A logo on a website or a line in a tender response is a claim. The record behind it can usually be checked, in less time than it takes to read the claim.
Supplier questionnaires usually ask whether the supplier holds Cyber Essentials or ISO 27001. In my experience, the answer comes back as a logo, a PDF or a “yes”, and it is usually accepted as given. The government’s Cyber Security Breaches Survey 2025/2026 found that 15% of businesses said they reviewed the risks posed by their immediate suppliers. For many of the rest, a badge on a website may be as far as the check goes.
That is a missed opportunity, because both kinds of certificate can usually be checked against a public record. For a certificate that matters to a contract, the check takes about ten minutes. Here is how I would do it, and what the records can and cannot tell you.
Cyber Essentials: search the register
Cyber Essentials certificates are issued through IASME, the National Cyber Security Centre’s delivery partner for the scheme. IASME’s certificate search lets you look up an organisation by name or certificate number and find those “holding a Cyber Essentials or Cyber Essentials Plus certificate issued in the last 12 months”. Each result shows the company name, the certificate reference, the level, the date of certification and the expiry date.
Three things are worth checking in the result. The level tells you whether you are looking at Cyber Essentials, which rests on a verified self-assessment, or Cyber Essentials Plus, which adds more rigorous, independent technical testing. The expiry date tells you whether the certificate is still current. And the name tells you which organisation holds it, which may not be the one you are contracting with.
In my experience, the holder is where most mistakes happen. A group of companies can certify one entity and show the logo across all of them. Since April 2026 the scheme has started to make this easier to check. For assessment accounts created after 26 April 2026, IASME says organisations “will need to specify all legal entities included within the scope of the assessment”, with details “such as the entity’s name, address, and company number”, and that “all legal entities included in scope can be viewed on the digital certificate platform”. Organisations are also no longer limited to a brief scope description, and where they provide a detailed one, it is visible through the same platform. Details of what is out of scope are not made public.
That detail sits on IASME’s digital certificate platform, separate from the search results, so ask the supplier for the link to its digital certificate. IASME also offers a free Supplier Assurance Tool, which requires registration, for organisations checking the Cyber Essentials certification of their suppliers and contractors.
There is a catch. Those changes apply to certificates from the new process. A certificate from an assessment account created on or before 26 April 2026 may still carry only the brief description, and earlier accounts had six months to certify under the previous version. For a while, then, you will see both kinds.
One more point is easy to miss. IASME defines the “point in time” for a certificate as “the date the certificate is issued”. A certificate tells you the organisation met the requirements on that date, and says nothing about what has happened since.
ISO 27001: check the accreditation
ISO 27001 certificates work differently. The International Organization for Standardization does not certify anyone: “ISO does not perform certification or issue certificates”. Certificates come from certification bodies, and some of those bodies are accredited by a national accreditation body while some are not.
In the UK, the accreditation body is UKAS. In June 2022 it launched CertCheck, which it describes as “a free online database of accredited management systems certification”, designed to “verify the current accreditation status of certification claimed to be held by prospective suppliers”. For certificates from other accreditation bodies, there is IAF CertSearch, the global database set up by the International Accreditation Forum. The IAF itself ceased operations on 1 January 2026, and ISO says its role has passed to the Global Accreditation Cooperation Incorporated (Global ACI). CertSearch is still running, and ISO still points buyers to it. UKAS notes that uploading to CertSearch “is currently voluntary and hence the database is not complete”. A certificate missing from IAF CertSearch proves little; one that claims UKAS accreditation and is missing from CertCheck is a reason to ask.
UKAS is blunt about why this matters: “A number of bodies have reported an increase in the number of fake certificates on the market. Some of these, upon a cursory review, look authentic”. And where a certificate’s accreditation comes from a body outside the international recognition arrangements, UKAS says “there is no formal recognition of their competence and care should be taken”.
The balancing point comes from ISO itself: “accreditation is not compulsory, and non-accreditation does not necessarily mean the certification body is not reputable.” An unaccredited certificate is a reason to ask more questions, and on its own no reason to reject a supplier.
For ISO 27001, the scope statement matters as much as the certificate. A certificate that covers one site or one service line tells you nothing about the rest of the company. Read the scope, and compare it with the service you are buying.
The ten-minute routine
Put together, the check for any supplier certificate comes down to five steps.
First, find the record: IASME’s certificate search for Cyber Essentials, UKAS CertCheck or IAF CertSearch for ISO 27001. Second, match the holder to the company you are contracting with, using the company number where the record shows one. Third, read the scope and decide whether it covers the service you are buying. Fourth, check the dates: when the certificate was issued and when it expires. Fifth, check the level: Cyber Essentials or Cyber Essentials Plus, or for ISO 27001, who accredited the certification body.
A failed step can have innocent causes: records lag, groups restructure and scopes change. Treat it as a reason to ask the supplier a direct question, and to write the answer into the contract.
Timing matters as much as the check. I would run it three times: when a supplier is shortlisted, again before the contract is signed, and at every renewal. Each certificate has an expiry date, and the search lists only those issued in the last 12 months, so a supplier that appeared when you signed may not appear at renewal. A short clause asking the supplier to tell you if a certificate lapses, or if its scope changes, is cheap to ask for and saves you having to find out for yourself. It also tells the supplier that someone on your side reads the records.
The counterpoint: a certificate is a floor
The strongest objection to all of this is that certificates prove less than buyers assume. Cyber Essentials sets a baseline of technical controls at a point in time. ISO 27001 certifies a management system, which is a different thing from certifying that every control works. A supplier can hold both and still be breached.
I agree, and that is why the check matters. A certificate is the cheapest piece of evidence a supplier can give you. If that piece does not hold up, the rest of the supplier’s answers deserve less weight too. If it does hold up, you have a floor, and the questions about incident notification, access and testing that I set out last week sit on top of it.
The survey figure from the start is worth keeping in mind. If only 15% of businesses say they review the risks from their immediate suppliers, many of those badges are probably taken on trust. Ten minutes is a small price for being one of the buyers who did.
This article is commentary on published guidance, not legal or procurement advice. Sources checked on 24 October 2026. Check the IASME and UKAS search pages for current wording before relying on them.
Sources
- DCMS and DSIT, Cyber Security Breaches Survey 2025/2026, 30 April 2026: https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026
- IASME, NCSC certificate search (including the Supplier Assurance Tool): https://iasme.co.uk/cyber-essentials/ncsc-certificate-search/
- IASME, Important Update: Changes to Cyber Essentials for April 2026, 12 February 2026: https://iasme.co.uk/articles/important-update-changes-to-cyber-essentials-for-april-2026/
- NCSC, Cyber Essentials overview (IASME as delivery partner): https://www.ncsc.gov.uk/cyberessentials/overview
- UKAS, FAQs (CertCheck, IAF CertSearch, fake certificates, recognition arrangements), modified 18 December 2025: https://www.ukas.com/faqs/
- UKAS, CertCheck: https://www.ukas.com/certcheck/
- ISO, Certification (including Global ACI’s assumption of the IAF’s former role): https://www.iso.org/certification.html
- IAF, legacy site notice: “IAF ceased operations on 01 January 2026”: https://iaf.nu/en/home/
- IAF CertSearch: https://www.iafcertsearch.org/