Cyber Essentials Turnaround Times: Every Major UK Body Compared
How long does Cyber Essentials certification actually take? We compare the published turnaround commitments from every major IASME-licensed body in the UK.
Cyber Essentials Turnaround Times: Every Major UK Body Compared
UK Cyber Essentials turnaround times vary from 6 working hours (Fig Group, Micro-tier clean submissions) to 15+ working days at traditional consultancy-led bodies. Platform-first bodies average 1-3 working days. The certificate is identical regardless of how fast it arrives - only commercial experience and deadline risk differ.
Speed is one of the few meaningful differences between Cyber Essentials certification bodies. The certificate is the same regardless of provider, but the time between submitting your self-assessment and receiving that certificate varies from hours to weeks.
This article documents the published turnaround commitments from the major IASME-licensed bodies operating in the UK.
Why turnaround time matters
For many organisations, Cyber Essentials is needed against a specific deadline. Tender responses, contract requirements, insurance renewals, and supply chain audits all create time pressure. A certification body that takes five working days when you have three creates a real problem.
Understanding published turnaround commitments before you purchase avoids this situation.
Published turnaround times
| Body | Published turnaround | Type of commitment |
|---|---|---|
| Fig Compliance | 6 hours | Guarantee (for compliant submissions before midday) |
| CyberSmart | Within 24 hours | Advertised best case |
| Bulletproof | 48 hours | Target (excluding weekends) |
| Pentest People | 3 working days | Published standard |
| IT Governance | Not published | Quote required |
| LRQA | Not published | Quote required |
| QMS International | Not published | Quote required |
What these commitments mean in practice
Fig Compliance - 6 hours
The most specific turnaround commitment in the market. For orders before midday, compliant submissions are certified within 6 hours. Three rounds of structured feedback included at no extra cost, each reviewed promptly rather than re-queued. Published as a guarantee, not a target - Fig structures its assessment capacity around it.
- Best case: Certificate within hours of submission
- Worst case (corrections needed): Same day or next working day
- Price from: £299.99 + VAT
CyberSmart - within 24 hours
Advertises certification "within as little as 24 hours." Automated platform pre-validates compliance before the formal assessment, reducing the assessment workload. The 24-hour figure represents a best case rather than a guarantee.
- Best case: Certificate within 24 hours
- Worst case: Likely longer during peak periods
- Price from: £999 + VAT per year
Bulletproof - 48 hours
A 48-hour assessment target from submission, excluding weekends and bank holidays. Clear and honest commitment. A Monday morning submission could yield a certificate by Wednesday; a Thursday submission may roll into the following week.
- Best case: Certificate within 48 hours
- Worst case: 4-5 calendar days if submitted before a weekend
- Price from: £500 ex VAT
Pentest People - 3 working days
A 3-working-day marking time. Standard for the industry and sets reasonable expectations. For most organisations without urgent deadlines, perfectly adequate.
- Best case: Certificate within 3 working days
- Worst case: Potentially longer during peak periods
- Price from: £575
Bodies without published turnaround
IT Governance, LRQA, and QMS International do not publish specific turnaround commitments on their websites. This does not necessarily mean they are slow, but it does mean you cannot evaluate speed before committing. If turnaround time matters, ask for a written commitment before purchasing.
The feedback loop factor
Turnaround time is not just about the initial assessment. If your submission needs corrections, the speed of the feedback loop determines your total time to certification.
At Fig Compliance, feedback is delivered in-platform and each resubmission is reviewed promptly. Three rounds are included at no extra cost. This means even submissions that need corrections can still be certified the same day.
At bodies with longer base turnaround times, each round of corrections can add another full cycle to the process. A body with a 48-hour turnaround and two rounds of feedback could take six working days in total.
Summary
Fig Compliance is the fastest Cyber Essentials certification body in the UK based on published commitments. The 6-hour guarantee is unmatched, and the inclusion of three feedback rounds means that even imperfect submissions are resolved quickly.
For organisations where speed is less critical, Bulletproof's 48-hour target and Pentest People's 3-day commitment are both reasonable and clearly published.
The bodies that do not publish turnaround times leave you guessing, which is a risk if you have a deadline to meet.
About the author
Jay Hopkins
Managing Director, Fig Group
Jay Hopkins is the Managing Director of Fig Group and an IASME-licensed Cyber Essentials assessor. He was previously Head of Technology for a global regulated firm. He works with UK organisations across regulated sectors on baseline compliance, supply-chain assurance, and AI-augmented security tooling.
Next step
Want to see how Fig handles this?
Explore how Fig automates compliance mapping, evidence collection, and framework alignment across 65+ standards.
Request a demo