Fast Cyber Essentials: get certified in 24 hours

Cyber Essentials can be assessed in one business day. Solusec is an appointed IASME Certification Body, so we assess your submission within one business day of you submitting it as standard, and the same day with the urgent turnaround option where you submit before midday. The certificate is issued by us directly. What decides your real timeline is not the assessment: it is how long it takes you to get the five controls right before you submit.

The honest answer: two clocks, not one

Every "Cyber Essentials in 24 hours" claim you will read measures the same thing, the assessor's clock. That clock starts the moment you press submit on a completed self-assessment and stops when a certificate is issued. It is the short clock, and every certification body competes on it.

The clock that actually decides whether you hit your deadline is the other one: the time from "we need Cyber Essentials" to "our answers are all true". That is the preparation clock, and it is the one nobody advertises, because it depends on your estate rather than on the assessor. For an organisation with managed devices, MFA everywhere and a patching routine, it can be an afternoon. For one that has to remove local admin rights from forty laptops and replace an unsupported server, it is weeks.

Any provider quoting you a six-hour or twenty-four-hour figure is quoting the short clock. That is not dishonest, but it answers a question you were not asking.

Published turnaround commitments, compared

These are the assessment-clock commitments the providers below publish on their own sites, checked in September 2026. All of them measure from a completed submission, and all of them are best-case figures rather than guaranteed maximums. Certification bodies change these, so check the current wording before you rely on it.

Published Cyber Essentials assessment turnaround claims, September 2026

Provider	Published claim	Measured from
Fig Compliance (Fastest Cyber Essentials)	6 hours, stated as a guarantee	Completed submission
CyberSmart	"As little as 24 hours"	Completed submission
Solusec, urgent option	Same day, submitted before midday	Completed submission
Solusec, standard	Within 1 business day	Completed submission
Several large certification bodies	No turnaround commitment published	Not stated

We are not going to tell you we are the fastest on that table, because we are not. What we will tell you is that the gap between six hours and the same afternoon is almost never the thing that makes you miss a tender deadline. A failed submission is.

What the scheme itself says a turnaround should be

Worth knowing before you weigh anybody’s promise, including ours. IASME, who run Cyber Essentials on behalf of the NCSC, tell applicants that assessors aim to return results within three days, and that a remark takes no more than three days. That is the baseline the scheme is built around, and it applies to every certification body.

So the honest comparison is not six hours against twenty-four hours. It is every certification body against a three day expectation, and most of the market sits comfortably inside it. Our standard is within one business day, which is quicker than the scheme asks for and slower than the quickest claim in the table above. Both of those are true, and neither is the number that decides whether you hit your date.

The reason nobody advertises the baseline is not hard to work out. A three day expectation makes a six hour guarantee sound like a smaller advantage than it does on its own.

Six hours, twelve hours, twenty-four hours: the same date

The claims on that table look very different from each other. Worked through to the thing you actually need, which is a certificate carrying a date on or before your deadline, most of them are not different at all.

Two reasons. The first is that a turnaround promise measured in working hours only runs during working hours, so six working hours from a Thursday afternoon submission is Friday, not Thursday evening. The second is that you cannot use a certificate at half past three on Tuesday any differently from one issued at nine on Tuesday. Procurement portals, insurers and customers want a date.

Here is the same set of promises against four ordinary submission moments. A nine to five working day, Monday to Friday, no bank holidays, and the assessment passes first time. Check the arithmetic yourself, it is the only way this is worth anything.

When you actually hold the certificate, by promise and submission moment

The promise	Submit Mon 9am	Submit Mon 11:30am	Submit Wed 2pm	Submit Fri 3pm
6 working hours	Monday	Tuesday	Thursday	Monday
12 working hours	Tuesday	Tuesday	Friday	Tuesday
24 hours	Tuesday	Tuesday	Thursday	Monday
Within 1 business day	Tuesday	Tuesday	Thursday	Monday
Same day, submitted before midday	Monday	Monday	Thursday	Monday

Read the first four rows across and they mostly agree. Take the plain "within one business day" row as the baseline and compare the three advertised promises against it: of those twelve cells, nine give the same calendar date. A twenty-four hour promise matches it in all four scenarios. The differences are not where the marketing suggests they are.

Three things worth pulling out of that table.

• Six working hours does buy a real day, but only from an early-morning submission. Submit at nine on Monday and it lands that afternoon while a one business day promise lands Tuesday. That is a genuine difference and we are not going to pretend otherwise. It is also the only cell in the table where it appears.
• A bigger number can be a later date. Twelve working hours from Friday afternoon is Tuesday, because the clock only runs Monday to Friday during office hours. That is slower than a plain one business day promise on the same submission. Working-hour promises are not comparable to clock-hour promises, and neither is comparable to a business-day promise, which is why putting them side by side in a sales table tells you so little.
• A cut-off beats an hour count. The bottom row is not faster because the assessment takes less time. It is faster in two of four scenarios because the commitment is to a day rather than to a duration, so anything arriving before midday gets finished that day rather than spilling into tomorrow's hours.

