Remediation
Remediation is the work of fixing security gaps, such as replacing unsupported software or turning on MFA, so a control meets the standard. In Cyber Essentials it happens before you submit, after a failed self-assessment, and before a Cyber Essentials Plus retest. Start with the automatic fails: 14-day updates at A6.4 and A6.5 and cloud MFA at A7.16 and A7.17.
- Term
- Remediation
- Also known as
- remediate, fixing gaps, remediation report
- Category
- Scheme and certification
- Requirement area
- 3. Security Update Management; 4. User Access Control
- Reviewed against
- Requirements v3.3
What does the term remediation mean in Cyber Essentials?
Remediation is the work of fixing security gaps, such as replacing unsupported software or turning on MFA, so a control meets the standard.
How does remediation apply to Cyber Essentials?
In plain terms. Remediation is the repair work after an inspection. A survey lists the damp patch and the loose roof tile. Remediation is getting them fixed and being able to show they were.
What Cyber Essentials asks. The scheme does not use one word for it, but the rules set the target. A6.6 and A6.7 expect unsupported software to be removed, or moved to a sub-set with no internet access. The A7.14 guidance says that where a cloud service supports multi-factor authentication "you must enable it for all users and administrators". For Cyber Essentials Plus, Test 2 fails if a critical or high-risk vulnerability has had a fix available for "more than 14 days", so remediation means installing fixes, not only noting them. The test specification also says virtual patching of legacy unsupported operating systems "will not be recognised as a mechanism for compliance".
Common mistakes. Fixing the symptom on one machine instead of the cause. If one laptop missed a browser update, the fix is automatic updates everywhere, because the next sample will find the same gap on another device. Another is remediating on paper: changing an answer without changing the setting behind it.
See gap analysis, retest and what happens if you fail.
Related terms
- Gap analysisA gap analysis is a review of your IT against the Cyber Essentials requirements before you apply, listing each gap and how to close it.
- RetestA retest is a repeat of failed Cyber Essentials Plus tests, carried out after the organisation has fixed the problems the assessor found.
- Requirements for IT InfrastructureCyber Essentials: Requirements for IT Infrastructure is the NCSC document that sets out exactly what an organisation must do to meet Cyber Essentials.
- SamplingSampling is how a Cyber Essentials Plus assessor tests a representative selection of devices and accounts rather than every one in scope.
- ScopeScope is the networks, hardware and software assets, and cloud services that are included in a Cyber Essentials assessment.
- Self-assessment questionnaireThe self-assessment questionnaire is the set of written questions an organisation answers about its own IT to apply for Cyber Essentials.
Frequently asked questions
Remediation is the work of fixing security gaps, such as replacing unsupported software or turning on MFA, so a control meets the standard.
In the 2026 Danzell question set, remediation comes up at A6.4, A6.5, A7.16, A7.17. Read those questions against the definition above so your answers use the term the way the assessor will.
Remediation relates to 3. Security Update Management; 4. User Access Control in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.