G-Cloud 15 Deadlines: Getting Cyber Essentials in Time
Published 29 July 2026
The two dates that matter
G-Cloud 15 has a submission window (weeks) and an award date (later). Cyber Essentials must be valid at the award date. It does not have to be valid at the submission date – but omitting the certificate reference from your submission is a common reason bids get flagged for clarification. Plan to hold the certificate before submission if at all possible.
Realistic timelines
- 24 to 48 hours – possible when MFA is already enforced, patching is in policy, and evidence is ready. Requires a fast-track slot.
- 5 to 10 working days – standard turnaround for prepared organisations of 10 to 49 staff.
- 2 to 4 weeks – typical when MFA rollout, patching remediation or asset-list clean-up is still in progress.
Why the last-minute rush kills bids
The biggest reason bids fail is not the assessment itself. It is running out of runway. Enforcing MFA across a 40-person Microsoft 365 tenant takes days when the change-management is done properly. Chasing patch evidence from a managed service provider takes even longer. Both need to happen before the assessor can pass you.
How to compress the timeline safely
- Book the assessment slot before you finish preparation – we hold the slot for you.
- Start MFA rollout in staged groups the day after you commit to bidding.
- Pull a patch status report from your RMM or Intune this week, not the week of the deadline.
- Where your lot or a call-off requires certification, check whether it extends to subcontractors who handle the buyer's data, and agree evidence with them early. See our supplier readiness checklist.
What happens if the certificate expires mid-award
If your existing Cyber Essentials certificate expires between submission and award, renew before it lapses. Where your lot or call-off requires certification, a lapsed certificate at award time can be grounds for rejection. Set your renewal cycle around your G-Cloud dates.
Fast-track fine print
Our 24-hour fast-track is a real service, not a marketing line – but it needs a prepared organisation. If MFA is not yet enforced or the asset list is fictional, we will tell you honestly and quote a realistic timeline instead.
Ready to start? Open the G-Cloud 15 hub to see which lots need CE or CE Plus.