The certification lasts three years, but an annual attestation will be needed to maintain the certificate, along with annual recertification to Cyber Essentials or Cyber Essentials Plus.