Cyber Essentials Plus Timeline: How Long Does Certification Take?

Prerequisite: Cyber Essentials

CE Plus can only be issued within three months of the underlying Cyber Essentials certificate. If you do not hold CE, that step must run first (usually one to two weeks with an experienced assessor) and CE Plus starts against a valid CE certificate. See Cyber Essentials.

Fast-track: two weeks

Fits well-prepared organisations already running an MDM-managed fleet.

• Day 1–3: scope confirmed, sample list agreed, evidence pack requested.
• Day 4–7: scanning agent installed on sample devices, self-scan run, obvious gaps fixed.
• Day 8–10: assessor runs the authenticated vulnerability scan, email test and web-download test.
• Day 11–14: report issued, minor remediation completed, certificate raised.

Standard: four weeks

Most first-time CE Plus certifications sit here.

• Week 1: readiness call, scope confirmation, evidence pack templates issued.
• Week 2: internal patching sweep, MFA gap fixes, admin separation, MDM tightening.
• Week 3: pre-audit scan by our team, remediation of anything flagged, final evidence pack.
• Week 4: formal audit, remediation window if needed, certificate issued.

Extended: six to eight weeks

Common where CE was passed a while ago and controls have drifted, or where an unsupported OS or missing MDM must be addressed first.

• Weeks 1–3: retire unsupported OS versions, deploy MDM, enforce MFA on non-M365 SaaS.
• Weeks 4–5: re-baseline patching, close admin separation gaps, evidence pack build.
• Weeks 6–7: pre-audit scan and remediation.
• Week 8: formal audit and certificate.

What compresses the timeline

• An existing MDM (Intune, Jamf) with compliant devices already reporting.
• Conditional Access enforcing MFA and blocking legacy auth already live.
• A clean asset inventory the day the engagement starts.
• Sample devices ready to run the scanning agent without local admin fights.

What blows it out

• Unsupported OS versions still in scope on audit day.
• MFA "recommended but not enforced" for admin accounts.
• Test user accounts that do not work.
• Waiting for procurement to buy licences mid-engagement.

Renewal timeline

At year two the timeline compresses further because the evidence pack templates exist and the MDM is proven. Two weeks is realistic for a stable estate. See the CE Plus renewal guidefor what changes on year two.

For readiness content, see the 30-day readiness checklistand the common failuresto check before audit day.