Re-mark
A re-mark is a second marking of a failed Cyber Essentials self-assessment after the applicant has corrected the answers. IASME's terms give one free re-mark if you resubmit within 48 hours of the fail notice. A second fail means reapplying and paying again. The window fixes wording or settings, not hardware.
- Term
- Re-mark
- Also known as
- remark, resubmission
- Category
- Scheme and certification
- Requirement area
- Scheme vocabulary
- Questions
- None directly
- Reviewed against
- Requirements v3.3
What does the term re-mark mean in Cyber Essentials?
A re-mark is a second marking of a failed Cyber Essentials self-assessment after the applicant has corrected the answers.
How does re-mark apply to Cyber Essentials?
In plain terms
It is a resit with a short deadline. The assessor hands back your paper with the reasons it failed, and you get one quick chance to correct it before it counts as a fresh attempt.
What does IASME say about the re-mark window?
The window is 48 hours from the fail notice. Clause 2.6 of the IASME scheme terms and conditions gives one further assessment "free of any additional charge provided that Your resubmission is made within 48 hours of receipt of Our notice that Your first assessment attempt has failed. Any further assessment attempts will be charged as a new application."
Plan to resubmit inside those 48 hours, and ask your Certification Body in advance if a weekend or bank holiday falls inside the window.
How does a re-mark work?
The assessor marks every answer. Where an answer does not meet a requirement, or a notes field does not describe a compliant control, they can query it or fail the submission. IASME's FAQ says every applicant gets feedback: "a report including all the answers you gave and comments from the Assessor against any that were considered non-compliant." You correct the answers, or the settings behind them, and resubmit.
What can the window fix?
| Usually fixable in the window | Usually not fixable in the window |
|---|---|
| A vague notes answer, such as A5.1 or A7.1, rewritten to describe the real process | A laptop or phone on an operating system the vendor no longer supports (A6.1) |
| A setting switched on and evidenced, such as MFA on a cloud admin account (A7.16) | Replacing a firewall or router that no longer receives firmware updates |
| A missing device or cloud service added to the scope lists (A2.6 to A2.9) | Rebuilding the network to create a sub-set for legacy kit (A6.7) |
| Turning on automatic updates and confirming they installed (A6.4.1, A6.5.1) | Leavers' accounts across many systems that nobody has audited |
Common mistakes
Changing an answer from No to Yes without changing anything real. The answers must stay true, a board-level person has signed to say so, and a Cyber Essentials Plus audit would test them later. The other trap is failing on something the window cannot fix. Check the automatic-fail questions (A6.4, A6.5, A7.15, A7.16 and A7.17) and supported software before you submit, not after.
A re-mark applies to the self-assessment. The Cyber Essentials Plus equivalent is a retest.
See what happens if you fail, what Cyber Essentials costs and the self-assessment questionnaire.
Related terms
- RetestA retest is a repeat of failed Cyber Essentials Plus tests, carried out after the organisation has fixed the problems the assessor found.
- Self-assessment questionnaireThe self-assessment questionnaire is the set of written questions an organisation answers about its own IT to apply for Cyber Essentials.
- RecertificationRecertification is the yearly renewal of Cyber Essentials, done by completing a full new self-assessment before the current certificate expires.
- RemediationRemediation is the work of fixing security gaps, such as replacing unsupported software or turning on MFA, so a control meets the standard.
- Requirements for IT InfrastructureCyber Essentials: Requirements for IT Infrastructure is the NCSC document that sets out exactly what an organisation must do to meet Cyber Essentials.
- SamplingSampling is how a Cyber Essentials Plus assessor tests a representative selection of devices and accounts rather than every one in scope.
Frequently asked questions
A re-mark is a second marking of a failed Cyber Essentials self-assessment after the applicant has corrected the answers.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.