In the 2026 Danzell question set, four questions fail automatically on a No answer: A6.4, A6.5, A7.16 and A7.17. A7.15 fails automatically if a listed cloud service does offer MFA. All five sit in security update management and user access control. Unsupported software in scope (A6.3, A6.6) also stops certification, according to IASME.
Key takeaways
- In the IASME Danzell question set v16.3, a no to A6.4, A6.5, A7.16 or A7.17 fails the assessment, according to the guidance printed under each question.
- A7.15 fails if you list a cloud service as having no MFA option when the service does offer MFA.
- All five questions with fail wording sit in two sections, A6 security update management and A7 user access control, as the Danzell question set analysis shows.
- A6.3 and A6.6 carry no fail wording in the question set, but IASME's FAQ, answering whether there are automatic fail questions, says any company using unsupported software in scope will fail to achieve certification.
- Fail on a No
- A6.4, A6.5 (critical and high-risk updates within 14 days), A7.16, A7.17 (MFA for every cloud admin and user)
- Fail on a wrong list
- A7.15, if a service you list as having no MFA option does offer MFA
- Also fails
- A6.3 and A6.6 (unsupported software): no fail wording in the question set, but IASME's FAQ says unsupported software in scope fails certification
- Where the rule is written
- The guidance text under each question in the IASME Danzell question set v16.3
- If you fail
- Free resubmission if you resubmit within 48 hours of the fail notice (IASME terms, clause 2.6)
Most Cyber Essentials questions are marked in the round. A weak notes answer gets a query, you amend it, the assessment continues. A handful of questions do not work that way. Their guidance text in the IASME question set says the words "automatic fail" or "the assessment will fail", and a wrong answer fails the submission, leaving only the short re-mark window to correct it. Our analysis of the question set counts five such questions out of 106, all in sections A6 and A7.
Which questions carry an automatic fail?
| Question | What it asks | The failing answer |
|---|---|---|
| A6.4AUTO-FAIL | Critical and high-risk updates for operating systems and firewall or router firmware installed within 14 days of release | No |
| A6.5AUTO-FAIL | Critical and high-risk updates for applications, including extensions, installed within 14 days of release | No |
| A7.15AUTO-FAIL | List of cloud services with no MFA option | Listing a service that does offer MFA |
| A7.16AUTO-FAIL | MFA applied to every administrator of every cloud service | No |
| A7.17AUTO-FAIL | MFA applied to every user of every cloud service | No |
Do A6.3 and A6.6 fail the assessment too?
In effect, yes. A6.3 asks whether any in-scope software or cloud service is unlicensed or unsupported, and A6.6 asks whether unsupported software has been removed. Neither carries fail wording in the question set guidance. But IASME's FAQ, answering "Are there any automatic fail questions?", says: "Any company using unsupported software in the scope of the assessment will fail to achieve Cyber Essentials certification." The requirement behind both questions is that all software on in-scope devices is licensed and supported, and removed or moved to an internet-isolated sub-set when it is not. Treat a Yes to A6.3 or a No to A6.6 as a fail, so an in-scope Windows 10 laptop without Extended Security Updates still stops certification. The supported software guides show what counts as supported.
Why are these five the ones that fail outright?
They map to the two requirements the scheme treats as non-negotiable. The security update management control in the NCSC requirements v3.3 says software must "be updated, including vulnerability fixes, within 14 days of release" where the fix is critical or high risk, has a CVSS v3 base score of 7 or above, or has no severity given. The user access control section says MFA must be used on cloud services for every user and every administrator where the service offers it.
Both are checked again at Cyber Essentials Plus. Test case 2 fails any sampled device with a qualifying fix available for more than 14 days. Test case 4 has the assessor watch a user and an administrator log in to each cloud service from an incognito session and fail the test if no MFA prompt appears.
We do not read A6.4 in isolation. If A6.4.1 says auto-update is on, A2.5 lists a firewall, and A6.4.2 is blank, we ask how firewall firmware is updated. Router and firewall firmware is inside A6.4 by name.
What does a passing answer look like for each?
For A6.4AUTO-FAIL and A6.5AUTO-FAIL, the answer is yes, backed by A6.4.1 and A6.5.1 (auto-update on) or by A6.4.2 and A6.5.2 (the process where auto-update is off). Feature updates and optional updates are not required, only critical and high-risk security updates. Firmware counts as an operating system for A6.1 and A6.4.
For A7.16AUTO-FAIL and A7.17AUTO-FAIL, the guidance adds one detail that catches people: MFA "in conjunction with a password of at least 8 characters". A four-digit PIN plus an authenticator app does not meet the wording. Check the password minimum on every service, not just Microsoft 365.
