Failed Cyber Essentials — What Now?

What a fail actually means

A Cyber Essentials fail isn't a black mark — it's a list of things to fix. The assessor tells you which answers didn't meet the standard, you remediate, and you resubmit. Depending on your certification body and where you are in the assessment window, you may be able to correct and resubmit quickly.

The common 2026 reasons for failing

Since April 2026 the marking is stricter, with genuine automatic fails. The usual culprits:

Missing MFA on a cloud service. Multi-factor authentication must be enabled wherever it's available, and it's mandatory on cloud services. A gap here is now an automatic fail.
Slow patching. Critical or high-risk security updates must be applied within 14 days — for operating systems, applications, and router/firewall firmware. Beyond that is an automatic fail.
Unsupported software. Anything past end-of-life and still in scope will fail you.
Scope and cloud gaps. Under the new rules all cloud services are in scope, and exclusions need clear justification. Vague scope trips people up.
Default credentials and weak configuration. Kit still on default passwords, or insecure defaults left in place.

How to pass next time

Prioritise the automatic fails first — MFA everywhere and patching within the window usually clear most of it. Then fix the smaller configuration and scope issues. The mistake to avoid is resubmitting the same setup hoping for a different marker; fix the root cause, then go back in.

How we help

Send us the feedback you were given. As your Certification Body we translate it into a clear fix list, help you close the gaps, and get you through the re-assessment — so the second attempt is a pass, not another fail.

Ready to buy?

Transparent, fixed pricing based on your organisation size. By default we give you access to the IASME portal to complete your Cyber Essentials assessment yourself, and once you submit it we aim to assess within one business day. You can preview the Cyber Essentials self-assessment questions to see where you stand first. There is no call or consultation as standard; we simply send you the questionnaire to complete. Your submission is reviewed by a qualified, certified assessor, never fed into AI. Need it faster? Add urgent turnaround below. Want us to review your setup against the controls before you apply? That is a gap analysis, quoted separately: ask for one using the contact button under the form.

An appointed IASME Certification Body: your certificate comes directly from us. Verify our credentials on the BlockMark registry, and find us listed on the IASME website.

Business name

Business size

Telephone

Optional add-on

Tick it if you need it.

Urgent turnaroundMoved to the front of the queue and assessed same day where your submission arrives before midday. +£100

Total: select your size + VAT

Want a gap analysis, a different way to pay, or a question answered first?

Gap analysis. We review your setup against the controls you will be assessed on before you apply and tell you exactly what needs fixing, so nothing is a surprise when you submit. It is quoted against your setup rather than sold as a fixed add-on, so ask us and we will price it.

Anything else. Paying by card here is the quickest route, not the only one. Tell us how you would rather pay and we will sort it. Same if you want a question answered before you buy, or a quote for on-site Cyber Essentials or IASME Cyber Assurance Level 1.

Common questions

Do I lose my fee if I fail?

Not the way people fear. You're told what to fix and you resubmit; depending on your certification body and timing, corrections can often be made within the assessment window. The goal is to get you certified, not to catch you out.

Why did we fail on MFA when we thought we had it?

The 2026 rules require MFA wherever it's available, and it's mandatory on cloud services — a single cloud app without it is now an automatic fail. It's the most common reason we see.

How long do we have to fix and resubmit?

It depends on your certification body and where you are in the assessment window. Send us the feedback and we'll tell you your realistic route and timeline.

Can you help us pass after a fail with someone else?

Yes. We take the feedback you were given, turn it into a concrete fix list, help you remediate, and support you through the re-assessment.