How long does Cyber Essentials actually take?

There are really four phases, and only one of them is unpredictable. Finding out where you stand (a gap analysis or readiness check) is fast: minutes to a couple of hours for a straightforward business. Submitting the formal questionnaire, once you're actually ready, is quick too. Certification body review adds its own turnaround on top, which you don't fully control but is generally not the long pole.

The phase that actually determines your timeline is remediation: closing whatever gaps get found. For a business that's already close, that might be a day or two of tidying up. For a business with real gaps, a patching backlog, MFA that was never properly rolled out across the team, admin accounts that need separating, it can stretch to several weeks, simply because some of that work (getting a whole team to set up MFA properly, for example) takes coordination, not just effort.

The phase that actually determines your timeline is remediation: closing whatever gaps get found.

So "how long will this take" is really the wrong first question. The right one is "how big is my gap," and that's exactly what a proper check surfaces early, rather than mid-process when you're already committed to a timeline.

Run the free 5-minute readiness check to find out where you actually stand, before you set a deadline you might not be able to hit.