Readiness = The entry-level consulting service. Purely advisory, with no external fees.

Day 1 – Review of your IT setup against the five Cyber Essentials controls
Day 2 – Delivery of gap analysis report, action plan, and optional consultancy call

Essentials = We guide you through, prepare answers, ensure you’re compliant before submitting. You then pay the official IASME fee separately.

Typical duration: 3–5 working days with consultancy support

Day 1-2 – Readiness check, remediation guidance
Day 3-5 – Complete self-assessment questionnaire, review, and submission to Certification Body

Notes: If your environment is already compliant, you can sometimes certify in as little as 1–2 days. If remediation is required (e.g., patching, MFA setup), this may extend the timeline.

Essentials Plus = We act as advisor, preparing you for the audit, helping with remediation, and coordinating with the Certification Body. You pay the CB directly for the audit.

Typical duration: 5–10 working days depending on availability of the independent auditor

Day 1-3 – Pre-audit readiness check and remediation support (Phenomlab consultancy role)
Day 4-7 – Independent Certification Body schedules and carries out the audit
Day 8-10 – Audit findings addressed, certificate issued

Notes: The audit scheduling is the main variable. Some SMEs complete Plus in a week; others may take 2–3 weeks if fixes are needed after the audit.

It depends on your current stage and requirements:

• Readiness is ideal for startups or SMEs who want a readiness check without committing to full certification.

• Cyber Essentials suits growing businesses that need an official certificate to win contracts and reassure customers.

• Cyber Essentials Plus is best for SMEs in regulated sectors or those bidding for high-value contracts, where independent validation is required.

Yes. Readiness is optional. Many businesses go directly to certification. Readiness is designed as a low-cost step to help you avoid surprises.

Yes. You must achieve Cyber Essentials certification before applying for Cyber Essentials Plus.

Both Cyber Essentials and Cyber Essentials Plus are valid for 12 months. They must be renewed annually.

With Phenomlab’s preparation and readiness support, you’ll know what to fix before submission. If issues are found, you’ll get a window of time to remediate and resubmit.

Not for all businesses – but many government contracts and private sector supply chains now require it. Even if it’s not mandatory for you, it’s a valuable trust signal for customers and investors.

If you already have good IT security practices, you can often achieve Cyber Essentials within a few weeks. Cyber Essentials Plus takes longer due to scheduling the external audit.