All services Every engagement has a fixed, published price. Book a strategy call
How to pass Cyber Essentials first time, from the people who mark the assessments: the ranked reasons submissions fail, how an assessor reads your answers, the pre-submission review, and a three week plan that passes without queries.
Guides on how to pass Cyber Essentials are usually written by people who have never marked a submission. This one is written by an IASME licensed certification body: our assessors mark these assessments, which means we see exactly where organisations fail, exactly which answers trigger queries, and exactly what separates a first-time pass from a month of corrections. This is that knowledge, organised into a method for anyone working out how to pass Cyber Essentials UK wide, whether alone or with help.
The short version. Passing Cyber Essentials first time is a sequencing problem. Scope accurately before anything else, fix the known killers before you buy the assessment (out-of-support software, incomplete MFA, slow patching, loose admin rights), answer the questionnaire with what is true today rather than what is planned, have a second person read the submission, and treat the correction window as a tool rather than a failure. Organisations that follow that order pass first time as a matter of routine. Organisations that start by buying the assessment and hoping usually meet us twice.
Before the method, the enemy. These are the failure causes as we see them in marking, in order, and every one is preventable before submission. This is also why the Cyber Essentials pass first time question is really a preparation question.
| # | Failure cause | Why it happens | How to prevent it |
|---|---|---|---|
| 1 | Out-of-support software still in use | One old machine, one legacy application, one server nobody dared touch | Inventory everything, check support status, retire or properly segregate before submitting |
| 2 | Incomplete MFA coverage | Enabled for most people, skipped for directors and service accounts. From April 2026 this fails the assessment outright | Check enrolment per user per cloud service rather than per policy document |
| 3 | Patching slower than 14 days | Updates rely on users clicking restart. Firmware forgotten entirely. Also an auto-fail from 2026 | Automatic updates on, a monthly patch review, and a true measurement before answering |
| 4 | Scope errors | Personal phones with work email, a cloud service someone signed up for, home workers assumed out of scope | Build the four lists in step one below, then reconcile answers against them |
| 5 | Admin rights everywhere | Rights granted in a busy week years ago and never reviewed | Separate admin accounts from daily accounts, and cut the admin list to people who administer |
| 6 | Contradictory answers | One answer says no personal devices, another describes staff webmail on phones. Assessors cross-check | One person owns the whole submission. A second person reads it before it goes |
Assessors read scope first, because everything else is marked against it. Build four lists before touching the questionnaire: every device that touches organisational data, including laptops, servers, phones and tablets, personal or not. Every cloud service the organisation uses, remembering that cloud can never be excluded. Everyone with access, and who holds admin rights. The fourth list is every internet boundary, including the home routers of home workers using them for business. Then apply the assessor’s test: do the lists agree with each other and with reality? The contradiction we see most is an organisation declaring no personal device use while half the staff read email on their own phones. Assessors notice, because the answers elsewhere give it away.
The cheapest time to fix a failure is before you have paid for the assessment. Work through these in order. The first two are the auto-fail killers.
| Fix | Typical effort | Who does it |
|---|---|---|
| Retire or segregate out-of-support software | Hours to weeks, depending on what the inventory found | IT provider or internal IT, with the business deciding replacements |
| Enable MFA on every cloud service, email first | Hours, plus a week of grumbling | Whoever administers each service. Directors enrol first rather than last |
| Turn on automatic updates everywhere | Hours | IT, including router and firewall firmware |
| Separate admin accounts from daily accounts | Half a day | IT, then a standing rule for new starters |
| Enforce device locking and remove ghost accounts | Hours | IT, guided by the access list from step one |
If this table looks like our five controls guide compressed, that is because passing first time and implementing the controls properly are the same activity wearing different names.
The questionnaire is where prepared organisations still stumble, so here is the craft of it, which doubles as a Cyber Essentials self assessment guide in miniature. Answer the question that was asked: the Danzell question set is precisely worded, and answers that respond to a different, easier question get queried. Answer what is true today: “we are rolling out MFA next month” is a fail today, and the right move is to finish the rollout first. Use the notes fields: a short factual note explaining how something is configured turns an ambiguous answer into a clear one and saves a query cycle. Stay consistent: your device counts, user counts and cloud lists appear in several places, and they must agree. And never over-claim, because from 2026 your answers are locked before any Cyber Essentials Plus testing, and the audit will test what you wrote rather than what you meant.
Knowing how marking works removes most of the fear. An assessor reads your scope, then works through the controls, cross-checking as they go: device counts against malware answers, cloud lists against MFA answers, the no-BYOD claim against the remote working description. Clear, specific, consistent answers pass quickly. Vague answers, contradictions, or the fatal phrases “mostly”, “we plan to” and “where possible” trigger queries. A query is not a failure: you get a window to clarify or correct, and organisations that respond calmly with facts usually pass within it. What the window cannot fix is an auto-fail answer that is true: if MFA genuinely is not enabled, or patching genuinely exceeds 14 days, the assessment fails regardless of everything else, which is why step two comes before payment. And remember who signs: the director’s declaration now covers keeping the controls in place all year, so the person signing should have read what they are signing.
