Most businesses fail Cyber Essentials because they treat the application as a questionnaire rather than a technical audit. The scheme, managed by the National Cyber Security Centre (NCSC) and IASME, is designed to ensure a baseline of security across five key controls. It is not a 'best efforts' certificate. If a single device or account falls outside the requirements, the entire application fails.
We see many organisations approach the process with a tick-box mentality, only to find their submission rejected because they missed a technical detail in their cloud configuration or their hardware inventory. Passing requires a deep dive into how your staff actually access data and how your devices are managed.
The Multi-Factor Authentication trap
Multi-Factor Authentication (MFA) is now the primary reason for failure. The requirement is absolute: every cloud service that provides access to organisational data must have MFA enabled for every user. This includes your primary productivity suite, like Microsoft 365 or Google Workspace, but it also extends to every third-party application you use, from Xero and Mailchimp to your CRM and your backup software.
A pattern we see on most tenants we take on is that several 'service accounts' created for old printers or scanners lack MFA because nobody thought they counted as user accounts. If an account can reach your data, the assessor expects it to be protected.
Businesses often fail because they rely on 'security defaults' without verifying that they are active for every user. If you have one director who found MFA annoying and had it disabled, or a contractor who was never forced to enrol, you will fail. There are no exemptions for convenience.
Unsupported software and the end-of-life problem
Any software or operating system that no longer receives security updates from the manufacturer is a critical fail. This is the 'supported software' rule. For many UK SMEs, this usually means an old Windows Server 2012 instance still running in a cupboard, or a handful of Windows 7 or 8 machines used for specific tasks like lab equipment or label printing.
The rule also applies to applications. If you are still using an old version of Office that reached end of life, or a browser that is no longer updated, your application will be rejected. The assessor is looking for evidence that everything in your environment is currently supported. If it is not, you must either upgrade it, replace it, or move it into a separate, isolated network that does not have internet access and is out of scope. For most small firms, isolation is technically difficult to prove, making removal or upgrading the only viable path.
The 14-day patching window
Cyber Essentials requires that all 'critical' or 'high' severity security updates are applied within 14 days of release. This is a high bar for businesses that rely on manual updates. If you wait for staff to click 'restart and update' on their own laptops, you will eventually miss this window.
A failure often occurs when an assessor finds a machine that has been offline for three weeks. When it reconnects, it is technically non-compliant until those patches are applied. To pass and remain secure, you need a centralised way to manage patches across your entire estate. Relying on luck or the diligence of your busiest employees is a recipe for a failed assessment.
Administrative rights and the God Mode issue
Giving staff administrative rights on their own computers is a significant security risk and a common reason for Cyber Essentials failure. An administrator account has the power to install software, change system settings, and bypass security controls. If a user clicks a malicious link while logged in as an admin, the malware has full run of the machine.
To pass, you must demonstrate that users perform their day-to-day work (email, web browsing, document editing) using standard user accounts. Administrative accounts should only be used for administrative tasks. We find many businesses have 'local admin' enabled for everyone because it makes installing printers easier. Under Cyber Essentials, this must stop. You need a clear policy and technical enforcement to ensure that administrative privileges are restricted to only those who absolutely need them, and only used when necessary.
Bring Your Own Device and scope confusion
Scope is where many applications fall apart before they even reach the technical questions. You must define exactly what is being certified. If your staff use their personal mobile phones to access work email or Teams, those phones are in scope.
Many business owners find this intrusive, but the logic is sound: if a phone contains your business data, it must be secured. This means the phone must have a PIN or biometric lock, it must be running a supported operating system (no old iPhones or Android versions), and it must be capable of being wiped if lost.
If you cannot or will not enforce these rules on personal devices, you must block access to work data from those devices. Failing to declare BYOD devices that are clearly being used for work is considered a failure of the declaration process. We often recommend using Intune and BYOD policies to separate work and personal data, which allows you to satisfy the requirements without taking full control of a staff member's private phone.
Default passwords and router security
The fourth pillar of Cyber Essentials is secure configuration. This includes the hardware that connects you to the internet. If you are using a standard ISP-provided router and have never changed the default admin password, you will fail.
Assessors look for 'known' default credentials. If your router's login is 'admin' and the password is 'password' or a code printed on the back of the device, it is a vulnerability. You must also ensure that remote access to the router's management interface is disabled. If your IT provider needs to log in to your firewall from outside the office, this must be done via a secure VPN or restricted to a specific IP address. Leaving a management portal open to the entire internet is an automatic fail.
The cost of failure versus preparation
Failing Cyber Essentials has a direct financial impact. It is not just the cost of the re-assessment fee; it is the wasted time of your internal team and the potential loss of contracts that require the certification.
Consider a hypothetical 25-person firm.
-
The 'Guess and Hope' approach: The business spends £300-£500 on the initial assessment fee. They spend 10 hours of a manager's time filling it in. They fail due to missing MFA on a legacy account and three unpatched laptops. They must now pay for a re-assessment (often the full fee again if the fail is significant) and spend another 15 hours fixing the technical issues under pressure. Total cost: ~£1,000 in fees plus ~25 hours of management time.
-
The 'Prepared' approach: The business spends time upfront auditing their devices and accounts. They might invest in a Microsoft 365 security review to find the gaps before applying. They fix the MFA and patching issues as part of their standard operations. They pass first time. Total cost: ~£500 in fees and a few hours of organised admin.
Doing the work before you submit is always cheaper than trying to fix a failed application while a contract deadline looms.
Cyber Essentials FAQ
Do I need a server to pass Cyber Essentials? No. You can pass Cyber Essentials as a purely cloud-based business. In fact, it is often easier to pass without a server, as you have fewer hardware assets to maintain and patch. Your 'boundary' simply becomes the devices you use and the cloud services you access.
Is my home office in scope? If you are a remote or hybrid worker, your home router is generally out of scope as long as your work device has its own software firewall enabled. However, the device you use at home (laptop, tablet, phone) is very much in scope and must meet all the patching and software requirements.
Can I fail if my staff use weak passwords? Yes. Cyber Essentials requires a password policy that either enforces long, complex passwords or uses MFA to mitigate the risk of shorter ones. You must also have a process to change default passwords on all new equipment before it is issued to staff.
Does Cyber Essentials cover my website? Generally, no. The 'infrastructure' version of Cyber Essentials covers your internal systems, devices, and cloud data. Your website is only in scope if it is hosted on a server you manage yourself. If you use a third-party hosting provider, the server is their responsibility, not yours.
How Black Sheep Support helps
We don't just help you fill in the form; we fix the technical issues that cause the failure in the first place. Our approach is to align your business with the Cyber Essentials standard as part of your day-to-day operations, so that certification becomes a formality rather than a stressful project.
We provide Cyber Essentials certification support that includes a full audit of your Microsoft 365 environment, device management, and patching schedules. We also handle hardware, broadband, mobile and networking, ensuring your entire infrastructure is compliant from the ground up.
If you are worried about an upcoming assessment or have already failed one
and we will help you identify the specific gaps in your security.
Not ready to talk yet? Run our free IT Health Check to assess your business risk and security posture in minutes, no commitment.
Want this handled for you? See Compliance and Cyber Essentials.
Based in Brighton or Hove? We are too: see IT support in Brighton.