None of which matters if the real variable moves. Every promise on that table starts when a complete and compliant submission arrives, and stops being relevant the moment one does not pass.

What a turnaround guarantee is a promise about

It is a promise about elapsed time. It is not a promise about how closely anybody looked, and those are different things worth separating before you choose on the number.

An assessment is a person reading your answers against the five controls. They cannot see your estate. They see what you wrote about it. So the whole value of the review sits in one question: does anybody notice when an answer is plausible but wrong?

The answers that pass an unqueried read and cause trouble later are consistent enough to list.

• Scope drawn too narrowly. The certificate covers one office or one entity, and the contract that asked for it is delivered from somewhere else. It passes. It does not satisfy the clause, and you find that out from the customer.
• "All devices are supported." True of the laptops, not true of the machine in the workshop running something that went out of support years ago. Nobody was lying. Nobody asked the follow-up question either.
• Multi-factor authentication "enabled". Enabled on the main tenant, not on the two cloud services somebody signed up for outside it.
• A patching answer describing intent rather than practice. "We apply critical patches within 14 days" is what the policy says. Whether it happened last month is a different sentence.

Each of those earns a certificate and then fails at the point it matters, which is a customer questionnaire, an insurer's follow-up, or next year's renewal when somebody finally asks. A throughput commitment and a queried answer pull in opposite directions. That is not an accusation about anyone, it is just what a clock on the wall does to a judgement call.

There is a second cost, and it is the one people mention afterwards rather than beforehand. Certification bought through a portal against a service level is efficient and impersonal by design. You submit, something happens, a PDF arrives. If you have done this three times and you know your estate, that is exactly what you want and you should buy it. If it is your first time, or your estate is mixed, or you are not sure whether the question about home workers applies to you, then what you actually needed was somebody to talk to, and a fast lane is the wrong purchase at any speed.

Here the person who assesses your submission is the person who reads your email and the person on the phone. If an answer looks wrong you get asked about it rather than passed or failed on it. That is slower than not asking. It is the part we would not trade.

Why a failed submission costs more than a slow assessor

Cyber Essentials is a pass or fail assessment against five technical controls. If your submission does not meet them, you do not get a certificate that day at any price. What happens instead is a feedback cycle: the assessor tells you what failed, you fix it, you resubmit.

Under the current scheme rules you get one free resubmission within a limited window if your first attempt does not pass. Miss that window, or fail twice, and you are paying again and starting over. Each cycle costs you the fix time plus another assessment turnaround.

So the arithmetic that matters is this. A six-hour assessor plus two failed submissions plus a week of remediation is worse than a one-day assessor plus a submission that passes first time. Speed on the short clock cannot rescue a submission that was never going to pass.

Three deadlines nobody puts on a sales page

Turnaround is the figure every provider publishes. These three are the ones that actually catch people out, and all three are set by the scheme rather than by your certification body, so they apply wherever you certify.

Scheme deadlines set by IASME, which apply whichever certification body you use

What	How long	If you miss it
Correcting and resubmitting a failed assessment	2 working days	You start a new application and pay again
How long a purchased application stays open	6 months	The account closes and you pay again
Certificate validity	12 months	You are uncertified until you recertify, and a procurement check will say so

The first is the one to plan around. Two working days is not long to remove local administrator rights across an estate, or to replace a machine running something unsupported. Fail on a Thursday and your window shuts on Monday. That is the real reason we push the gap analysis at anyone working to a date: not because the assessment is slow, but because the correction window is short, and it is exactly the same length whoever you certify with.

The second is more useful than it sounds. Buying does not start a countdown you have to beat. It opens a six month window. If you know Cyber Essentials is coming in the spring, nothing stops you buying now, working through the questions at your own pace, and submitting when you are genuinely ready.

The third catches people at renewal. A certificate that lapsed three weeks ago is not a certificate, and a buyer checking the date will treat it exactly that way. Put the renewal in the diary a month before it expires rather than on the day, and remember that if your estate has changed you are answering the questions again, not copying last year’s.

The three things that actually delay people

Across the assessments we run, delay concentrates in the same three places, and all three are fixable before you submit.

1. Unsupported software still in scope

An operating system, browser, or application past its vendor support date is an automatic fail, and it is the single most common one. Upgrading Windows on a handful of machines is a day. Replacing a line-of-business application that only runs on an unsupported platform is a project, and no assessor can shorten it. Find this one first.

