What happens if I fail Cyber Essentials?

You receive specific, numbered feedback from the assessor on the questions you didn't pass. You get one free resubmission within 48 hours of receiving that feedback. Areas you already passed are not re-reviewed.

How long do I have to resubmit?

48 hours from the marker's feedback email. Submit corrected answers within that window and there's no extra fee. Miss the window and a resubmission typically costs £100–£200.

Will my tender or insurer see that I failed?

No. The public IASME register lists only successful certifications. A failed first attempt is not visible externally – they can only see that you are not yet certified.

What's the most common second-fail cause?

Paraphrasing the marker's feedback instead of addressing each numbered point specifically, and changing answers in areas that weren't flagged (which can re-open the review).

Can I switch Certification Body after a fail?

Yes. There is no lock-in. You can switch to a different IASME-licensed Certification Body for your next attempt. NixInfinity-AI accepts re-attempts and includes a pre-check.

What Happens if You Fail Cyber Essentials

What "fail" actually looks like

A Cyber Essentials fail is not a generic rejection – the assessor returns specific, numbered feedback against the questions you answered "non-compliant" or where they couldn't verify your answer. You see exactly what needs to change. This makes resubmission much more focused than first-time submission.

The 48-hour resubmission window

IASME gives every submission one free resubmission, provided you submit corrected answers within 48 hours of receiving the marker's feedback. Missing that window forces a fresh submission and a new fee.

The 48-hour clock starts when the feedback email is sent, not when you read it. Have someone monitoring the assessor inbox.

What gets re-checked vs what doesn't

Only the specific questions flagged by the assessor are re-reviewed. Areas you already passed stay passed. The marker is not looking for new things to fail you on – they want a clean second pass and a closed file.

Costs if you miss the window

Within 48 hours: free resubmission
After 48 hours: typically £100–£200 to resubmit
If the gap is fundamental (e.g. unsupported OS that can't be removed in days): consider re-scoping rather than rushing a third attempt

What happens to your tender deadline

A failed first attempt does not show on the public IASME register – only successful certifications appear. Your tender or insurer cannot see the failure. They can only see "not yet certified".

That said, if you have a 7-day deadline and you fail on day 4, you have time only if you can remediate within 48 hours. For tight deadlines, see our fast Cyber Essentials certification guide.

The five most common fails (and how to fix them in 24 hours)

1. MFA missing on a cloud account

Fix: enable MFA on every flagged account, document any service-account exceptions, take fresh screenshots showing MFA enforced. Time: 2–4 hours.

2. Unsupported operating system

Fix: either upgrade the OS, replace the device, remove it from scope (if genuinely not used for business data), or buy vendor extended support. Time: 2 hours to 2 weeks depending on path.

3. Patching evidence too thin

Fix: document the patching process in writing, screenshot update settings on a representative sample of devices, confirm the 14-day rule for high/critical patches. Time: 2–3 hours.

4. Asset inventory incomplete

Fix: produce a current device list including BYOD, with serial numbers / hostnames and the user assigned to each. Time: 2–4 hours.

5. Inconsistent answers

Fix: have one person re-read every answer and reconcile contradictions before resubmitting. Time: 1–2 hours.

How to avoid a second fail

Read the marker's feedback line by line. Address each item specifically – do not paraphrase.
Update screenshots with current dates so the assessor can see the change is recent.
Do not change answers in areas the assessor didn't flag – it can re-open the review.
Have a qualified assessor (not just IT) review the resubmission before you send it.

When to consider switching Certification Body

If you fail twice with the same provider and the feedback feels arbitrary, you can switch Certification Body for the next attempt. There is no lock-in. NixInfinity-AI accepts switch-in renewals and re-attempts and includes a pre-check at no extra cost.