Retest

How does retest apply to Cyber Essentials?

In plain terms. Imagine a food inspector who finds one dirty fridge. On the return visit they check that fridge and open a few others at random, to see whether the kitchen fixed the habit or just the one fridge. The 2026 retest works the same way.

What the scheme says. The NCSC test specification says any single fail fails the whole assessment, unless the Delivery Partner accepts marginal deviation in less than 5% of tests with no sign of a wider process failure. Tests that cannot be finished on the day can be deferred, and the specification recommends no more than one month. IASME's April 2026 update adds a retest and revocation rule for update management: "During the retest, the Assessor will not only recheck the original sample, but will also test a new random sample of devices", and "a second failure will result in a revocation of the verified self-assessment certificate." IASME introduced it because some organisations had patched only the sampled devices. Other tests follow the specification's normal retest process. Self-assessment answers are also frozen: the same update says the verified self-assessment "must be completed, finalised, and remain unchanged prior to the commencement of CE+ testing".

What an assessor looks for. Evidence that the cause is fixed, not only the symptom. If Test 2 failed because a browser missed a critical update, expect the assessor to look for automatic updates or a patching process that covers every device, because the new random sample would find the same gap elsewhere.

Before you book the retest.

• Fix the cause across the whole scope, for example by turning on automatic updates for the browser that failed, then run your own report showing every device is current.
• Keep within the deferral limit. The specification recommends deferring tests for no more than one month.
• Check your provider's terms to see whether a retest visit is included in the price. For the self-assessment, the equivalent is a re-mark.

See the pass and fail rules, what happens if you fail and remediation.