For A7.15AUTO-FAIL, the safe answer is usually an empty list. Before you add anything, check the vendor's help pages. The guidance links to a list of cloud services and their MFA availability, and an assessor will look a service up.
"MFA is enforced for all staff via Conditional Access" while three break-glass admin accounts, a shared mailbox login and the accounts payable portal sit outside the policy. A7.16 says all administrators. A7.17 says all users. Excluded accounts are the reason for most MFA fails we see.
What do you check for each one, and what is the fix?
| Question | What to check before you answer | Evidence the assessor can ask about | Fix if it is red |
|---|---|---|---|
| A6.4AUTO-FAIL | Every operating system in A2.6 to A2.8 and every firewall or router in A2.5 is on the latest security update, with nothing critical or high-risk older than 14 days | Auto-update setting or MDM update policy; firmware version against the vendor's advisory | Install the update, then set auto-update or an update ring with a deferral well inside 14 days |
| A6.5AUTO-FAIL | Browsers, Office, PDF readers, extensions and every app in A6.2.x are current | Patch report from Intune, your RMM or the vendor console | Turn on auto-update, force a browser relaunch, remove apps nobody owns |
| A7.15AUTO-FAIL | Each service you list really has no MFA option, checked in the vendor's own documentation | The vendor page that says MFA is not offered | Take the service off the list and enable MFA |
| A7.16AUTO-FAIL | Every admin account on every A2.9 service, including break-glass and shared admin logins | MFA registration report filtered to admin roles | Enrol the accounts; protect emergency accounts with a hardware key |
| A7.17AUTO-FAIL | Every user account on every A2.9 service, including guests and service accounts a person signs in with | MFA registration report against your full user list | Enforce MFA for all users, not a pilot group; check passwords are at least 8 characters |
The 14-day rule in practice sets out the update settings vendor by vendor, and the passkeys post covers which sign-in methods count as MFA.
How do you check before you submit?
Run three reports. The Entra ID (or Google Workspace) MFA registration report against your full user list, including guests and service accounts that a person signs in with. The patch compliance report from Intune, your RMM or your MDM, filtered to updates older than 14 days. The operating system list from A2.6, A2.7 and A2.8, checked against vendor end-of-support dates with the is it supported tool.
The readiness checker covers the four no-answer fails (A6.4, A6.5, A7.16 and A7.17) along with A6.3 and A6.6, and puts any of them you fail at the top of your results. It does not ask about A7.15, so check that list against each vendor's documentation yourself. If any come back red, the security update management and user access control hubs explain the fix in full, and a gap analysis will find the accounts you have missed before an assessor does.
- IASMEIASME, Cyber Essentials Danzell Question Set 2026 (v16.3)Read on iasme.co.uk (opens in a new tab)
- NCSCNCSC, Cyber Essentials: Requirements for IT Infrastructure v3.3 · April 2026Read on ncsc.gov.uk (opens in a new tab)
- NCSCNCSC, Cyber Essentials Plus Test Specification v3.2Read on ncsc.gov.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials frequently asked questions (failed assessments)Read on iasme.co.uk (opens in a new tab)
- IASMEIASME, Important update: changes to Cyber Essentials for April 2026Read on iasme.co.uk (opens in a new tab)
- IASMEIASME, Cyber Essentials terms and conditions (certificate validity, free further assessment)Read on iasme.co.uk (opens in a new tab)
Frequently asked questions
The assessment is marked as failed and returned with the assessor's feedback. IASME's terms (clause 2.6) give one free further assessment if you resubmit within 48 hours of the fail notice, enough to fix simple issues and update your answers. If the gap cannot be closed in that time, you reapply and pay again.
No. The guidance says you must meet the 14-day requirement in all circumstances and that a 'no' is an automatic fail. There is no notes field on A6.4 for mitigation. Fix the patching gap, then answer yes.
List it in A7.15. The auto-fail on A7.15 only applies when a listed service does offer MFA. Check the vendor's documentation before listing it; most business SaaS now has MFA, and social media accounts count as cloud services under A2.9.
Not by that name in the question set. Scope questions can still block certification: a scope with no end user devices is not acceptable under A2.6 and A2.8, and cloud services cannot be excluded under A2.9. Those are marked as non-compliant rather than as an automatic fail.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.
- IASME Certification Body
- CREST accredited
- IASME fee included
- UK offices in Leeds, Newcastle, London and Edinburgh