Cyber Essentials Plus pass and fail rules

What are the success criteria?

The specification requires the assessor to record a pass or fail for every test case and every sub-test, and it defines how those results roll up.

• One internet-facing service that fails the Test 1 flow diagram, for example a login page with a vulnerability scored 7.0 or more, fails the assessment.
• One sampled laptop with a 20-day-old critical update in Test 2 fails the assessment.
• One cloud service without MFA for one administrator in Test 4 fails the assessment.
• The assessor still completes every test so you receive a full appraisal, and may add advisory notes to any result.

What is the marginal deviation exception?

The marginal deviation exception lets the Delivery Partner, at its discretion, allow a pass when only marginal deviation is found in less than 5% of performed tests and there is no evidence of a wider failure of security processes.

When the assessor concludes, a fail that results from a small number of minor issues can be referred to the Delivery Partner, who may still allow a pass. The NCSC sets two conditions for that discretion.

• Marginal means a small departure from the standard. In our reading that is a single low-impact difference, not a missing critical update, but the judgement belongs to the Delivery Partner.
• Less than 5% of performed tests: the specification does not define how performed tests are counted, so the Delivery Partner decides how the threshold applies to your sample.
• No wider failure: three devices with the same missing patch is a process failure, and the exception is not intended for it.

Can tests be deferred?

Yes, for technical reasons, with the Delivery Partner's agreement. If a test cannot be completed on the appointed day, for example because a sampled server is unreachable or a user is absent, the assessor may defer it and complete it later. The NCSC's note to the Delivery Partner recommends that deferrals do not exceed one month.

Deferral is for completing a test that could not be run. It is not a remediation window for a test that ran and failed. For non-compliance found during the audit, IASME's guide to the two levels says the applicant has 30 days to remediate but will not be able to pass until it is remediated. For update management the 2026 retest rule below applies as well.

What is the 2026 retest rule?

For assessment accounts created after 26 April 2026, a Cyber Essentials Plus sample that fails on update management must be remediated and retested. The retest covers the original sample plus a new random sample, and a second failure revokes the verified self-assessment certificate.

IASME introduced the rule under the heading 'Verification of update management compliance' in its April 2026 scheme update. The reason it gives is that some organisations applied updates only to the devices sampled for the audit rather than across the whole scope. The revised process closes that gap: the applicant remediates, then the assessor rechecks the original sample and tests a new random sample from the wider environment. If the retest also fails, the verified self-assessment certificate is revoked and the organisation starts again with a new self-assessment.

The rule is written for update management, which is what Test 2 (the authenticated patch scan) verifies. Failures on the other test cases are still remediated and retested, but IASME's update does not attach the new random sample or the revocation to them. Ask your Certification Body how it handles retests for those.

Two other consequences follow. Fixing only the devices that failed is not enough, because the new random sample will find the same missing update elsewhere if the cause is systemic. And the same update says the verified self-assessment must be completed, finalised and unchanged before Plus testing starts: you cannot amend the answers to match what the audit found.

This rule comes from IASME's April 2026 update, not from the NCSC test specification v3.2. Re-verify the current wording with your Certification Body before relying on it.

What happens after a pass or a fail?

After a pass, the assessor compiles the report in the Delivery Partner's template and the Certification Body issues the Cyber Essentials Plus certificate. IASME issues certificates valid for 12 months from the date of issue, and renewal means a fresh self-assessment followed by a new Plus audit inside the three-month window.

After a fail, you receive the full report with every finding and any advisory notes. IASME's guidance gives 30 days to remediate non-compliance found during the audit. With Precursor, targeted re-testing after remediation is at no additional cost. Test 2 and Test 4 are common causes of a fail, and both are often fixed within days once the cause is identified.

How do assessors check this?