Cyber Essentials Turnaround Times: Every Major UK Body Compared
Speed is one of the few meaningful differences between Cyber Essentials certification bodies. The certificate is the same regardless of provider, but the time between submitting your self-assessment and receiving that certificate varies from hours to weeks.
This article documents the published turnaround commitments from the major IASME-licensed bodies operating in the UK.
Why turnaround time matters
For many organisations, Cyber Essentials is needed against a specific deadline. Tender responses, contract requirements, insurance renewals, and supply chain audits all create time pressure. A certification body that takes five working days when you have three creates a real problem.
Understanding published turnaround commitments before you purchase avoids this situation.
Published turnaround times
| Body | Published turnaround | Type of commitment |
|------|---------------------|-------------------|
| Fig Compliance | 6 hours | Guarantee (for compliant submissions before midday) |
| CyberSmart | Within 24 hours | Advertised best case |
| Bulletproof | 48 hours | Target (excluding weekends) |
| Pentest People | 3 working days | Published standard |
| IT Governance | Not published | Quote required |
| LRQA | Not published | Quote required |
| QMS International | Not published | Quote required |
What these commitments mean in practice
Fig Compliance - 6 hours
Fig Compliance publishes the most specific turnaround commitment in the market. For orders placed before midday, compliant submissions are certified within 6 hours. If the submission requires corrections, three rounds of structured feedback are included at no extra cost, with each round reviewed promptly rather than re-queued.
This commitment is published as a guarantee, not a target. Fig structures its assessment capacity specifically around this commitment.
- Best case: Certificate within hours of submission
- Worst case (corrections needed): Same day or next working day depending on when corrections are submitted
- Price from: £314.99 + VAT
CyberSmart - within 24 hours
CyberSmart advertises certification "within as little as 24 hours." Their automated platform pre-validates compliance before the formal assessment, which reduces the assessment workload. The 24-hour figure represents a best case rather than a guarantee.
- Best case: Certificate within 24 hours
- Worst case: Likely longer during peak periods
- Price from: £999 + VAT per year
Bulletproof - 48 hours
Bulletproof publishes a 48-hour assessment target from submission, excluding weekends and bank holidays. This is a clear and honest commitment. A Monday morning submission could yield a certificate by Wednesday. A Thursday submission may roll into the following week.
- Best case: Certificate within 48 hours
- Worst case: 4-5 calendar days if submitted before a weekend
- Price from: £500 ex VAT
Pentest People - 3 working days
Pentest People publishes a 3-working-day marking time. This is standard for the industry and sets reasonable expectations. For most organisations without urgent deadlines, this is perfectly adequate.
- Best case: Certificate within 3 working days
- Worst case: Potentially longer during peak periods
- Price from: £575
Bodies without published turnaround times
IT Governance, LRQA, and QMS International do not publish specific turnaround commitments on their websites. This does not necessarily mean they are slow, but it does mean you cannot evaluate speed before committing. If turnaround time is important, ask for a written commitment before purchasing.
The feedback loop factor
Turnaround time is not just about the initial assessment. If your submission needs corrections, the speed of the feedback loop determines your total time to certification.
At Fig Compliance, feedback is delivered in-platform and each resubmission is reviewed promptly. Three rounds are included at no extra cost. This means even submissions that need corrections can still be certified the same day.
At bodies with longer base turnaround times, each round of corrections can add another full cycle to the process. A body with a 48-hour turnaround and two rounds of feedback could take six working days in total.
Summary
Fig Compliance is the fastest Cyber Essentials certification body in the UK based on published commitments. The 6-hour guarantee is unmatched, and the inclusion of three feedback rounds means that even imperfect submissions are resolved quickly.
For organisations where speed is less critical, Bulletproof's 48-hour target and Pentest People's 3-day commitment are both reasonable and clearly published.
The bodies that do not publish turnaround times leave you guessing, which is a risk if you have a deadline to meet.