2-4 weeks if you're already prepared. 6-8 weeks if you need to fix gaps first. Cyber Essentials Plus adds another 1-2 weeks for the technical assessment.
Quick answer: 2-4 weeks if you're already prepared. 6-8 weeks if you need to fix gaps first. Cyber Essentials Plus adds another 1-2 weeks for the technical assessment.
If You're Already Prepared
Your IT is well-managed. Patching is current. MFA is enabled everywhere. Firewalls are configured properly.
Cyber Essentials (basic):
- Complete the self-assessment questionnaire: 1-2 days
- Assessment body reviews and clarifies: 3-5 days
- Certificate issued: 1-2 days
- Total: 1-2 weeks
- Same as above, plus
- Schedule technical assessment: 1-2 weeks (assessor availability)
- Technical testing: 1 day
- Any clarifications: 2-3 days
- Total: 3-4 weeks
If You Need to Fix Things First
Most organisations aren't ready on day one. Common gaps:
- Patching backlogs
- MFA not enabled everywhere
- Firewall rules need tightening
- Devices not properly managed
- Documentation gaps
- Gap analysis: 1 week
- Remediation work: 2-4 weeks (depends on gaps)
- Assessment: 1-2 weeks
- Total: 6-8 weeks
What Slows Things Down
Patching debt: That server running an old OS. Applications that haven't been updated. Firmware from 2019. Each one needs addressing.
Scope creep: You discover devices you forgot about. The MD's home laptop. The warehouse PC. That test server.
Third-party dependencies: Waiting for your firewall vendor. Waiting for software updates. Waiting for IT support to make changes.
Questionnaire back-and-forth: Unclear answers lead to clarification requests. The more accurate your initial submission, the faster it goes.
Tips for Speed
Get a gap analysis first. Know exactly what needs fixing before you start the clock.
Fix everything before booking the assessment. Don't assume you can remediate while waiting.
Document your scope clearly. Know every device, every user, every system that's in scope.
Answer the questionnaire precisely. Vague answers create delays.
Use an experienced partner. We know what assessors look for and what causes delays.
Our Approach
For managed clients, certification is straightforward—their environment is already configured to pass. We handle the questionnaire, coordinate the assessment, and resolve any queries.
For new clients, we start with gap analysis so there are no surprises. We fix gaps, then certify. No wasted assessment fees, no failed attempts.
---
- we'll give you a realistic timeline.
---