How long does Cyber Essentials take? The honest timelines

The three clocks

Three separate things take time, and people blur them. Preparation — building the scope list, switching on MFA, fixing gaps — is the long one and entirely yours. The questionnaire is an afternoon once you know the answers. The assessor’s review after you submit is set by your certification body, and its length is theirs to quote — ask before you buy so it never surprises you.

Timelines by starting point

Tidy and cloud-based: hours, spread over a week or two

Modern laptops, Microsoft 365 or Google Workspace, no servers, no shared logins. The work is an hour building the asset list, ten minutes per cloud service confirming MFA, an afternoon of secure-configuration settings, and the short policies. Focused, this is a few hours; realistically, spread over one to two weeks around a day job.

Ordinary and a bit scruffy: two to four weeks

Some MFA on, some not; updates “mostly automatic”; nothing written down; one machine of uncertain age. The extra time is per-account MFA enrolment across the team, chasing the odd tool nobody owns, and writing processes for the first time. None of it is hard; it is coordination.

Old kit or shared logins: four to six weeks

An unsupported device needs a decision — upgrade, replace, or wall off — and possibly a purchase. Untangling a shared login means new accounts, new habits and a week of “where did that email go”. Start these two first; everything else can run alongside.

The two things that stretch the calendar

• Hardware. A laptop that cannot run a supported operating system is a purchase and a migration, not a setting — see the unsupported software guide.
• Other people’s calendars. MFA enrolment needs each person’s phone in hand; the tool with one part-time owner waits for their Tuesday. Announce a deadline and do enrolment in one sitting where you can.

How long it lasts, and the renewal clock

The certificate is valid for twelve months. Renewal is a full reassessment against whatever the question set is then, so put a reminder six weeks before expiry — the renewal planner turns your date into the working-back timeline, and the renewal guide covers what tends to have changed.

Compressing it honestly

The order that saves days: run the free readiness check or the checklist first so the gap list exists on day one; clear the automatic fails before anything cosmetic; do MFA as one all-hands sitting, not a rolling request; and only buy the assessment when the answers are already true — paying first compresses nothing and adds a deadline.