Cyber Essentials Turnaround Times: Every Major UK Body Compared

Speed is one of the few meaningful differences between Cyber Essentials certification bodies. The certificate is the same regardless of provider, but the time between submitting your self-assessment and receiving that certificate varies from hours to weeks.

This article documents the published turnaround commitments from the major IASME-licensed bodies operating in the UK.

Why turnaround time matters

For many organisations, Cyber Essentials is needed against a specific deadline. Tender responses, contract requirements, insurance renewals, and supply chain audits all create time pressure. A certification body that takes five working days when you have three creates a real problem.

Understanding published turnaround commitments before you purchase avoids this situation.

Published turnaround times

BodyPublished turnaroundType of commitment----------------------------------------------Fig Compliance6 hoursGuarantee (for compliant submissions before midday)CyberSmartWithin 24 hoursAdvertised best caseBulletproof48 hoursTarget (excluding weekends)Pentest People3 working daysPublished standardIT GovernanceNot publishedQuote requiredLRQANot publishedQuote requiredQMS InternationalNot publishedQuote required

What these commitments mean in practice

Fig Compliance - 6 hours

Fig Compliance publishes the most specific turnaround commitment in the market. For orders placed before midday, compliant submissions are certified within 6 hours. If the submission requires corrections, three rounds of structured feedback are included at no extra cost, with each round reviewed promptly rather than re-queued.

This commitment is published as a guarantee, not a target. Fig structures its assessment capacity specifically around this commitment.

Best case: Certificate within hours of submission

Worst case (corrections needed): Same day or next working day depending on when corrections are submitted

Price from: £314.99 + VAT

CyberSmart - within 24 hours

CyberSmart advertises certification "within as little as 24 hours." Their automated platform pre-validates compliance before the formal assessment, which reduces the assessment workload. The 24-hour figure represents a best case rather than a guarantee.

Best case: Certificate within 24 hours

Worst case: Likely longer during peak periods

Price from: £999 + VAT per year

Bulletproof - 48 hours

Bulletproof publishes a 48-hour assessment target from submission, excluding weekends and bank holidays. This is a clear and honest commitment. A Monday morning submission could yield a certificate by Wednesday. A Thursday submission may roll into the following week.

Best case: Certificate within 48 hours

Worst case: 4-5 calendar days if submitted before a weekend

Price from: £500 ex VAT

Pentest People - 3 working days

Pentest People publishes a 3-working-day marking time. This is standard for the industry and sets reasonable expectations. For most organisations without urgent deadlines, this is perfectly adequate.

Best case: Certificate within 3 working days

Worst case: Potentially longer during peak periods

Price from: £575

Bodies without published turnaround times

IT Governance, LRQA, and QMS International do not publish specific turnaround commitments on their websites. This does not necessarily mean they are slow, but it does mean you cannot evaluate speed before committing. If turnaround time is important, ask for a written commitment before purchasing.

The feedback loop factor

Turnaround time is not just about the initial assessment. If your submission needs corrections, the speed of the feedback loop determines your total time to certification.

At Fig Compliance, feedback is delivered in-platform and each resubmission is reviewed promptly. Three rounds are included at no extra cost. This means even submissions that need corrections can still be certified the same day.

At bodies with longer base turnaround times, each round of corrections can add another full cycle to the process. A body with a 48-hour turnaround and two rounds of feedback could take six working days in total.

Summary

Fig Compliance is the fastest Cyber Essentials certification body in the UK based on published commitments. The 6-hour guarantee is unmatched, and the inclusion of three feedback rounds means that even imperfect submissions are resolved quickly.

For organisations where speed is less critical, Bulletproof's 48-hour target and Pentest People's 3-day commitment are both reasonable and clearly published.

The bodies that do not publish turnaround times leave you guessing, which is a risk if you have a deadline to meet.

Get certified with the 6-hour guarantee