From application to continuous assurance
Certification runs through six stages. The first four take an applicant from registration to a decision, backed by the accredited audit. The last two — Assurance and Renewal — are what keep the certificate meaningful for its full term.
A formal audit is a point-in-time snapshot. It is thorough and it is the basis for the certificate — but between one audit and the next, systems change, people change, and configurations drift. Historically that left a visibility gap of up to a year.
The platform's continuous-assurance layer closes that gap. It watches for drift, scores risk in real time, and feeds what it sees back to DESC and the accredited authorities. It is a layer that supports the BSI and CREST process between cycles — it never replaces the audit or the decision.
Validity & renewal
A three-year term with a light annual refresh each year, kept live by continuous assurance in between.
Same three-year model with a yearly refresh, tuned to the operational signals of a SOC.
A two-year term with a refresh after the first year, and continuous assurance tracking competency and conduct throughout.
Renewal is risk-based. A provider whose assurance history stayed clean follows a lighter renewal path; one whose risk climbed during the term gets more scrutiny. The loop closes back to Renewal — assurance feeds directly into how the next term is granted.
After you're certified
A certificate isn't a one-time event. Three things keep it meaningful between audits — and every one of them comes with notice and a fair way back.
Each year you re-confirm your file. It's pre-filled from last year; you declare only what changed. A clean year means a desk review, not a new assessment.
Active → Under watch → Suspended → Withdrawn, under published criteria. You get notice, a fix window, a right of reply and an appeal heard by someone else. DESC decides.
Government buyers rate the work you deliver. Ratings aren't public — DESC sees them, you see your own, and buyers see stars only when evaluating a tender. A rating alone never suspends a certificate.
See it for a real application
Register to start your own, or verify a certificate that's already been issued.