2. Multi-factor authentication gaps on cloud services

MFA is required on all cloud services, for all users, including administrators and including the accounts nobody remembers. The usual failure is not the main tenant, it is a forgotten service: an old file-sharing account, a marketing tool, a legacy mailbox. Inventory every cloud service before you answer the question, not after.

3. Local administrator rights on everyday accounts

Users must not do day-to-day work in an account with administrative privileges. On an unmanaged estate, separating those accounts across every device takes longer than people expect and needs a short period of user disruption. Start it the day you decide to certify.

None of these three is an assessment problem. All three are the reason organisations that "needed it by Friday" get it three weeks later.

What you get from a Certification Body rather than a reseller

Many providers selling Cyber Essentials are not certification bodies. They sell you a package, collect your answers on their own platform, and pass the submission to a certification body to assess. That is a legitimate model, but it puts an extra organisation between you and the person who decides whether you pass, and it means the turnaround you were quoted depends on a queue you cannot see.

Solusec is an appointed IASME Certification Body for Cyber Essentials and for IASME Cyber Assurance, and a Defence Cyber Certification Body for Level 0. When you certify with us:

• The assessment is done by a qualified, certified assessor here, and the certificate is issued by us. There is no handoff and no third party in the chain.
• Your submission is reviewed by a person. It is never fed into an AI system. Solusec holds CREST accreditation for AI-Enabled Penetration Testing, which means our use of AI is independently assured, and assessment is not one of the places we use it.
• If something in your submission does not meet the standard, you get told what and why, in plain terms, rather than a bare fail.
• You can verify us independently on the BlockMark registry and on the IASME certification body directory.

What it costs, including the urgent option

Cyber Essentials pricing follows the IASME fee bands, set by organisation size. These are our prices, fixed, excluding VAT.

Cyber Essentials certification, Solusec pricing

Organisation size	Certification	With urgent turnaround	With gap analysis and urgent
Micro, 1 to 9 staff	£320	£420	£720
Small, 10 to 49 staff	£440	£540	£840
Medium, 50 to 249 staff	£500	£600	£900
Large, 250+ staff	£600	£700	£1,000

• Urgent turnaround, £100. Your application is prioritised and we aim to assess it the same day where you submit before midday, rather than within one business day.
• Gap analysis, quoted on request. We review your setup against the five controls before you apply and tell you exactly what needs fixing. This is the step that protects your deadline, because it is the one that stops a failed submission. Ask for a quote using the contact button under the form.

If you are certain your controls are already in place, buy the certification on its own. If you are not certain and the date matters, the gap analysis is worth more than the urgent option.

The fastest realistic route to a certificate

Assuming a small organisation with a managed estate and no unsupported software, this is what a genuinely fast certification looks like.

Fastest realistic Cyber Essentials timeline

Stage	Who does it	Typical time
Buy, and receive IASME portal access	Us, same day	Within hours
Check the five controls, fix anything obvious	You	Hours to weeks, the real variable
Complete the self-assessment questionnaire	You	2 to 4 hours
Assessment, standard	Us	Within 1 business day
Assessment, urgent option	Us	Same day, submitted before midday
Certificate issued	Us	On pass

You can preview the self-assessment questions before you buy anything. That is the single most useful thing you can do today if you are working to a deadline: read the questions, and see how many you can honestly answer yes to. The count tells you your real timeline better than any provider's turnaround claim.

Working backwards from your date

Most people arrive with a date rather than a plan. Here is the same arithmetic in reverse, using our standard one business day assessment, and the urgent option where it actually changes the answer.

Latest safe dates, counted back from the day you need the certificate in hand

If your controls are	Latest safe submission	Latest safe purchase	What eats the time
Already in place, and you can evidence them	1 business day before	2 business days before	Completing the questionnaire, 2 to 4 hours
Mostly there, with minor gaps	4 business days before	1 to 2 weeks before	The fixes, plus the 2 working day resubmission window held in reserve
Unknown, or the estate is not centrally managed	2 weeks before	4 to 6 weeks before	Finding out what you have, then remediation that cannot be compressed

The middle row is where most organisations actually sit, and the column that matters is the last one. We have built the resubmission window into it deliberately. Planning to pass first time is optimism. Planning so that a fail still leaves you certified before the deadline is a plan.

If your date is closer than the row that describes you, say so when you get in touch. There is usually something that can be done, occasionally there is not, and you will be told which on the first call rather than at the end.

When fast is not possible, and we will say so

We will not pass a submission that does not meet the standard, whatever your deadline is. If you tell us your date and your setup will not support it, we will say that on the first call rather than take your money and let you find out at the end.

Certification bodies advertising a guaranteed pass are advertising something the scheme does not permit. If a provider guarantees you will pass before seeing your estate, that guarantee is either meaningless or it means they are not really assessing you. We have written about why a guaranteed pass should worry you, and about how to tell a genuine assessor from a reseller.

Common questions