The time required to achieve Cyber Essentials and Cyber Essentials Plus certifications can vary depending on several factors, including the size and preparedness of the organization. Here’s a general timeline for each:
Cyber Essentials:
- Preparation: If your organization is already well-prepared and has implemented the necessary cybersecurity controls, the self-assessment questionnaire can typically be completed within a few days.
- Certification Process: After submitting the questionnaire to an accredited certification body, the review and approval process usually takes a few days to a few weeks, depending on the body’s workload and any additional information required.
Cyber Essentials Plus:
- Preparation: Like Cyber Essentials, preparation involves ensuring all necessary controls are in place and addressing any gaps identified during a pre-assessment.
- Vulnerability Assessment: The external vulnerability assessment, which includes scanning and testing, typically takes a few days to a week. Scheduling and conducting the assessment can add to the timeline.
- Addressing Issues: If vulnerabilities or issues are identified, remediation and re-testing may be required. This could extend the timeline by additional weeks, depending on the complexity and number of issues.
- Certification Process: Once the assessment and any necessary re-testing are complete, the certification body will review the results and issue the Cyber Essentials Plus certification, usually within a few weeks.
In summary:
- Cyber Essentials: Typically a few days to a few weeks.
- Cyber Essentials Plus: Generally a few weeks to a few months, including preparation, assessment, and addressing any issues.
Planning and preparing in advance can help streamline the process and reduce the time needed to achieve certification.
