Common reasons for failing Cyber Essentials

The gaps that fail a Cyber Essentials submission are usually simple ones you can find in advance. The most serious are a cloud service with MFA available but not switched on, critical or high-risk updates left for more than 14 days, and software that is no longer supported by its vendor. Close behind are scope problems, such as leaving out home workers, personal devices or cloud services, and answers too vague for the assessor to mark. This list is drawn from the scheme rules; your Certification Body marks the real submission.

1. MFA not enabled on a cloud service

Requirements v3.3 says authentication to cloud services must always use MFA. Under Danzell, a service that offers MFA but does not have it on is an automatic fail (A7.14 to A7.17). It is easy to miss on:

• smaller services staff signed up to themselves with a work email
• admin accounts, including emergency (break-glass) admin accounts
• accounts excluded from a conditional access policy
• services that offer MFA only on a paid tier

See MFA for cloud services.

2. Updates not installed within 14 days

Critical and high-risk updates must be installed within 14 days of release (A6.4 and A6.5 are automatic fails under Danzell). Typical misses are browsers and extensions, PDF readers, firmware on routers and firewalls, and devices that sit switched off for weeks. For Apple devices, a device still on the previous macOS, iOS or iPadOS version fails 14 days after the newer version is released. See The 14-day update rule.

3. Unsupported software in scope

All in-scope software must be licensed and vendor-supported. Common examples of unsupported software still in use:

• Windows 10 without Extended Security Updates, now that support ended on 14 October 2025
• older macOS versions, older phones and tablets no longer receiving updates
• old versions of Office, Java, or server operating systems past end of support
• routers and firewalls whose firmware is no longer maintained

Unsupported software must be removed, or isolated in a sub-set with no internet traffic in either direction. See Supported software rule and Options for unsupported software.

4. Scope that leaves things out

Assessors check that the scope is complete and believable. Problems include:

• personal phones or laptops that reach work email or files left out. See Personal devices.
• home workers left out, or no software firewall on their devices. See Home and remote workers.
• cloud services left out, which is never allowed
• a sub-set with no end-user devices, or excluded parts not named

5. Admin rights used for everyday work

Admin accounts must be separate and used only for admin tasks, not email or web browsing. Answers saying staff are local administrators on their own laptops, or that one shared admin login is used by several people, will fail. See User access control.

6. Default passwords and remote admin on firewalls

Every firewall and router must have its default admin password changed to a strong, unique one, or remote admin switched off. The admin interface must not be reachable from the internet unless there is a documented need and it is protected by MFA or an IP allow list. See Firewalls.

7. Password rules that do not match an accepted option

Where passwords are used without MFA, you need brute-force protection and one of the accepted quality options: MFA, a minimum of 12 characters, or a minimum of 8 characters with a deny list of common passwords. Enforcing expiry or complexity rules is not one of them. See Passwords and passkeys.

8. Malware protection missing on some devices

Every in-scope device needs active malware protection: anti-malware software kept up to date, or application allow listing. Servers, Macs and Linux machines are where gaps tend to appear. Apexward requires anti-malware on Linux, and ClamAV with on-demand scanning meets that requirement. See Malware protection.

9. Vague or inconsistent answers

"Yes", "all of them" or "IT handles it" gives the assessor nothing to mark. Answers that contradict each other, such as listing a device in one section and an unsupported version of it in another, will be queried. Name products, versions and settings. See How to answer the questions.

10. Missing the resubmission window

If the assessor asks a question or fails an answer, you respond and resubmit. Certifying directly with IASME, you have 2 working days, so make sure someone is available in the days after you submit. With Apexward Group through CyberEssentials.AI, you have until the end of the six months your assessment is open.

Before you submit

• Check every cloud service for MFA, users and admins
• Check update dates on every device and application
• Check every operating system version is supported
• Re-read the scope answer against your device and service list
• Have the person signing the declaration review the answers

To find these gaps before you apply, use the readiness checker.