A cyber security gap assessment for a small to mid-sized business typically takes 2 to 4 weeks from kickoff to final report, ranging from a few days for a focused review under about 20 staff to 6 weeks or more for a multi-site organisation with complex compliance obligations. The fieldwork itself is usually the smallest slice; scoping, evidence collection and report writing carry most of the timeline.
TL;DR
- Most SMB gap assessments run 2 to 4 weeks end to end; complexity, not headcount, moves the number.
- Fieldwork is days; scoping, evidence chasing and report writing carry most of the timeline.
- Fixed-scope frameworks (Essential Eight baseline) are faster than open-ended reviews.
- Remediation planning runs after the report, on its own schedule.
Why the timeline varies
Four factors dominate the duration:
- Scope. A baseline review against a fixed framework such as Essential Eight has a defined checklist; an open-ended review of "everything" has no finish line.
- Evidence access. If logs, policies and configurations are documented and reachable, assessment days shrink; if every artefact needs chasing across three providers, the calendar stretches.
- Interviews. Assessors need a few hours with IT, plus shorter sessions with finance, HR and operations. Getting four calendars into one week is often the biggest single delay.
- Report depth. A prioritised action plan with effort estimates takes longer to write than a findings list, and it is worth the extra days.
Typical timeline by business size
| Business size | Typical duration | Notes |
|---|---|---|
| Under 20 staff, single site | 3-10 days | Often a single assessor and a fixed framework |
| 20-200 staff, one IT environment | 2-4 weeks | The most common engagement shape |
| 200-1,000 staff or multi-entity | 4-6 weeks | Multiple stakeholders, more policy review |
| Regulated or multi-site | 6-10 weeks | Compliance overlays add evidence rounds |
Use the middle row as the planning default. A 50-person professional services firm with cloud systems and a documented policy set sits comfortably inside four weeks.
The phases and how long each takes
1. Scoping and kickoff (2-5 days)
The assessor confirms systems in scope, the framework to assess against, and the evidence list. A clear scope here saves a week later.
2. Evidence collection and technical review (3-10 days)
The working heart of the assessment: configuration review, identity and access checks, email security, backups, endpoint coverage, and policy review. The assessor reads more than they ask.
3. Interviews (2-5 days, often overlapping)
Structured sessions confirm what the documents cannot: who actually approves changes, how offboarding really works, who holds admin rights.
4. Analysis and report (3-10 days)
Findings are rated against the framework, risks are prioritised, and remediation gets effort estimates. The report should name what to fix first and why, not just what is missing.
How to compress the timeline
- Prepare the evidence pack before kickoff. A current network diagram, policy set and asset list can cut a week by themselves.
- Pick a fixed framework. A baseline Essential Eight review has a defined checklist and finishes when the checklist does.
- Book all interviewees in week one. Calendar conflicts are the most common schedule killer.
- Agree the report format upfront. Reformatting rounds are pure delay.
A cyber security gap assessment that measures both the technical estate and the human layer runs faster when training and reporting data already exist - the human risk side is one export rather than a fresh investigation.
After the report
The assessment ends; the programme does not. Remediation of quick wins usually starts within days, while structural fixes land over a quarter or two. This is also where the people side connects: many gaps trace to behaviour, and security awareness training addresses the human layer no configuration change can reach.
FAQ
How long does a gap assessment take for a 50-person business? Typically 2 to 4 weeks end to end, with 2 to 3 days of assessor fieldwork inside that window.
Can a gap assessment be done faster? Yes - a fixed-scope review against one framework with a prepared evidence pack and pre-booked interviews can finish in a week or less for a small, single-site business.
What adds the most delay? Missing evidence and calendar conflicts. Both are controllable before kickoff.
Is the timeline different for Essential Eight assessments? The phases are the same; the fixed checklist usually makes the whole engagement shorter than an open-ended review of equivalent depth.
What happens immediately after the assessment? You receive a prioritised findings report. Quick wins start within days; structural fixes are scheduled over the following quarter.