Short answer
An expired certificate no longer demonstrates current certification. Check the certificate validity and the buyer's requirement, and complete a new assessment against the applicable requirements. Do not assume that an expired certificate disappears from every record, that a buyer allows a grace period, or that a renewal has fewer required questions.
Why this matters
Turnaround questions matter when a buyer has a tender deadline, insurer request, or supplier onboarding gate. Fast certification is only credible when the submission is complete and compliant; if the assessor has to return the application for fixes, the applicant controls the delay.
A same-day route normally depends on three things: the self-assessment is complete, the answers are consistent with the scope, and the organisation already meets the five Cyber Essentials controls. Cyber Essentials Plus adds scheduling and technical testing, so it should not be treated like a same-day document review.
What to check next
- Prepare scope, asset, user, cloud, and MFA information before submission.
- Submit before midday on a UK business day if you need the 6-hour guarantee.
- Use Cyber Essentials Plus planning time for device sampling and external scan remediation.
Official sources and related Fig Group guidance
For scheme-level confirmation, use the official NCSC and IASME resources. Fig Group links to these sources so Cyber Essentials buyers can verify the scheme, delivery partner and certificate record independently.