In short: Organisations fail Cyber Essentials because of unsupported software, missing MFA on a cloud service, critical updates not installed within 14 days, default router passwords, exposed admin interfaces, everyday use of admin accounts or scope mistakes. Under Danzell the first three are automatic fails. After a fail you get two working days to amend.
The three automatic fails
Under the Danzell question set, used for every assessment account created from 27 April 2026, three issues fail the whole assessment regardless of how good the rest of your answers are.
1. Unsupported software in scope. Any operating system, application or firmware that no longer receives security updates from its vendor fails. The usual culprits are Windows 10 devices not enrolled in Extended Security Updates, old server operating systems, phones too old for current updates, and applications such as legacy accounting or design software. The fix is to upgrade, replace or remove it, or to isolate it in a sub-set with no internet traffic.
2. No MFA on a cloud service where it is available. IASME announced in November 2025 that this would become an automatic fail, and it applies whether MFA is free, included in your plan or a paid add-on. People forget smaller SaaS tools, shared admin logins and break-glass accounts. See Cyber Essentials MFA requirements.
3. Critical or high-risk updates not installed within 14 days. Questions A6.4 (operating systems and router or firewall firmware) and A6.5 (applications) are now automatic fails. A fix counts if the vendor rates it critical or high, it scores 7 or more on CVSS v3, or the vendor gives no rating. Third-party applications and network firmware are where most organisations slip. See security update management.
Configuration and account failures
These are not automatic fails, but they regularly lead an assessor to mark an answer as non-compliant.
| Problem | Why it fails | How to fix it |
|---|---|---|
| Default router or firewall password | Firewalls control requires default admin passwords to be changed | Set a strong, unique password, or disable remote admin |
| Admin interface exposed to the internet | Only allowed with a documented need and MFA, or an IP allow list plus managed passwords | Turn off internet-facing admin, or add MFA and document the need |
| Undocumented inbound rules | Every inbound rule needs an approved, recorded business reason | Review port forwards, remove old ones, record the rest |
| Everyday work on admin accounts | Admin accounts must be separate and used only for admin tasks | Give admins a standard account for email and browsing |
| Shared logins | Each user needs unique credentials | Create individual accounts; use delegated access for shared mailboxes |
| Leavers still active | Accounts must be removed when no longer needed | Tie account removal to your leaver process |
| Weak device locking | Unlock-only PINs need at least 6 characters, plus throttling or lockout | Enforce lock settings through device management |
| No malware protection on some devices | Every in-scope device needs at least one active mechanism | Check servers, Macs and virtual machines as well as Windows laptops |
The firewalls, user access control and malware protection pages explain each requirement.
Scope mistakes
- Excluding a cloud service. Under Requirements v3.3 cloud services cannot be excluded from scope, so Microsoft 365, Google Workspace and every other service you use must be covered (cloud services).
- No end-user devices. A scope made up only of servers or a single network segment is not acceptable.
- Forgetting personal devices. Staff phones and laptops that reach work email or files are in scope; devices used only for calls, texts or an authenticator app are not (BYOD and home working).
- Home workers without a firewall. Home routers you did not supply are out of scope, so the device's own software firewall must be on.
- A sub-set that is not really separate. A sub-set needs segregation by a firewall or VLAN, and you must justify what is excluded (scope).
- Missing legal entities. Danzell requires every in-scope legal entity to be listed with its name, address and company number.
- Overlooking MSP and contractor accounts. Accounts your organisation owns are in scope even if a third party uses them.
Answers that do not give enough detail
Assessors can only mark what you write. Answers often fail because they are too vague ("we use antivirus"), describe plans rather than reality ("we will enable MFA next month"), or contradict another answer. Write in the present tense, name the product or setting that meets the requirement, and explain any exception.
Remember that the director's declaration under Danzell covers staying compliant throughout the certification period, so an answer that is only true on the day is a risk. Our guide to the Cyber Essentials question set explains how to answer well.
Where Cyber Essentials Plus goes wrong
At the Plus level, the assessor tests a sample of your real devices and accounts, so gaps that a self-assessment might miss are found. Common causes of a failed test are:
- one sampled laptop with a critical update outstanding for more than 14 days
- a cloud admin account that signs in without an MFA challenge
- an email or browser test file that the user can open, or a test executable that runs without a prompt asking the user to confirm
- a standard user who can run an admin process without being asked for separate admin credentials
- changing the self-assessment after Plus testing has started, which Danzell does not allow
Under Danzell, if a patching sample fails, the retest covers the original sample plus a new random sample, and a second failure revokes your self-assessment certificate too. See Cyber Essentials Plus requirements for the five test cases.
What happens after a fail
- Feedback. The assessor tells you which answers did not meet the requirements.
- Two working days to amend. IASME allows you to correct and resubmit within two working days at no extra cost.
- Reapply if you need longer. If the fix takes more time, such as replacing devices, you start a new assessment and pay again.
- Fix the cause, not the wording. Changing an answer without changing the system is risky, because the declaration says your answers are true.
The cheapest way to avoid all of this is to find the gaps first. Our Cyber Essentials gap analysis does exactly that, and the free Cyber Essentials checklist is a good DIY start. Contact us if you have failed and want help.
How Forever Systems helps you get certified
Most organisations fail Cyber Essentials for the same handful of reasons: unsupported operating systems left in scope, missing multi-factor authentication on cloud services, default passwords on routers and firewalls, and security updates that sit for longer than the 14 days the scheme allows. We find those gaps before an assessor does, then help you fix them.
- Readiness review and gap analysis of your devices, cloud services, firewalls and user accounts against the current question set
- Remediation: patching, configuration hardening, MFA roll-out, firewall changes and device management with tools such as Microsoft Intune
- Support through assessment with an IASME-licensed certification body, for both Cyber Essentials and Cyber Essentials Plus
- Supply chain and sector requirements: help when a customer, a public-sector contract or a framework asks for certification as a condition of working with them
- Staying compliant all year, so renewal is a formality rather than a scramble
Forever Systems Ltd is an IT and cyber security provider. We prepare you for certification and work alongside a licensed certification body, which carries out the assessment and issues the certificate.
Want to know how close you are to passing Cyber Essentials?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the most common reason for failing Cyber Essentials?
Neither the NCSC nor IASME publishes a ranking of failure reasons, so treat any league table with caution. The issues to check first are the Danzell automatic fails: unsupported software, missing MFA on a cloud service, and critical or high-risk updates left for more than 14 days. After those, look at default router passwords, exposed admin interfaces, everyday use of admin accounts and scope mistakes.
What happens if you fail Cyber Essentials?
The assessor explains which answers fell short. You have two working days to amend and resubmit free of charge. If you need longer, for example to replace devices, you reapply and pay the fee again.
Can you fail Cyber Essentials for not having MFA?
Yes. Under the Danzell question set, a cloud service without MFA where MFA is available, whether free, included or paid, is an automatic fail of the whole assessment.
Does one old computer fail Cyber Essentials?
If it is in scope and runs an unsupported operating system, yes, because unsupported software is an automatic fail. Upgrade or replace it, or remove it from scope by isolating it in a sub-set with no internet traffic.
Can I change my answers after starting Cyber Essentials Plus?
No. Under Danzell the verified self-assessment must be final and unchanged before Plus testing starts, so fix any problems before you submit it.