This pre-submission Cyber Essentials checklist takes ten minutes and prevents most of the query cycles we see. Read each one against your actual answers rather than your intentions.
1. Is every cloud service the business uses listed, including the ones individual teams signed up for?
2. Is the MFA answer true for every user on every service, including directors and shared mailboxes?
3. Is the 14 day update answer true, measured from release, firmware included?
4. Is anything out of support still in scope? If it must exist, is the segregation described?
5. Do the personal device answers agree with how staff read email?
6. Are admin accounts genuinely separate from daily accounts, and is the admin list short?
7. Do device and user counts match everywhere they appear?
8. Have the notes fields been used to explain anything unusual, factually and briefly?
9. Has someone other than the author read the whole submission?
10. Has the director read the declaration they are about to sign, knowing it covers the whole year?
For an organisation of ordinary complexity, this Cyber Essentials step by step sequence passes first time without heroics. Tidy small businesses can compress it into a week, and our Cyber Essentials SME guide shows that faster version day by day.
| Week | Focus | Done means |
|---|---|---|
| Week 1: see and fix | Build the four scope lists. Retire unsupported software. Switch on MFA everywhere and auto-updates | The auto-fail risks are gone and the lists describe reality |
| Week 2: verify and answer | Separate admin accounts. Verify malware protection and device locking on a sample of devices. Draft every questionnaire answer against the lists | A complete draft submission with notes fields used and nothing answered from memory |
| Week 3: review and submit | Run the pre-submission review. Second reader. Director briefing. Submit | Certificate, typically without a single query |
The Plus audit adds hands-on verification, and the 2026 rules changed the tactics. Book the audit together with the basic assessment so both land inside the required window. Fix estate-wide rather than sample-wide: if the auditor’s random sample finds unpatched devices, the retest now examines a fresh random sample too, and a second failure revokes the certificate, so patching only the machines you think will be tested is a strategy with a countdown attached. Do not touch the self-assessment after submission, because it is locked before Plus testing begins and the audit tests what you declared. And run your own check first: patch status and malware protection verified on a handful of randomly chosen devices tells you what the auditor will find, a week early and for free. Full detail on the audit itself is on our Cyber Essentials Plus page.
No drama is required. A query or a failed area comes with a window to correct and resubmit, and most organisations that miss first time pass on the correction. Use the feedback literally: it names what fell short. Fix that, confirm nothing else drifted while you fixed it, and resubmit inside the window rather than paying again. If the failure was structural, a genuinely messy estate rather than a wrong answer, that is the moment guided help earns its money, because a second cold failure costs more than the guidance would have.
We are the certification body, so the help is direct. Guided certification at £950 + VAT means our assessors run this entire method with you: scope, fixes, every answer prepared against the Danzell question set, and the submission reviewed before it goes, which is why guided submissions pass first time as a matter of course. Straight certification is the official fee of £320 to £600 + VAT, and Cyber Essentials Plus is £1,150 + VAT fixed, with a readiness check before we audit because a failed audit under the 2026 rules is expensive for everyone. The requirements themselves, rule by rule as an assessor marks them, are in our Cyber Essentials requirements guide.
Not for organisations that prepare in the right order: scope accurately, fix out-of-support software, enable MFA everywhere, patch within 14 days, then answer with what is true. It is hard for organisations that buy the assessment first and discover their estate during the questionnaire.
Out-of-support software still in use, followed closely by incomplete MFA coverage and patching slower than 14 days. The last two are automatic failures from April 2026, which is why they must be fixed before submission rather than promised for later.
A tidy small business: about a week. An ordinary organisation following the three-week plan: three weeks. Estates with legacy systems or loose access need remediation time on top, which is why the fixing comes before the buying.
Guidance yes, answers no. Assessors can explain what a question means and what evidence satisfies it, and a guided service can prepare the submission with you, but the answers must describe your organisation truthfully and a director signs for them.
You receive the reasons and a window to correct and resubmit, and most near-misses pass on correction. True auto-fail conditions, missing MFA or slow patching, must be fixed in the estate first, because the answers have to be true.
No. Basic certification stands alone. Plus is a separate hands-on audit of the same controls, needed when a contract names it or when you want independently verified assurance.
Current state only. The assessment certifies what is true at submission, and from 2026 the signed declaration commits you to keeping it true all year. Finish the rollout, then answer.
Build the scope lists before opening the questionnaire, fix the auto-fail risks before paying, use the notes fields to explain anything unusual, keep counts consistent across answers, and have a second person read the whole submission before the director signs.
Written by Emmanuel Olatunji, Chief Enterprise Architecture Partner at Intelance, an IASME licensed certification body for Cyber Essentials and Cyber Essentials Plus. Last reviewed 8 July 2026.
Emmanuel Olatunji
Chief Enterprise Architecture Partner
Emmanuel founded Intelance in 2017 and has led architecture, AI governance, cyber and deal engagements across the UK, Europe, the Middle East and Africa. Every Intelance engagement runs under his direction, and every guide he publishes comes from that work.
See his record on LinkedIn About IntelanceThirty minutes with a licensed assessor. You leave knowing which route applies to you, what it costs and what to do first.
Talk to a senior adviser
