How long does Cyber Essentials take?

Last updated: 27 September 2026

For a well-prepared small organisation, Cyber Essentials can be completed in a few days to a couple of weeks. Most of the time goes into preparation: getting devices, accounts and settings to the required standard before you submit.

Typical timeline

1. Readiness check (1 to 3 days): review devices, software, accounts, MFA and firewall settings against the requirements.
2. Fixing gaps (a few days to several weeks): replacing unsupported devices, enabling MFA, applying updates and tidying admin rights. This varies most.
3. Completing the questionnaire (1 to 2 days): answering the online self-assessment accurately.
4. Assessment and certificate: the certification body marks your answers, usually within a few working days.

Once you start your assessment, you have up to six months to submit it.

What about Cyber Essentials Plus?

Cyber Essentials Plus adds a hands-on technical audit of a sample of your devices. It must be completed within three months of achieving Cyber Essentials. The audit itself usually takes one or two days.

How long does the certificate last?

Certification is valid for 12 months, so plan to renew each year and keep standards up in between. See what happens if you fail and which devices are in scope.

ABCOM, an NCSC Assured Service Provider, guides organisations through Cyber Essentials and Cyber Assurance from start to finish.