All services Every engagement has a fixed, published price. Book a strategy call
Cyber Essentials failures from the marking side: what failing means, the fail reasons ranked as we see them, the recovery plan for a failed assessment, and the 2026 rules that raised the stakes for Cyber Essentials Plus.
This guide covers Cyber Essentials failures from both ends: why organisations fail, and what to do if you already have. It is written by an IASME licensed certification body, so the failure patterns come from marking real submissions, and the recovery advice comes from watching organisations handle failure well and badly. If you are reading this with a failed assessment in front of you, skip to the recovery plan. It is calmer down there than you expect.
The short version. Most Cyber Essentials failures come from a short list: out-of-support software, incomplete multi-factor authentication, security updates slower than 14 days, and scope errors, in that order. Failure is rarely final: most submissions that stumble pass within the correction window once the feedback is read literally and each point is classified as either an estate problem (fix reality) or an answer problem (fix the words). The two auto-fail areas, MFA and patching, must genuinely be fixed in the estate, because from April 2026 no amount of wordsmithing passes an untrue answer.
The word “failed” covers four different situations, and your next move depends entirely on which one you are in. This triage table is the first thing to settle.
| What happened | What it means | Your next move |
|---|---|---|
| The assessor raised queries | Not a failure. Something was unclear, inconsistent or incomplete, and you have a window to clarify or correct | Answer factually within the window. Most submissions in this state pass |
| An area was marked non-compliant | A control fell short of the requirement as described. Fixable if the underlying issue can be resolved within the window | Classify it: estate problem or answer problem, then fix the right one |
| An auto-fail question failed | MFA missing from a cloud service that offers it, or high-risk updates slower than 14 days. The assessment fails regardless of other answers | Fix the estate itself. These cannot be worded away, and resubmission needs the truth to have changed |
| The Cyber Essentials Plus audit failed | The hands-on test found devices that did not match your declared answers | Remediate across the whole estate rather than just tested devices. The 2026 retest rules are covered below |
Here are the Cyber Essentials fail reasons as they occur in marking, ranked. The right-hand column is deliberately blunt, because every one of these is preventable in days.
| # | Failure | The tell | The fix |
|---|---|---|---|
| 1 | Out-of-support software | One old operating system, one legacy application, one server nobody dared touch | Upgrade, retire, or genuinely segregate it out of scope with the segregation described |
| 2 | Incomplete MFA | Enabled for most staff, skipped for directors, shared mailboxes or one forgotten service | Check enrolment per user per service. Auto-fail from April 2026 |
| 3 | Updates slower than 14 days | Updates waiting for users to click restart. Firmware never touched | Automatic updates on, monthly patch review, honest measurement. Auto-fail via A6.4 and A6.5 |
| 4 | Scope errors | Personal phones on work email declared out of scope. A cloud service nobody listed | Build complete device, cloud and access lists before answering anything |
| 5 | Admin rights everywhere | Daily work done from administrator accounts because it was easier once | Separate admin accounts, shrink the admin list, review it |
| 6 | Default and exposed boundaries | Router on factory credentials. Remote management reachable from the internet | Change the passwords, close remote admin, document every open service |
| 7 | Configuration drift | Devices set up well years ago, never audited since. No device locking on phones | Audit a sample, fix the fleet, write the setup checklist |
| 8 | Unverified malware protection | “It comes with Windows” answered without checking it is on, updating and scanning | Verify on real devices, phones included |
| 9 | Contradictory answers | Counts that disagree, BYOD denied in one answer and described in another | One author, one source of truth, one second reader |
| 10 | Submitting too early | Buying the assessment as a way of finding out what is broken | Fix first, then buy. The questionnaire is a mirror rather than a diagnostic service |
Out-of-support software fails more organisations than anything else, and it usually comes down to a single machine. The scheme’s logic is unforgiving because attackers’ logic is: software past its support date receives no security fixes, so every vulnerability found after that date stays open forever. One such device inside scope fails the control for the whole organisation. The honest options are upgrade, retire, or real segregation, and “we hardly use it” is not among them.
MFA gaps are now the most expensive kind of oversight. The pattern is nearly always the same: the rollout covered everyone except the people who found it annoying, and those people are directors, whose accounts attackers most want. Since a cloud service with available-but-unenabled MFA is an automatic failure, the fix is a per-user, per-service check rather than a policy statement. Why organisations fail Cyber Essentials on this point is rarely technology. It is deference.
Patching failures hide behind good intentions. Updates are “managed”, meaning a tool exists. Whether fixes land within 14 days of release, on applications and firmware as well as operating systems, is a number most organisations have never measured. Measure it before you answer, because the question is now auto-fail and the honest answer must be yes.
Scope errors are contradictions waiting to be found. Assessors cross-check: the remote working answers against the device list, the cloud answers against the MFA answers, the BYOD claim against how email reaches phones. A missed cloud service or an undeclared personal device does not just weaken one answer. It makes several answers disagree, and disagreement is what triggers scrutiny.
