What happens if you fail Cyber Essentials?

What happens if the self-assessment fails?

If a Cyber Essentials self-assessment fails, IASME's terms give one further assessment at no extra charge if you resubmit within 48 hours of the fail notice. If it still fails, you reapply and pay the scheme fee again.

The assessor marks every answer. Where an answer does not meet the requirement, or the notes field does not describe a compliant control, the assessor can raise a query or mark the submission as failed. A failed self-assessment is returned with the assessor's feedback on the non-compliant answers, and you have 48 hours from the fail notice to resubmit for a free re-mark. That is enough time to correct a wording problem or confirm a setting, but not to replace an operating system. If it still fails, a new application is needed and the scheme fee is paid again.

Nothing is published. Certificates appear on the IASME register; failed submissions do not.

Which answers cause an automatic fail?

Four Danzell questions fail automatically on a No answer: A6.4, A6.5, A7.16 and A7.17. A7.15 fails automatically if a cloud service listed there as having no MFA option does offer MFA. They cover the 14-day update rule and MFA on cloud services.

A6.4AUTO-FAIL and A6.5AUTO-FAIL cover critical and high-risk updates for operating systems and applications installed within 14 days of release. A7.16AUTO-FAIL and A7.17AUTO-FAIL cover MFA for administrators and users of cloud services, and A7.15AUTO-FAIL covers the list of services that offer no MFA option. A6.3 and A6.6 (unsupported software) carry no fail wording, but a non-compliant answer means the requirement that all in-scope software is licensed and supported is not met, and the application will not pass until it is fixed.

The other questions can still fail the assessment when the notes describe a control that does not meet the requirement, for example a firewall admin interface open to the internet without MFA at A4.11, or shared logins at A7.2.Those are marked fails rather than automatic ones, which means the assessor has discretion to query first.

What happens if Cyber Essentials Plus fails?

If any Cyber Essentials Plus test fails, the whole assessment fails and no certificate is awarded, unless the Delivery Partner applies the under-5% marginal deviation exception.

The test specification is explicit: if any sub-test results in a fail, the parent test case and the overall assessment are marked fail. Any single fail means a fail for the assessment as a whole unless a special exception is stated. The assessor still completes every test so you receive a full report.

The one exception sits with the Delivery Partner. Where only marginal deviation from the standard is found in fewer than 5% of the performed tests, and the evidence does not indicate a wider failure of the organisation's security processes, the Applicant may still pass at the Delivery Partner's discretion. A missing patch on one device out of forty might qualify; a cloud service with no MFA will not.

If a test cannot be concluded on the day because of technical difficulties, the assessor may defer it with the Delivery Partner's agreement. The specification recommends that deferrals do not exceed one month.

What is the 2026 retest rule?

Under IASME's April 2026 update, a Cyber Essentials Plus sample that fails on update management is retested together with a new random sample, and a second failure revokes the verified self-assessment certificate.

IASME published the rule under "Verification of update management compliance", because some organisations had updated only the devices sampled for the audit. It applies to assessment accounts created after 26 April 2026. The organisation remediates the findings, then the assessor rechecks the original sample and tests a new random sample from the wider environment. If the retest also fails, the verified self-assessment certificate is revoked, and the organisation must complete the self-assessment again before another Plus attempt. The same update says self-assessment answers must be finalised before Plus testing starts and cannot be adjusted afterwards.

The rule is written for update management, which Test 2 (the authenticated patch scan) verifies. Fails on the other test cases are still remediated and retested, but IASME's update does not attach the new random sample or the revocation to them. See Test 2: the authenticated patch scan for what the scan checks.

What should you do after a fail?

After a failed self-assessment or Plus test, fix the control behind the finding across the whole scope, record the evidence, and only then resubmit or book the retest. The order below works for both levels.

1. Read the reasons. The Certification Body returns the question numbers or test cases that failed. Map each one to the requirement it tests, for example the Danzell question pages for a self-assessment fail.
2. Decide whether it is wording or a real gap. A vague notes field can be rewritten inside the re-mark window. A missing update, an unsupported operating system or a cloud service without MFA cannot be fixed by rewording.
3. Fix the cause, not the instance. Push the update to every device, enforce MFA by policy for every account, or remove local administrator rights by policy. Use the supported-software checker for end-of-life dates.
4. Keep evidence. Export the update compliance report, the MFA registration report and the administrator group membership with a date on each. Assessors may ask how you know the fix covers the whole scope.
5. Resubmit or book the retest. Inside the 48-hour free re-mark window for a self-assessment; inside the three-month window for a Plus retest.