“How long does the certificate take?” We hear this on almost every call, and there is usually a contract award or an expiry date behind it.
The short answer: a SACS-210 certificate usually takes 2 to 4 weeks from the start of work to the issued certificate. Here is what happens in that time, and what makes it shorter or longer.
The Stages of Certification
1. Questionnaire and quotation
You send your request and the SACS-210 questionnaire arrives in your inbox. You fill it in with information about your users, devices, email and current controls, and we review it and send you a quotation.
The time here depends on you: the sooner the questionnaire comes back, the sooner work starts.
2. Gap review
We compare your current setup with TPC-1.1 to TPC-1.33 and identify exactly what is in place and what is missing.
3. Implementation
Usually the longest stage. We apply the missing controls across email, accounts and devices: MFA, disk encryption, anti-virus, firewall, USB restrictions, macro blocking and more. In parallel we prepare the written policies and procedures.
4. Evidence report
We document each control with screenshots, build the report in the format the auditor expects, and submit it to the audit firm.
5. Live audit session
The auditor reviews the report, then schedules a live online session to check the implementation personally. We attend with you and answer the technical questions.
6. Certificate issued
Once the audit is passed, the authorized audit firm issues the certificate, valid for 24 months.
What Makes It Faster?
- A company email domain already in place on Microsoft 365 or Google Workspace.
- A limited number of devices, or devices managed centrally with a tool such as Intune.
- Controls already applied from a previous SACS-002 or SACS-210 certificate.
- Quick replies to the questionnaire and to requests for device access.
- One responsible person on your side who follows the work and makes decisions.
And What Makes It Longer?
- No company email domain, so it has to be created and email moved to it first.
- Devices on editions without encryption support, such as Windows Home, that need upgrading.
- Expired anti-virus licences that need to be purchased.
- Devices spread across several sites or employees working remotely.
- Auditor findings that need fixing and part of the audit repeated.
- The audit session date itself, which depends on the audit firm’s schedule.
When Should You Start a Renewal?
The certificate is valid for 24 months, and the standard requires renewal before expiry (TPC-1.6). We recommend starting about two months before the expiry date, so there is enough time to fix anything that changed since the last certificate: new devices, new employees or expired licences.
Details are on the SACS-210 renewal page.
What If the Deadline Is Very Close?
If the certificate is needed for an urgent award, or yours has already expired, contact us right away. We handle it as an urgent request and start with the controls that take the longest.
To prepare what you can on your side first, see the SACS-210 requirements checklist.
Frequently Asked Questions
Can the certificate be issued in one week?
Rarely. Even with every control in place, the evidence report needs preparing and the audit session needs a date from the audit firm, so we do not promise timelines we do not fully control.
Is a renewal faster than a first certificate?
Usually yes, if the controls stayed in place throughout the certificate period. If devices or employees were added without the controls, a renewal gets close to a first certificate in duration.
Who sets the date of the audit session?
The authorized audit firm sets the date after reviewing the evidence report. Our job is to make sure the report reaches them complete and clear the first time, so the date is not delayed by requests for more evidence.
Does it take longer if our previous certificate was under SACS-002?
A little. The controls you applied for SACS-002 still count, but we review them against SACS-210 and apply the new ones. See moving from SACS-002 to SACS-210.
How do we keep the controls in place until the next renewal?
The controls must stay active for the full 24 months, not just on audit day. That is why many of our clients choose an IT maintenance contract that keeps the settings in place and applies them to every new device and employee.
Request your certificate and the SACS-210 questionnaire arrives in your inbox right away.