A meaningful share of Cyber Essentials mistakes are not in the estate at all. They are in the writing. Vague answers where a specific one was needed. “Mostly” and “where possible”, which an assessor must read as “not everywhere”. Descriptions of plans rather than the present. Counts that drift between questions. These matter because they are entirely avoidable and entirely fixable inside the correction window: unlike an estate problem, an answer problem needs only clearer, truer words. The discipline that prevents them is the same one that fixes them: answer from lists rather than memory, and let a second person read the whole submission before it goes. The full craft is in our guide on how to pass Cyber Essentials first time.
A Cyber Essentials failed assessment feels worse than it is. The scheme is built for recovery, and most organisations that fail pass shortly afterwards. The plan has three steps, and the first one is the one people skip.
Step one: read the feedback literally, then classify it. The assessor’s feedback names exactly what fell short. Take each point and label it either an estate problem, where reality has to change (software retired, MFA enabled, updates applied), or an answer problem, where the words have to change (clarification, a corrected count, a note explaining configuration). This classification is the whole game, because the two are fixed differently and the correction window is generous for one and tight for the other.
Step two: use the correction window like a professional. Answer problems: correct them factually, without argument or padding, and resubmit within the window. Small estate problems: fix them for real, then update the answers, because the answer must be true on the day you resubmit rather than eventually. The window rewards calm and punishes improvisation. Organisations that fire back defensive essays use up their window without changing anything the assessor can mark.
Step three: if the window is not enough, plan the resubmission. Larger estate problems, a migration off unsupported software, an MFA rollout across many services, may not fit any window. Then the sequence is: fix properly, verify on real devices, and submit fresh when the answers are true. Watch two clocks while you do it: any contract deadline that needed the certificate, and your renewal date if this was a renewal. Telling a waiting customer “we found issues and are fixing them properly, certification expected by X” lands far better than silence.
| When | What to do |
|---|---|
| Day 0 | Read the feedback twice. No replies yet, no blame meetings |
| Days 1 to 2 | Classify every point: estate or answer. Assign each an owner and a date. Decide: correction window or full resubmission |
| Days 3 to 10 | Fix estate problems for real. Draft corrected answers from evidence. Second reader reviews everything |
| Resubmission | Within the window if it all fits. Otherwise fresh submission once every answer is true. Brief the director on what changed before they sign again |
Cyber Essentials Plus failures now carry consequences worth planning around. The audit tests a random sample of devices against the answers you declared, and those answers are locked before testing begins, so the audit measures reality against your own words. If the sample fails, you remediate and retest, and under the 2026 rules the retest examines the original sample plus a fresh random sample, precisely to catch organisations that fixed only the machines the auditor saw. A second failure revokes the underlying certificate, which converts a bad audit into a public problem. The strategy this kills is patching the sample. The strategy it rewards is fixing the estate before the auditor arrives, which is cheaper anyway. Our approach is a readiness check before we audit, because under these rules a failed Plus audit is expensive for everyone involved, including us.
Step back from the list and one pattern remains: a failed assessment is a discovered truth. The unsupported server was unsupported before the assessor noticed. The MFA gap was open before anyone asked. The assessment did not create the problem, it billed for finding it, and that reframe is the most useful thing a leadership team can take from a failure. It also points at the only reliable strategy for how to avoid failing Cyber Essentials: make the estate true first, then certify it, in that order. The requirements guide lists every rule as an assessor marks it, the controls guide shows how to implement each control well, and a Cyber Essentials first time pass follows from those two plus honesty.
As the certification body, we sit on the marking side of every pattern in this article. Guided certification at £950 + VAT means our assessors prepare the submission with you, which is the practical insurance against everything above. Straight certification is the official fee of £320 to £600 + VAT, Cyber Essentials Plus is £1,150 + VAT fixed with a readiness check before the audit, and if you have just failed with another provider, the recovery plan above works regardless of who marked it.
Out-of-support software still in use, usually one forgotten machine or application. Incomplete MFA and updates slower than 14 days follow, and both of those are automatic failures from April 2026.
Yes. One device running out-of-support software inside scope fails the control for the whole organisation, which is why the asset list matters more than any other preparation step.
You receive feedback naming what fell short, and a window to correct and resubmit. Answer problems are fixed with clearer, truer words. Estate problems must be fixed in reality first, because the resubmitted answers have to be true.
There is a defined correction window after feedback, enough for answer corrections and small fixes. Larger remediation, like migrating off unsupported software, usually means a fresh submission once the work is done.
Corrections within the window are part of the assessment. A full resubmission after the window means paying the assessment fee again, which is why fixing before buying is the cheapest sequence.
Yes, through guidance and guided preparation: explaining what questions mean and preparing the submission with you. The answers must still truthfully describe your organisation, and a director signs for them.
The opposite: Plus adds a hands-on audit that can fail independently. Under the 2026 rules a failed sample leads to a wider retest, and a second failure revokes the certificate, so Plus raises the stakes on estate-wide readiness.
If a contract was waiting on the certificate, yes, briefly and with a date: found issues, fixing properly, certification expected by then. It reads as competence. Silence reads as the opposite, and certification dates are checkable.
Written by Emmanuel Olatunji, Chief Enterprise Architecture Partner at Intelance, an IASME licensed certification body for Cyber Essentials and Cyber Essentials Plus. Last reviewed 8 July 2026.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with a licensed assessor. You leave knowing which route applies to you, what it costs and what to do first.
Talk to a senior adviser
