Why firms fail Cyber Essentials

Last reviewed 2 November 2026 against the Cyber Essentials requirements v3.3 (Danzell question set).

1. The three 2026 automatic failures

Since 27 April 2026 (IASME Danzell), assessors have zero discretion on three checks — get any one of them wrong and the assessment fails outright:

1. Missing MFA on any cloud service where it is available: Even if Microsoft 365 has MFA on for everyone, leaving MFA off on Xero, Sage, HubSpot, Dropbox or your payroll portal (including when MFA is a paid add-on) is an automatic fail.
2. Critical OS or router/firewall firmware updates taking longer than 14 days: Any unpatched high-risk, critical (CVSS v3 7.0+) or unrated security update on Windows, macOS, iOS, Android or your boundary router fails the assessment.
3. Critical application or browser extension updates taking longer than 14 days: Leaving Chrome, Edge, Adobe Reader, Zoom, 7-Zip or browser extensions unpatched beyond 14 days also triggers an automatic fail.

2. Seven other common reasons we see

• The wrong scope statement: Leaving out end-user laptops, omitting a cloud service, or forgetting to list every legal entity by name, address and company number.
• Unsupported software still installed: A Windows 10 PC with no paid Extended Security Updates (ESU), a copy of Office 2016, 2019 or 2021 left on a laptop, or an end-of-life office router.
• Everyday work done in administrator accounts: Staff running as local Administrators on their laptops, or a director using their daily Outlook email login as a Microsoft 365 Global Administrator.
• Personal phones (BYOD) ignored: Staff reading work email on personal iPhones or Androids that have no 6-digit PIN or no longer receive security updates.
• Default passwords or exposed router admin pages: Leaving factory passwords on routers/printers or leaving WAN remote management open to the internet.
• Macs with no anti-malware or firewall: Assuming macOS needs no software firewall turned on and no managed anti-malware for Cyber Essentials Plus.
• Optimistic “Yes” answers backed by policy rather than reality: Answering what your written policy says rather than what is actually configured on your devices.

3. What happens if you fail an assessment?

• Basic Cyber Essentials: When the assessor marks your submission as non-compliant, you are typically given 2 working days (48 hours) to remediate the issues found and resubmit once free of charge. If the fix requires replacing hardware or migrating software that takes longer than 2 working days, the application fails and you must pay a new assessment fee when ready.
• Cyber Essentials Plus (Danzell 2026 rule): If your initial device sample fails the patching audit, the retest covers both the original sample and a new random sample of devices. If you fail that retest, your Basic Cyber Essentials certificate is revoked as well, and you cannot alter your self-assessment answers once Plus testing has started.

4. What we check first — and why none of our prepared clients has ever failed

At AlphaSec and Alphabyte IT, we never open the questionnaire first. We treat Cyber Essentials as an engineering tidy-up: we audit the Microsoft 365 tenant, export the Intune and Defender software inventories, list every cloud app, fix the red items, and only then fill in the form.

5. Pre-submission checklist: tick every box before you submit

• Every legal entity in scope is listed with its company number and registered address.
• Every cloud service used with work email is listed, and MFA is enabled for 100% of users on all of them.
• Global Administrators use separate, mailbox-free admin-* accounts, and staff laptops run as standard users.
• Every Windows, Mac, iOS and Android device in scope (including BYOD phones with work email) runs a supported OS.
• All critical/high-risk OS, router firmware and application updates install within 14 days, and old Office 2016, 2019 or 2021 copies are uninstalled.
• Office router default password is changed, WAN admin is closed, and laptop software firewalls are switched on.
• Anti-malware and malicious-website blocking (SmartScreen / Defender) are active and updating on every computer.