Beware the 100% pass rate with Cyber Essentials

Shopping for Cyber Essentials, you will see providers leading with a “100% pass rate” or a “guaranteed pass”. It sounds reassuring. It is worth thinking about what it actually means.

What a pass rate really tells you

There are only two ways to reach 100%. Either you do the hard work of getting every client’s controls genuinely in place before they submit, or you wave submissions through without properly checking them. A rate that high, used as a headline, is worth a second look, because the second route leaves you with a certificate and not much else.

The certificate is only as good as the assessment behind it

Cyber Essentials is a self-assessment that an assessor verifies. If the assessor does not actually scrutinise your answers, you can end up certified as secure when you are not. That gap matters on exactly the days you need the certificate to mean something: when a client audits you, when your insurer asks questions after a claim, or when you are actually attacked.

A good assessor will sometimes say “not yet”

The most valuable thing an assessor can do is tell you honestly when you are not ready, and help you get there. “You need multi-factor authentication everywhere and to remove that unsupported software first” is worth far more than a rubber stamp. It is the difference between a certificate that reflects reality and one that does not.

What to look for instead of a pass-rate boast

Look for an assessor who checks rather than assumes, who explains what each control means in plain English, who will push back when something is not right, who is a certified IASME assessor, and who cares whether you are genuinely secure rather than just certified. Speed is fine, and Cyber Essentials can be quick, but not at the cost of the assessment being real.

How we do it

As a certified IASME assessor, we get you to a genuine pass, often in days if your controls are close, and we will not sign off anything that is not actually in place. That is not slower, it is just honest, and it means your certificate holds up to scrutiny from the people who ask to see it.

Common questions