Short answer
Cyber Essentials certification is renewed annually. Use the validity and expiry details on the issued certificate when planning continuity; an assessment start date is not a substitute for the certificate record. Arrange renewal early enough to complete any required remediation before expiry.
Why this matters
Turnaround questions matter when a buyer has a tender deadline, insurer request, or supplier onboarding gate. Fast certification is only credible when the submission is complete and compliant; if the assessor has to return the application for fixes, the applicant controls the delay.
A same-day route normally depends on three things: the self-assessment is complete, the answers are consistent with the scope, and the organisation already meets the five Cyber Essentials controls. Cyber Essentials Plus adds scheduling and technical testing, so it should not be treated like a same-day document review.
What to check next
- Prepare scope, asset, user, cloud, and MFA information before submission.
- Submit before midday on a UK business day if you need the 6-hour guarantee.
- Use Cyber Essentials Plus planning time for device sampling and external scan remediation.
Official sources and related Fig Group guidance
For scheme-level confirmation, use the official NCSC and IASME resources. Fig Group links to these sources so Cyber Essentials buyers can verify the scheme, delivery partner and certificate record independently.