Cyber Essentials Plus assessment — what’s involved and how long it takes

A Cyber Essentials Plus assessment is the NCSC-backed Cyber Essentials scheme’s technical verification: it has two parts — an online questionnaire and a hands‑on technical test by an accredited assessor — and usually finishes with a certificate if the tests pass.

First week

In the first week you register and complete the online Cyber Essentials questionnaire and gather basic evidence: inventories, patching processes and user-account lists. This stage is administrative but essential: assessors check the information before arranging the practical tests. Expect an assessor to ask for proof of software-update policies, firewall settings and administrator account controls.

What matters here is readiness — honest answers reduce surprises later. Use this week to tidy device inventories and note any machines that are temporarily offline or managed by third parties. If you need guidance on preparing documentation or managing the pre-check, see our Cyber Essentials page.

First month

Between scheduling and the assessor visit you should remediate simple, repeatable issues. In our experience of the businesses we work with, when we run Cyber Essentials Plus assessments, most first-attempt failures come from two places: patch cadence on user devices (a Chrome or Adobe patch behind), or an unenforced admin approval workflow. Both are fixable in days once the assessor flags them, but not on the morning of the assessment.

Plan this month for these practical tasks:

Confirm automatic updates are enabled on endpoints and servers.
Ensure a documented admin-approval workflow is actually enforced (not just in policy).
Remove or restrict legacy admin accounts and shared passwords.

Tip: schedule the assessor only after a fresh patch run and a validation pass; that eliminates the most common failures and turns the on-site test into a verification rather than a troubleshooting session.

First quarter

The technical verification usually happens in this phase. An accredited assessor performs on-device checks: vulnerability scans, manual inspection of configuration and sometimes a small number of social-engineering checks depending on the scope. The assessor will verify your firewall configuration, secure configuration of endpoints, and that anti-malware controls are active.

Practical outcomes during this phase include a short list of findings and an assessor report. Most fixes at this stage are operational (change a setting, enforce a patch job, tighten an admin workflow) rather than large projects. Keep authorised staff available so fixes can be applied promptly; delays at this stage extend the timeline and increase cost.

What a pass looks like: systems up to date, admin controls enforced and network / endpoint protections enabled. A pass results in a stamped Cyber Essentials Plus certificate; a fail gives you a clear remediation list and a chance to re-test.

First year

After certification you should treat Cyber Essentials Plus like an operational checkpoint rather than a one-off trophy. Maintain a monthly patch cadence, review admin privileges quarterly and record configuration changes. Renewals typically require demonstrating the same controls remain in place, so continuous attention reduces future assessment effort.

Use this year to close strategic gaps: asset management, backup verification and employee training. Small investments here lower the chance of failure next time and reduce the operational friction of re-testing.

What to watch for next

Before your next assessment focus on two short checks: confirm automatic updates have run in the 48 hours before the assessor visit, and make sure admin approvals are enforced (not just documented). If you can satisfy those, the technical visit is usually straightforward and quick.

Finally, if you prefer to hand off the prep, an accredited assessor or managed service can handle the pre-checks and fix the quick wins so the visit is verification rather than firefighting. That saves time and protects your reputation with suppliers and insurers. A small investment now avoids last-minute disruption on the day and keeps your certificate current; improved uptime and reduced audit time are common benefits.

FAQ

How long does a Cyber Essentials Plus assessment usually take?

The technical verification itself is typically completed in one day; the full process from questionnaire to certificate often takes between one and four weeks depending on the speed of remediation.

Will failing the first attempt stop me getting certified?

No — a fail gives a clear remediation list and a chance to re-test; most fixes are operational and can be completed in days if you act on the assessor’s report.

What are common fail points I should check before booking?

Check that endpoints are fully patched and that admin approval workflows are enforced; these two items cause the majority of first-attempt failures in the assessments we run.