How Long Does Cyber Essentials Take?
Three honest answers depending on your starting posture: 24 hours for the prepared, 1 week for most small businesses, 2–4 weeks if remediation is needed. Here's how to know which track is yours.
The honest answer to "how long?"
The most-searched question about Cyber Essentials is "how long does it take?", and the most common answer online – "1 week" – is misleading without context. Certification time depends almost entirely on your existing technical posture, not on the assessor's speed.
If your environment is already compliant, we can issue a certificate within 24 hours of submission through the certification portal. If you have unsupported Windows machines, no MFA on cloud admin accounts and undocumented BYOD policy, no assessor – however good – can compress the remediation work into a week. The honest answer therefore comes in three tracks.
Three certification tracks
24-hour Fast-Track
1 day
Suitable for: Organisations already running supported OS, MFA on all cloud accounts, automatic patching, and a documented asset inventory.
- 1.Scoping & readiness call (1 hour)
- 2.Self-assessment walkthrough (2–3 hours)
- 3.Submission through the certification portal
- 4.Certificate issued by us within 24 hours of submission for prepared organisations
Standard 7-day
1 week
Suitable for: Most small businesses with reasonable existing hygiene but needing assessor support to navigate the question set.
- 1.Day 1: Scoping call
- 2.Days 2–3: Evidence gathering with assessor support
- 3.Days 4–5: Draft submission reviewed
- 4.Day 6: Submission
- 5.Day 7: Certificate issued
Typical 2–4 week
2–4 weeks
Suitable for: Organisations needing remediation: OS upgrades, MFA roll-out, BYOD scope decisions, password policy documentation.
- 1.Week 1: Scoping & gap analysis
- 2.Weeks 2–3: Remediation execution with weekly check-ins
- 3.Week 3–4: Submission and certification
Cyber Essentials Plus timeline
Cyber Essentials Plus adds an independent technical audit on top of the self-assessment. Plan for 1–2 weeks beyond the base CE timeline:
- CE certificate must be issued before the CE+ audit can begin (or both can run in parallel with overlapping scoping).
- Audit scheduling typically requires 5–7 working days lead time depending on assessor availability.
- Remote audit of a sample of devices: usually 1 day for SMEs, 2–3 days for larger estates.
- External vulnerability scan of internet-facing infrastructure runs in parallel.
- Report and certificate issued within 5 working days of audit completion.
Read our CE vs CE Plus comparison to decide which level you need.
The three things that slow certifications down
If your timeline is slipping, it is almost always one of these three.
Unsupported operating systems
Windows 10 without Extended Security Updates, end-of-life macOS versions, or unsupported mobile OS. Replacing or upgrading hardware can add 1–3 weeks.
Missing MFA on cloud admin accounts
Enforcing MFA across Microsoft 365, Google Workspace, AWS or Azure admin accounts is technically simple but requires user comms and a rollout window – typically 3–7 days.
Undocumented BYOD policy
If staff use personal phones for work email, you need a documented BYOD position and evidence of mobile device controls. Documenting this from a blank page typically takes 2–5 days.
A realistic visual timeline
Typical 14-day timeline for a small business. Fast-track and longer remediation tracks shift these proportions.
Frequently Asked Questions
Find out which track is yours
A 30-minute scoping call tells us – and you – whether you're ready for the 24-hour fast-track or need a remediation plan first.
Book my readiness call