How long does Cyber Essentials take?

How long does each stage take?

Two sets of timings apply. IASME publishes the scheme's own clock, which is the same at every Certification Body. Precursor publishes how long its supported route takes. Remediation is the stage nobody can time for you, because it depends on what the gap check finds.

IASME's figures come from its Cyber Essentials page and FAQ, checked on 3 November 2026. Precursor's are published on precursorsecurity.com.

How long does the self-assessment take?

A Cyber Essentials self-assessment typically takes 1 to 2 weeks from start to certificate when the controls are already in place. Answering the questions takes a few hours; the rest is gathering evidence and assessor marking.

The question set has 106 questions across eight sections. With the device inventory, software version list, cloud service list and administrator register already to hand, answering takes a few hours. Precursor's supported route runs at 1 to 2 weeks from kick-off to certificate, which includes reviewing your notes fields before submission so the assessor raises no queries.

Without the evidence gathered, the same questions take days, because each one sends you to a console or a colleague. A2.6 to A2.9 and A6.2.1 to A6.2.4 are the usual bottlenecks: they need quantities and versions, not descriptions.

How long does Cyber Essentials Plus take?

Cyber Essentials Plus typically takes 2 to 5 weeks from scoping to report, depending on device count, and IASME requires it to be completed within 3 months of the self-assessment certificate.

Cyber Essentials Plus needs a valid self-assessment first, and the Plus assessment must be completed within 3 months of that certification on the same scope. The external vulnerability scan runs remotely; the device tests run on site or over a supervised remote session. Precursor's turnaround is 2 to 5 weeks from scoping call to report, including a pre-audit check of the sample.

If a test cannot be concluded on the day, the test specification allows the Delivery Partner to permit deferral, and recommends no more than one month. Plan any deferral so the audit still completes inside the 3-month window.

What slows certification down?

Fixing the controls behind the auto-fail questions and the supported-software requirement slows certification most: replacing unsupported software, rolling out MFA and separating administrator accounts. Paperwork is rarely the bottleneck.

Three fixes commonly cause the longest delays. An unsupported operating system (A6.1, A6.3) has to be upgraded or removed from every device, or isolated in a sub-set with no internet access. MFA rollout (A7.16AUTO-FAIL, A7.17AUTO-FAIL) has to reach every user of every cloud service, including the ones set up outside IT. Administrator account separation (A7.6, A7.7) means creating a second account for each administrator and removing admin rights from their daily one.

None of these is quick on a fleet of any size. Start them before the question set, not after the assessor's query.

How long does the certificate last?

A Cyber Essentials certificate lasts 12 months from the date of issue, under IASME's scheme rules. Cyber Essentials Plus certificates run on the same 12-month cycle.

The renewal is a fresh submission against whichever requirements version is current, and A1.9 asks whether the application is a renewal. Organisations that keep the evidence from the previous year renew fastest, because the inventory and policies only need updating rather than rebuilding.