they're really certified, they can prove it.
Tip: Check the expiry date. A certificate from over a year ago is no good. Even if they still have the document.
Checking Lots of Suppliers at Once
Need to check many suppliers? IASME has a Supplier Check Tool for that.
It lets you:
- Upload a list of suppliers
- Check them all at once
- Get alerts when certificates expire
- Export reports
It costs money and needs you to register. It's for buying teams with lots of suppliers.
For most businesses checking a handful of suppliers, the free search tool is all you need.
Why does this matter? Because 92% of certified businesses avoid breaches. Checking your suppliers are certified protects you too.
Basic vs Plus: What's the Difference?
When you check a certificate, you'll see which level they have. Here's what that means:
| Aspect | Basic | Plus |
|---|---|---|
| How it's done | They fill in a form | Someone tests their systems |
| How sure can you be? | They say it's in place | It's been tested for real |
| Security scans | No | Yes |
| Best for | Lower-risk suppliers | Sensitive data access |
For most suppliers, basic is fine. If they touch sensitive data, ask for Plus.
I've written more on Cyber Essentials vs Plus if you need to decide which to ask for.
Frequently Asked Questions
Go to the IASME Certificate Search. Type the company name. It shows if they have a valid certificate, what level, and when it expires. You can also search by certificate number.
Yes. IASME runs it for the NCSC. All valid certificates are listed. Companies drop off when their certificate expires or they don't renew.
Their certificate might have expired. The name might be different. Or they were never certified. Try other name versions. Or ask them for their certificate number and search that.
12 months from the date they got it. They must renew each year. Always check the expiry date when you verify a supplier. See certification costs if you need to budget for your own renewal.
Yes. IASME has a Supplier Check Tool. You upload a list and check them all. It costs money. For a few suppliers, the free search is fine.
Check four things: level (basic or Plus), expiry date, scope (what parts of the business it covers), and if that scope includes the service you use.
Want Your Business on That List?
I help UK businesses get Cyber Essentials certified. Then you show up in the search too.
Learn About Cyber Essentials