What's the most common reason organisations fail Cyber Essentials first time?

Missing MFA on at least one cloud account – usually a founder's admin account, a service account, or a third-party SaaS app that wasn't included in the scoping. Under the Danzell question set this is now an immediate fail.

How long should I prepare before submitting?

For a typical 10–49 person UK SME, plan 2–4 weeks of part-time effort. The certificate fee is the small cost; the real work is closing the gaps surfaced by the question set – MFA, patching, asset inventory, leavers process.

Do I get a free resubmission if I fail?

Yes. IASME provides one free resubmission within 48 hours of the original review. Use it to fix the specific items the assessor flagged. Subsequent resubmissions usually cost £100–£200.

Can a pre-check guarantee a first-time pass?

It cannot guarantee, but it dramatically improves the odds. A pre-check by a qualified assessor catches the predictable fails – MFA gaps, unsupported OS, scope inconsistencies – before the formal submission.

Is Cyber Essentials harder than it used to be?

Modestly, yes. The Danzell question set tightened MFA scope and the 14-day patching rule. The five controls themselves haven't changed, but the evidence bar has risen.

How to Pass Cyber Essentials First Time

Why first-time pass matters

A first-time pass means you keep your tender deadline, avoid resubmission stress, and protect the £25,000 cyber insurance benefit from day one. A failed submission is not the end of the world – you get one free resubmission within 48 hours – but it costs time and shakes confidence with whoever is waiting on your certificate.

The eight pre-submission checks

1. MFA on every cloud account (admin and user)

Under the Danzell question set, in force since 27 April 2026, MFA must be enabled on all cloud user accounts – not just admins. Audit every cloud service: Microsoft 365, Google Workspace, AWS, Azure, Salesforce, Xero. Document any service account exemptions.

2. No unsupported operating systems

Windows 10 ESU status, macOS major version, mobile OS minimums all matter. Anything past vendor end-of-support is an automatic fail unless removed from scope or covered by a paid extended-support arrangement.

3. Complete asset inventory

You need a documented list of every device that touches business data – laptops, desktops, mobiles, tablets, BYOD. The list must be current, not last quarter's spreadsheet. Assessors look for evidence of an inventory method, not just a snapshot.

4. Patching evidence (the 14-day rule)

High and critical vendor patches must be applied within 14 days. You need to demonstrate a process – not just a screenshot of one device. Show update settings on Windows, macOS, mobiles, browsers and any business-critical applications.

5. Account inventory and leavers process

Every active account must belong to an active person. Old leaver accounts and unused service accounts are an immediate red flag. Document a written leavers process – who disables what, on what timescale.

6. Firewall and router configuration

Default admin passwords changed. No unrequested inbound services exposed. Software firewalls enabled on all in-scope devices. For home workers, the home router counts – the rule is "default password changed and no unrequested inbound services".

7. Malware protection on every device

Active anti-malware on every laptop and desktop, configured to scan downloads and update automatically. Mobile devices need either an approved app store policy or a managed AV.

8. Consistent answers across the question set

Assessors flag contradictions – e.g. answering "we have BYOD" in one section and "no personal devices" in another. Have one person own the submission and review every answer in one sitting before you submit.

The pre-submission rehearsal

Read every answer back as if you were the assessor. Ask: "If I had to evidence this in 60 seconds, could I?" If the answer is no, the answer in your submission is probably overconfident. Pull it back to what you can actually prove.

Common failure patterns we see

One Windows 10 device past end-of-support that nobody noticed
MFA missing on the founder's "convenience" admin account
BYOD denied in the submission, but the assessor sees it in screenshots
Asset list missing the warehouse tablet or the meeting-room PC
Password policy on paper but not actually enforced in M365

Use a pre-check

A pre-submission review by an assessor catches the points above before you submit. It's the single highest-leverage thing you can do for a first-time pass. NixInfinity-AI includes a pre-check on every Cyber Essentials engagement at no extra cost.

For a deeper walkthrough see our Cyber Essentials readiness checklist and the five controls breakdown.