Duplicate Cyber Essentials Certificates: How to Certify Group Companies and Other Legal Entities
Many organisations hold Cyber Essentials certification on behalf of a group: a parent company and its subsidiaries, or several companies run by the same director on the same IT. Each of those businesses may need a Cyber Essentials certificate in its own name for a contract, tender or supplier check. These are often called “duplicate certificates”, and the way you get them changed when the Danzell question set was introduced.
This guide explains which legal entities can share one certification, exactly what to enter in your self-assessment, and how to buy individual certificates for each entity once your main certificate is issued.
What changed under the Danzell question set
The Danzell question set became the live Cyber Essentials question set on 27 April 2026. Under Danzell, every legal entity covered by your certification must be declared in your assessment before it is submitted. IASME has confirmed that once a certificate has been issued, further entities cannot be added to it.
If you received a duplicate certificate under an earlier question set, don’t assume the same process applies when you renew. Follow the steps below instead.
Can your organisations share one Cyber Essentials certificate?
IASME’s guidance allows several legal entities to be covered by a single Cyber Essentials certification when both of the following are true:
Shared network infrastructure — the entities use the same network infrastructure, with consistent security policies and operational oversight, and the network is centrally managed and governed.
The same legally responsible person — the same director or board member holds legal responsibility for every entity and can sign off the assessment on behalf of all of them.
Firewall separation inside your network does not automatically mean you need separate certificates. If the firewalls are managed by the same administrative team under one legally responsible individual, and the underlying infrastructure is shared and centrally governed, a single certification may still be possible. If the firewalls represent a true separation, for example because different teams manage them or the entities sit under different legal or governance structures, separate certifications are required.
When separate certifications are required
Each legal entity needs its own Cyber Essentials assessment when:
The legally responsible persons differ — no single director or board member can sign off for all of the entities.
The network infrastructure differs — the entities do not share the same network infrastructure.
There is no shared governance — the entities are separate companies with no shared governance or oversight.
IASME illustrates this with three examples:
One owner, three companies, one network: these can share a certificate, because they share the same network infrastructure and legally responsible person.
A parent and subsidiary on different networks: these need separate certifications, because the infrastructure is not shared.
Two companies with different directors sharing an office and network: these need separate certifications, because they are separate companies with different directors.
How to get Cyber Essentials certificates for additional legal entities
Name your primary legal entity at question A1.1. Enter the name of just one legal entity. This is the primary legal entity: it appears on the main certificate and is responsible for the assessment and the shared IT infrastructure.
List every other legal entity at question A1.6.1. Answer “Yes” at A1.6 to confirm that your scope includes other legal entities, then give the name, company number and registered address of each one at A1.6.1.
Complete and pass your assessment. The declaration must be signed by a director or board member who is legally responsible for every entity you have listed.
Look out for IASME’s invitation email. Once the main certificate has been issued, IASME emails you an invitation to buy certificates for the entities you listed. It names them as “Associated Organisations” and gives you a unique six-digit PIN. Check your junk or spam folder if it doesn’t arrive.
Purchase the certificates. Click the “Purchase Certificates” button in the email, enter your PIN when prompted and complete the payment. Each additional certificate costs £10 and is issued in that entity’s own name.
Important: any legal entity that is not listed at A1.6.1 cannot be added after the certification process is complete. Check the list carefully, including company numbers and registered addresses, before your assessment is submitted.
What IASME’s invitation email looks like
The invitation comes from IASME after your certificate is issued. It congratulates you on completing your Cyber Essentials assessment, explains that the additional entities in your scope are eligible for their own certificates at £10 each, and lists those entities under the heading “Associated Organisations”. Below that are the purchase steps, your PIN and a green “Purchase Certificates” button.
Do you have to buy the additional certificates?
No, buying them is optional. The names of the included legal entities are automatically listed on your digital certificate, added to the Cyber Essentials certificate search and made discoverable in the Cyber Essentials Supply Check Tool, whether or not you buy individual certificates. A separate certificate is useful when a customer, contract or tender asks for a certificate in that entity’s own name.
What if a legal entity was left out?
An entity cannot be added to a certificate that has already been issued. It will need to be covered by a future Cyber Essentials assessment, either listed at A1.6.1 when you next renew, or through its own certification. If you are unsure which route is right for your organisation, speak to us before you start your renewal.
How Get Cyber Certified can help
Getting the legal entity questions right first time avoids paying for a second assessment. If you are not sure whether your companies can share a certificate, contact us before you begin. On our Supported Service we review your answers before anything is submitted for marking, including the entities at A1.1 and A1.6.1. For wider scoping questions, read How to Scope Cyber Essentials.
Comments