Lesson 10.5 — Final course close: maintaining Cyber Essentials, recertification, management review and continuous improvement
This final lesson closes the course by helping the learner move from certification as a one-off project to Cyber Essentials as an ongoing operating discipline.
What You'll Be Able to Do
By the end of this lesson, you will be able to:
- maintain Cyber Essentials controls throughout the year
- assign ongoing owners
- set review frequencies
- keep evidence current
- prepare for annual recertification
- respond to organisational and technical changes
Why This Matters
It explains how to maintain the controls after certification, prepare for annual recertification, keep evidence current, manage changes, run periodic reviews, use management review effectively, and turn Cyber Essentials into continuous improvement rather than a once-a-year scramble.
The Core Rule
Cyber Essentials should become part of normal cyber hygiene.
Certification is valuable, but the controls must keep working after the certificate is issued.
What the CE Assessor Looks For
A strong position shows:
- controls have named owners;
- scope is reviewed after major changes;
- inventories are kept current;
- user access is reviewed regularly;
- firewall rules are reviewed;
- patch compliance is monitored;
Copy This
Keep this rule visible:
Do not make Cyber Essentials a yearly panic. Make it a maintained baseline that is reviewed, evidenced and improved throughout the year.
Quick Checklist
Before moving on, make sure you can say yes to these:
- [ ] Why is certification not the finish line?
- [ ] Why should submitted answers be kept after certification?
- [ ] Why should last year’s answers not simply be copied?
- [ ] Why is ongoing ownership important?
- [ ] Give three examples of changes that should trigger a Cyber Essentials scope review.
Your Action
Do this now — it takes 10–20 minutes.
Submit your assessment. Set a reminder for 11 months from today for recertification. Update your evidence document with the submission date.
Key Takeaway
Do not make Cyber Essentials a yearly panic. Make it a maintained baseline that is reviewed, evidenced and improved throughout the year.
Your Workbook Activity
Complete: Cyber Essentials maintenance, recertification and continuous improvement plan