Automatic fail questions

Some answers in the Danzell question set are automatic fails. IASME has confirmed that a cloud service with MFA available but not switched on is an automatic fail, covering questions A7.14 to A7.17. The questions on installing critical and high-risk updates within 14 days (A6.4 for operating systems and firmware, A6.5 for applications) are also automatic fails under Danzell. Beyond these, remember that any answer showing you do not meet a requirement fails the assessment anyway.

What "automatic fail" means

Every requirement in Cyber Essentials must be met. If your answers show a requirement is not in place, the assessor cannot pass the assessment, whichever question it sits under. An automatic fail goes one step further: the assessor has no room to treat the answer as a minor point or a matter for clarification. A non-compliant answer on one of these questions fails the submission.

So the useful question is not "which questions can I get wrong?" The answer is none. It is "which gaps are the scheme now marking most strictly?"

Cloud MFA (A7.14 to A7.17)

Requirements v3.3 says authentication to cloud services must always use multi-factor authentication. Under Danzell, IASME's position is that if a cloud service offers MFA in any form and it is not enabled, the assessment fails. That includes MFA that is:

• built in but switched off
• free, bundled with another product, or available only on a paid tier
• available through another service, such as single sign-on with an identity provider that enforces MFA

It applies to user accounts and admin accounts. Passkeys and FIDO2 security keys count as MFA. Trusted IP addresses or location-based access rules on their own do not.

If a cloud service genuinely does not offer MFA at all, list it in your answer to A7.15. The assessor checks those claims, so make sure they are accurate.

See MFA for cloud services.

Critical and high updates within 14 days (A6.4 and A6.5)

All in-scope software must have updates installed within 14 days of release where the update:

• fixes vulnerabilities the vendor describes as critical or high risk
• fixes vulnerabilities with a CVSS v3 base score of 7 or more
• comes with no information from the vendor about severity

A bundled update that includes any critical or high fix counts. A6.4 covers operating systems and firewall or router firmware. A6.5 covers applications, including browsers and extensions.

For Apple devices, treat every Apple security release as high or critical. Once a newer macOS, iOS, iPadOS or Safari version is released, a device still on the older one fails 14 days after that release date.

See The 14-day update rule.

Other answers that will fail

This article does not publish a longer list, because any non-compliant answer on a requirement fails. Examples of requirements that are just as firm include using only licensed and vendor-supported software, having a correctly configured firewall protecting every device, and having malware protection active on every in-scope device. See Common reasons for failing.

If you fail

An automatic fail does not end the assessment. With Apexward Group through CyberEssentials.AI, you can close the gap, update your answers and resubmit, provided you complete within the six months your assessment is open. Certifying directly with IASME, you have 2 working days to resubmit. Turning on MFA can be quick; replacing unsupported devices usually is not, so leave yourself time. Do not change an answer unless the change is true. If another Certification Body marks your assessment, check how it handles resubmission.

What to do before you submit

1. List every cloud service your organisation uses, including ones staff signed up to with a work email.
2. Check MFA is enforced for every user and admin account on each one.
3. Record any service that offers no MFA, with the evidence you checked.
4. Check update history on every device and application against the 14-day rule.
5. Check browsers, extensions and firmware, which are easy to miss.

To check these areas before you submit, use the readiness checker.