Failed a Cyber Essentials Plus Audit? What Happens Next?
Published 20 October 2026
What a CE Plus failure actually means
Cyber Essentials Plus is a technical verification of the controls you declared in your Cyber Essentials self-assessment. A failure means the assessor found evidence that one or more controls are not working on the devices or services tested. Typical examples are missing security updates, unsupported software, malware protection not blocking a test file, or MFA not enforced on a cloud account.
It does not mean you go back to the start. Your Cyber Essentials certificate stays in place while you remediate, subject to the update-management rule explained below.
Immediate next steps
- Get the findings in writing. Ask the assessor exactly which test failed, on which device or account, and why.
- Agree the remediation window. Confirm what time is available given your three-month deadline, and when the retest can be booked.
- Find the root cause. Work out why the control failed, not just what failed.
- Fix across the scope. Apply the fix to every device, build or account that shares the cause.
- Check your own work. Verify the fix on a spread of devices before the retest.
Remediation vs retesting
Remediation is the work you do. Retesting is the assessor confirming it worked. Depending on what failed, the assessor may retest the specific control, the failed devices, or a wider set. Ask your assessor what they will retest so you can prepare properly.
The 2026 update-management retest rule
IASME's April 2026 Cyber Essentials Plus update changed how failures in update-management testing are handled. When that testing fails:
- the retest includes the original sample plus a new random sample of devices; and
- if the update-management test fails again in that process, your verified self-assessment (Cyber Essentials) certificate can be revoked.
This rule is specific to update-management testing as described by IASME. Check the current IASME guidance and your assessor's explanation for how it applies to your case rather than assuming it extends to every type of failure.
Why fixing only the sampled devices is not enough
Your Cyber Essentials declaration covers the whole scope, not just the sample. If one finance laptop is missing a browser update, other laptops on the same build probably are too. Under the 2026 update-management rule a new random sample is added at retest, so patching only the devices that were tested is a gamble against a fresh sample. Fix the process (update policies, deployment rings, third-party app patching) so every device is covered.
How the three-month window affects planning
CE Plus must be completed within three months of your Cyber Essentials certificate. If testing happens late in that window, there is less time to remediate and retest. If the window runs out, you will normally need a new Cyber Essentials assessment before CE Plus can be attempted again.
Practical tip: book your CE Plus test early in the window so there is room to fix and retest if needed.
A practical remediation priority list
| Priority | Focus |
|---|---|
| 1 | Anything that could trigger revocation, such as update-management failures. Fix the update process across the estate. |
| 2 | Unsupported software: upgrade, remove or isolate. |
| 3 | Cloud account MFA gaps, including admin and forgotten accounts. |
| 4 | Malware protection and secure configuration issues on the failing builds. |
| 5 | Documentation: update the device inventory and scope so they match reality. |
For the usual causes of failure, see common CE Plus failures. This page is about what to do once a failure has happened.
When to ask for help
- You do not understand why a control failed.
- The fix needs changes to your device management or update tooling that your team has not done before.
- Your three-month window is nearly used up.
- The failure relates to update management and you are worried about the second-failure consequence.