KeptTimeline guide, updated 2026
How long does Cyber Essentials take?
Two to four weeks for a tidy business; six to eight if you are starting from scratch. The marking is out of your hands — the preparation is not. Here is a realistic week-by-week plan.
A realistic week-by-week plan
Week 1 — Scope and asset list
Decide what is in scope and list every device, cloud service and account. This is where most businesses discover services they had forgotten about.
Weeks 1–2 — Fix the obvious gaps
Turn on multi-factor authentication, separate shared logins into individual accounts, and update or retire unsupported software. The five controls decide what 'obvious' means.
Weeks 2–3 — Policies and evidence
Write the policies assessors actually ask for and collect dated evidence — screenshots, settings pages, licence records — so your answers can be backed up.
Week 3 — Submit to a certification body
Choose an IASME-appointed certification body, pay the fee for your size band and submit the self-assessment questionnaire.
Weeks 3–4 — Marking and follow-up
Answer any assessor questions quickly — each round adds days. Once you pass, the certificate is issued and valid for twelve months.
All year — Keep it current
Evidence gathered once a year is a scramble. Log changes as they happen and the next renewal takes days, not weeks.
What usually causes the delay
Almost every slow submission stalls on one of three things: a forgotten cloud service that should have been in scope, accounts without multi-factor authentication, or software that is out of support and cannot be answered honestly. A two-minute readiness check will flag all three before you pay the certification fee.
Working to a tender deadline?
Start preparation at least six weeks before the bid date and never promise a certificate you do not yet hold — buyers check, and a failed submission burns the window. If the deadline is immovable, some certification bodies offer faster marking for a higher fee.
Common questions
How long does it take to get Cyber Essentials certified?
For a tidy small business, two to four weeks is realistic: one to two weeks of preparation, then marking once you submit. A business starting from scratch — no asset list, shared accounts, unsupported devices — should allow six to eight weeks. The certificate itself is issued shortly after you pass.
How long does marking take?
Marking timescales are set by the certification body you choose and vary with demand. Many come back within a few working days, but you should not book a tender deadline against a best-case turnaround. If the assessor asks questions, each round of follow-up adds days.
What slows a Cyber Essentials submission down?
The same three things almost every time: an incomplete list of devices and cloud services, accounts without multi-factor authentication, and unsupported software that has to be updated or replaced before you can answer honestly. Each fix pauses the whole submission.
Can I get Cyber Essentials in a week?
If your estate is simple, documented and already meets the five controls, yes — some businesses prepare in a couple of days. But most delays are outside your control once you submit, so treat one week as the exception, not the plan.
How long does a Cyber Essentials certificate last?
Twelve months. Diary the renewal early: starting preparation four to six weeks before expiry keeps the certificate continuous, which matters if a contract requires you to hold it at all times.