When people ask what certification costs, they mean the invoice from the certifying body. That is the smallest and most predictable number. Cyber Essentials is a modest fixed fee; a management system standard is more, and scales with the size of your organisation. If that were the whole cost, most businesses would simply pay it and move on.

The real cost is hours. Someone has to gather evidence, write the policies that were only ever informal, and answer an assessor's questions in the language the scheme expects. In the businesses we help, this lands on one person who already has a full job, and it is rarely fewer than a couple of full days spread across a fortnight. Nobody quotes you for that because nobody can, honestly, until they see your setup.

Then there is the chasing. This is the six weeks nobody warns you about. You need a supplier to confirm a setting, a colleague to send a screenshot, a director to sign a policy, and each of those waits on someone else's inbox. The technical work might be a day. Getting other people to do their small part is what stretches the whole thing out.

We say this not to put anyone off but so the timeline is realistic. If you need a certificate for a tender with a deadline, start six to eight weeks out, not two. Do the useful groundwork first - the register, the leavers process, second factors on email - because most of it is required anyway and it makes the assessment itself almost boring, which is the goal.