How long does Cyber Essentials take?
Quick answer: For a well-prepared small business already running Windows 11 and Microsoft 365, Basic Cyber Essentials typically takes 1 to 2 weeks from start to certificate. For a typical firm that needs to roll out Multi-Factor Authentication (MFA), tidy up admin accounts or replace a few unsupported apps, allow 2 to 4 weeks. If you need Cyber Essentials Plus as well, allow 4 to 6 weeks in total.
Last reviewed 2 November 2026 against the Cyber Essentials requirements v3.3 (Danzell question set).
The four stages and realistic durations
| Stage | Well-prepared M365 firm | Typical small firm (some fixes needed) | Firm with legacy Windows 10 / hardware to replace |
|---|---|---|---|
| 1. Scope & gap check | 1–2 days | 2–4 days | 1 week |
| 2. Technical fixes & MFA rollout | 1–3 days | 1–2 weeks | 3–6 weeks (waiting for new PCs or software migration) |
| 3. Completing the assessment & director sign-off | 1–2 days | 2–3 days | 2–3 days |
| 4. Assessor marking & certificate issue | 2–5 working days | 2–5 working days | 2–5 working days |
| Total for Basic Cyber Essentials | 1 to 2 weeks | 2 to 4 weeks | 4 to 8 weeks |
Key IASME time limits to know
- 6-month account expiry: Once you purchase and open a Cyber Essentials self-assessment account on the IASME portal, you have 6 months to submit it before the account expires without a refund.
- Typically 2 working days (48 hours) for resubmission: If the assessor marks your submission as a fail and asks for fixes or clarifications, you are typically given 2 working days to fix the issues and resubmit once free of charge. That is why you should always complete your technical fixes before submitting.
- 90-day (3-month) window for Plus: If you are going on to Cyber Essentials Plus, the technical audit must be completed within 90 days of the date your Basic certificate is issued (IASME FAQ).
What slows firms down most often
- Waiting for hardware stock when replacing old Windows 10 PCs or an end-of-life office router.
- Chasing staff to register for MFA across third-party cloud apps (accounting, CRM, payroll).
- Uncovering personal phones (BYOD) running unsupported iOS or Android versions that access work email.
Find out in 10 minutes how much work your systems need
Answer 25 quick questions to see whether any of the April 2026 Danzell rules would fail your assessment outright, with the exact fix for each.
Check if you'd auto-fail in 10 minutes →