Cyber Essentials Logo and Badge: Who Can Use It and How

The Cyber Essentials logo, formally the Cyber Essentials certification mark, may only be used by an organisation that holds a current Cyber Essentials certificate. The Cyber Essentials Plus badge may only be used by an organisation that holds a current Plus certificate. You don’t download either from a logo library. When your certificate is issued, IASME, which delivers the scheme for the National Cyber Security Centre (NCSC), gives you a digital certificate and a digital badge to embed on your website and in your email signature. You may use the badge only while the certificate is valid, which is 12 months.

This guide is for organisations that have just certified, or are about to, and want to display the badge properly. Sovereign Secure is an IASME-licensed Cyber Essentials certification body, so we issue the certificates these badges come from.

Can I use the Cyber Essentials logo?

Yes, once your organisation is certified, as long as you follow the scheme’s branding rules. IASME’s Cyber Essentials terms and conditions, which every applicant accepts, define two certification marks: one for Cyber Essentials and one for Cyber Essentials Plus. Each is awarded only to organisations that successfully certify at that level.

The terms attach three conditions to the marks:

That rules out some common uses. You cannot display the Cyber Essentials certified logo if you are “working towards” certification, describe yourself as “compliant with” or “aligned to” Cyber Essentials, have let your certificate expire, or rely on a certificate held by your IT provider or a sister company.

Where do I get the Cyber Essentials logo?

You get it from your own certificate, not from a download site. IASME issues the Cyber Essentials certified logo with your digital certificate, through the BlockMark Registry platform, and the same applies to the Cyber Essentials Plus logo. So instead of a Cyber Essentials logo download, you generate your Cyber Essentials certification logo from the certificate itself, in five steps.

1. Pass your assessment. Your certification body marks your answers and, for Plus, carries out the technical audit.
2. Open the certificate email. It comes from BlockMark, links to your digital certificate and has a PDF copy attached. If it doesn’t arrive, check junk and quarantine folders.
3. Create or sign in to your BlockMark account. When asked, connect it to your organisation account, or your certificates won’t appear under Received Certificates.
4. Generate your badge. Open the certificate, choose Share, then “Smart badge for website” or “Smart badge for email”, and select Create to get the embed code.
5. Add it to your site or signature. Paste the code into your website’s HTML through your content management system, or into your email signature. Only change the options the badge controls offer, such as the background colour.

IASME’s user guide to its digital certificates has step-by-step screenshots, including the settings for Outlook and Apple Mail.

Why is the badge embed code instead of an image?

So that it can’t outlive the certificate. IASME moved away from JPEG and PNG badges because a static image can be copied onto any website and left there long after a certificate has expired, and because, in IASME’s words, certificates are widely faked. The embedded badge stays linked to your live certificate. Hovering over it shows who it was issued to, which body issued it and the issue and expiry dates, and clicking it opens the full digital certificate, including the scope.

Can I download the Cyber Essentials logo as a PNG?

Not as a substitute for your issued badge. A Cyber Essentials logo PNG found on another website is not linked to your certificate, can’t be verified and won’t disappear if you stop being certified. For printed material, tender templates and other marketing literature where embed code won’t work, IASME’s guide asks certified organisations to contact its marketing team. For the same reason, we don’t host the Cyber Essentials marks for download on this site.

What is the difference between the Cyber Essentials logo and the Cyber Essentials Plus logo?

They are separate marks for separate certificates, and each one tells a buyer something different. The Cyber Essentials badge shows that you passed a verified self-assessment. The Cyber Essentials Plus logo shows that an assessor also tested your systems.

Three points catch people out:

• Never show the Plus badge with a basic certificate. It claims an audit that never took place.
• Your two certificates can carry different dates. Plus follows the basic certificate by up to three months, so check which badge you are showing and when each one expires.
• A failed Plus retest can remove both. Under the rules in force since April 2026, a second failure of the Plus update tests results in the revocation of the basic Cyber Essentials certificate, and with it the right to show either badge.

Our Cyber Essentials Plus page explains what the audit involves.

Where can you display the Cyber Essentials badge?

Anywhere you represent the certified organisation, provided the badge stays accurate. The website and email badges are designed for digital use. Everything else needs more care, because a static copy does not expire on its own.

If Sovereign Secure certified you, you can also add a short “Certified by Sovereign Secure” text line beneath the official badge. See certified clients and our badge snippet for how to request it.

What must you not imply when you display the badge?

The badge must not say more than your certificate does. The commonest problems are:

• Overstating the scope. A certificate can cover the whole organisation or a defined part of it, such as one subsidiary or one site. Don’t place the badge where it suggests the whole group is certified when it isn’t.
• Overstating the level. Basic Cyber Essentials is not Plus, however recently you certified.
• Overstating what it proves. Cyber Essentials shows that baseline controls were in place on the date your certificate was issued. It is not an endorsement of your products and doesn’t mean the government has approved your services.
• Altering the mark. Don’t redraw it, recolour it, crop it, add effects or merge it with your own logo. The badge controls are the only changes IASME provides for.
• Borrowing someone else’s badge. Your IT provider’s certificate, a parent company’s certificate or a client’s certificate does not make you certified.

What happens to the badge when your certificate lapses?

Cyber Essentials certificates last 12 months and there is no grace period. On the expiry date, the embedded badge disappears automatically from your website and emails. Static copies in PDFs, slide decks and printed material do not, so you need to remove them yourself: IASME’s terms limit use of the marks to the period your certificate is valid.

Renewing doesn’t bring the old badge back. IASME issues a new certificate number at each renewal, and its guide says embed codes are tied to individual certificates, so you replace the old code with the code from your new certificate. Renew before the expiry date and you avoid any gap on your website or on the register. Our Cyber Essentials renewal guide explains the timing.

Buyers who want to confirm that a badge is genuine can check a Cyber Essentials certificate on the official register.

Why Sovereign Secure

• We issue the certificates behind the badge. Sovereign Secure is an IASME-licensed Cyber Essentials certification body. We assess and certify both Cyber Essentials and Cyber Essentials Plus, and your digital certificate and badge are issued as soon as you pass.
• Published prices. Cyber Essentials costs from £320 + VAT (Bronze, 0 to 9 employees) to £750 + VAT (Gold, 250+ employees). Every package includes a pre-assessment check and a support call of up to an hour. See the full Cyber Essentials price list.
• Assurance beyond Cyber Essentials. Sovereign Secure Ltd was incorporated in 2012 (Companies House 08334453), is ISO 27001 certified and is a PCI SSC Qualified Security Assessor (QSA) company.

Next step

Not certified yet? Our Cyber Essentials certification packages start at £320 + VAT, and Gold submissions are assessed within one working day, after which your badge is ready to embed. For the Plus badge, complete the Cyber Essentials Plus scoping questionnaire for a fixed quote. Or send us your company size through the form below, or call +44 161 523 5276.