Working to a Cyber Essentials deadline
How far ahead you need to start for a tender, a contract, an insurance renewal or an audit, and what to do when the date is already closer than that.
For an organisation with a managed estate, allow two weeks from decision to certificate. For an unmanaged or mixed estate, allow four to six. The assessment itself is one business day of that; everything else is you getting the five controls right. If your date is closer than this, it is usually still recoverable, but only if you start with a gap analysis rather than a submission.
How far ahead to start
| Your situation | Start this far ahead | Main risk |
|---|---|---|
| Fully managed estate, MFA everywhere, current patching | 1 to 2 weeks | Forgotten cloud services without MFA |
| Mostly managed, some legacy | 3 to 4 weeks | Unsupported software discovered late |
| Unmanaged devices, BYOD, no central control | 6 to 8 weeks | Admin rights separation across every device |
| Previously failed an assessment | 2 to 4 weeks | Resubmission window expiring |
| Cyber Essentials Plus required | Add 2 to 3 weeks | Scheduling the hands-on audit |
The four deadlines people actually have
A tender or bid closing
Check whether the portal wants the certificate uploaded at submission or only before contract award. The difference is often several weeks, and bid teams routinely assume the earlier one. See fast Cyber Essentials for a tender.
A client contract completing
Usually the most flexible, because the other side wants the contract signed too. Ask whether certification in progress with a named certification body is acceptable as an interim. See fast Cyber Essentials for a contract.
An insurance renewal
Rarely movable, and the wording matters: some insurers specify Cyber Essentials Plus, which takes longer. Read the requirement before you buy. See fast Cyber Essentials for insurance.
An audit or scheme requirement
Includes Defence Cyber Certification, where Cyber Essentials is a prerequisite for every level. If you are working towards DCC Level 0 before 31 December 2026, your Cyber Essentials needs to land first.
The three things that will cost you the deadline
Assessment speed is rarely what makes people late. These three are, and all of them are findable today.
- Unsupported software still in scope. Any operating system, browser or application past its vendor support date is an automatic fail. Upgrading a few machines is a day. Replacing a line-of-business application that only runs on an unsupported platform is a project.
- MFA missing on a cloud service you forgot about. It is required on every cloud service for every user, including administrators. The failure is almost never the main tenant, it is an old file-sharing account or a legacy mailbox.
- Everyday accounts holding local administrator rights. Separating admin from day-to-day accounts across an unmanaged estate takes longer than people expect and needs a short window of user disruption.
If your date is already tight
Do these three things, in this order, today.
- Read the actual requirement. Confirm whether it says Cyber Essentials or Cyber Essentials Plus, and confirm the real date the certificate is needed by. A surprising number of tight deadlines turn out to be softer than the person chasing them believed.
- Ask for a gap analysis. We quote it against your setup. It converts an unknown remediation list into a known one within a day or two, which is the only way to plan a tight window honestly.
- Add urgent turnaround. £100, assessment within one business day of submission. Add it at the end, not the start: it is the cheapest part of the timeline to fix.
Price
| Organisation size | Certification | + urgent turnaround | + gap analysis |
|---|---|---|---|
| Micro, 1 to 9 staff | £320 | £420 | £720 |
| Small, 10 to 49 staff | £440 | £540 | £840 |
| Medium, 50 to 249 staff | £500 | £600 | £900 |
| Large, 250+ staff | £600 | £700 | £1,000 |
Ready to buy?
Transparent, fixed pricing based on your organisation size. By default we give you access to the IASME portal to complete your Cyber Essentials assessment yourself, and once you submit it we aim to assess within one business day. You can preview the Cyber Essentials self-assessment questions to see where you stand first. There is no call or consultation as standard; we simply send you the questionnaire to complete. Your submission is reviewed by a qualified, certified assessor, never fed into AI. Need it faster? Add urgent turnaround below. Want us to review your setup against the controls before you apply? That is a gap analysis, quoted separately: ask for one using the contact button under the form.
An appointed IASME Certification Body: your certificate comes directly from us. Verify our credentials on the BlockMark registry, and find us listed on the IASME website.
Common questions
How long does Cyber Essentials take in total?
One to two weeks for a managed estate, four to six for an unmanaged one, measured from the decision to certify to the certificate being issued. The assessment is one business day of that. The rest is remediation, which depends entirely on your estate rather than on your certification body.
My tender closes in ten days. Is that enough?
Usually yes if your estate is managed. Ask for a gap analysis today, fix what it finds in the first week, submit, and take the urgent assessment. The thing that derails a ten-day window is discovering unsupported software on day seven, which is exactly what the gap analysis prevents.
Can I tell my buyer I am 'in progress'?
Many will accept it for a short window, especially if you can name your certification body so they can verify it independently. Ask them directly rather than assuming. What buyers reject is an unsupported claim with no certification body behind it.
Does the certificate expire?
Cyber Essentials certification lasts twelve months. If your deadline is an annual contract requirement or an insurance renewal, put a reminder in at ten months, not twelve, so you are never certifying under time pressure again.
What if I miss the resubmission window after a fail?
You would need to start a new application and pay again. The window is limited, so a fail late in a tight deadline is the expensive outcome. See what happens after a failed assessment.
Related
Free, no obligation
Understand your exposure
An attacker’s first move is not an attack, it is a look. So we look first, and send you what we find, worst first.
- Services and ports you did not know were open
- Security misconfigurations on anything public facing
- Known vulnerabilities already indexed by engines like Shodan
- Company credentials sitting in known breach data
The only question is: do you know where and how to look?
We reply within one business day. Prefer to talk first? 01902 288763 or info@solusec.co.uk.
Nothing is touched on your systems. It is all public and already indexed, just scattered. We pull it together, which is what an attacker does first.
Deadline looming? Let's get you certified.
A quick call, an honest answer on what is achievable, a fixed price, and an assessor who moves fast.