security audits

Failing a Cyber Essentials assessment is a setback, but it does not always end your application. What happens if my business fails a cyber essentials audit depends on whether you applied for Basic or Plus. Basic applicants can resubmit their answers twice before an outright failure. For Plus, findings require remediation and further testing.

It is understandable to worry about the impact on contracts, suppliers and customer confidence. The assessment feedback identifies the areas that need attention, giving you a practical starting point for fixes instead of leaving you to guess.

This guide explains what follows a failed assessment, how the next steps differ between Basic and Plus, and which common security gaps to prioritise. It also covers possible supply-chain effects and how timely, clearly documented remediation can show that your business is taking security seriously.

What happens if I fail Cyber Essentials?

Cyber Essentials is a UK cybersecurity certification scheme backed by the National Cyber Security Centre and IASME. It sets baseline security controls to help organisations improve online safety. A failed assessment means the organisation has not shown that it meets one or more requirements. The Certification Body’s feedback identifies the gaps and helps you focus remediation before resubmitting.

There are two certification versions: Basic and Plus. Basic uses a self-assessment questionnaire marked by a Certification Body. In the self-led route, a board member or equivalent signs the answers before an assessor marks them. UK businesses can resubmit Basic answers twice before an outright failure. After two failed resubmissions, the organisation must reapply. Plus adds independent technical testing, so a failure may require technical changes followed by further testing.

Yes. A business may have its Cyber Essentials certification removed after failing an assessment. If the certificate is revoked, the organisation must reapply to become certified again. It is important to distinguish an unsuccessful application from an issue affecting an existing certificate.

Internal audits can uncover gaps before formal assessment. Review the systems in scope, the software in use, and whether written policies match actual practice. An unsupported application or an unclear update process, for example, can undermine your answers. Record each finding, assign an owner and resolve it before submission. This helps ensure the controls declared cover the full assessment scope, not just a sample of devices.

An IASME-licensed Certification Body can help explain the questions and how they apply to your business. This can be useful when the network boundary, cloud services or software estate makes the scope difficult to define. Depending on the assessment terms and findings, a reassessment may review the whole scope or focus on the failed areas.

Some Certification Bodies may charge extra for reassessment. The cost depends on the Certification Body and agreed assessment terms, so factor possible repeat testing into your certification budget.

Prioritising common remediation tasks

Start with issues that can affect the entire Cyber Essentials assessment scope. A single in-scope device running unsupported software can cause the organisation to fail a control. Identify unsupported operating systems and applications, then replace or remove them before addressing lower-risk configuration issues.

Next, review patching. Cyber Essentials requires software to be licensed, supported and kept up to date with security patches. From April 2026, security updates taking longer than 14 days and incomplete multi-factor authentication are automatic failures. Critical or high-risk updates must be applied within fourteen days. A CVSS v3 base score of at least 7 is one trigger for that deadline.

• Update software: map applications and operating systems to the devices using them, then address unsupported versions and overdue patches.
• Enable multi-factor authentication: apply it to administrator and user accounts on cloud platforms. The Danzell question set requires MFA wherever a cloud service offers it.
• Resolve control gaps: use the Certification Body’s assessment feedback to identify whether settings, security measures or written procedures need attention.

Prioritise issues by scope and impact, not convenience. An unsupported application on one included laptop, for example, may affect the organisation’s result. A policy document alone will not fix a technical control that is not working. Record each issue, the affected systems, the fix and evidence that the work is complete.

After remediation, review the full scope again before resubmission. Check that updates are applied consistently, multi-factor authentication is enabled where required, and documented procedures match actual practice. The Certification Body may review the failed areas or conduct a broader assessment, so unresolved gaps can mean further work.

A focused cyber security remediation review can help organise technical fixes and policy changes before reassessment.

Business and supply-chain consequences

A failed assessment can affect work where a buyer requires Cyber Essentials certification as a procurement condition. UK Central Government and the Ministry of Defence require Cyber Essentials for relevant work. Without a current certificate, a business may not meet that requirement and could lose eligibility for a contract. The effect depends on the contract’s stated security conditions, not simply on the assessment result.

Outside government procurement, supply-chain consequences depend on the customer. A larger organisation may ask suppliers to demonstrate security controls before sharing data, connecting systems or renewing an agreement. If a certificate is a stated condition, failing to obtain or retain it can delay onboarding or prompt a contract review. If it is not required, a failed assessment does not automatically end the relationship. Identify which agreements name the scheme and what evidence they require.

Cyber Essentials assesses declared controls across the full assessment scope, not only the devices selected for testing. That matters in a supply chain because one neglected laptop or system can undermine the organisation’s answers. For example, an in-scope device running unsupported software may affect the result, even if other devices are well protected. Plus testing can also reveal whether controls work in practice, rather than just appearing in written answers.

Give buyers a factual update on the assessment outcome: name the affected control, explain the remediation underway and provide a realistic status. Do not describe a failed assessment as evidence of a malware incident. A failure means a control did not meet scheme requirements; by itself, it does not show that malware entered the network. Clear distinctions help procurement teams understand the issue without overstating it.

Cyber Essentials is not a legal requirement for every UK business. Its commercial importance comes from buyer requirements and contract terms. Map those requirements, identify renewal or tender deadlines, and plan remediation around them. Certification must be renewed annually to remain current, so include the next renewal in supply-chain planning rather than treating it as a one-off task.

Business reputation and customer confidence

A failed assessment can raise questions from customers, especially if they expected Cyber Essentials certification as evidence of your security controls. Explain clearly what the result means for your organisation: which control failed, what it affects and what action is underway. Avoid broad claims about the whole network when the finding concerns one specific area.

Consistency builds confidence. If a customer asks about an unsupported application, for example, give the same factual update through your account team and technical contact. Explain whether the application is in scope, how you are addressing it and when you will provide the next update. A named owner and a dated action record make your response easier to follow.

• Document the finding: describe the failed control and affected systems in plain language.
• Show progress: record completed fixes, outstanding actions and who owns each one.
• Keep statements aligned: ensure customer communications match the assessment answers and remediation records.

A short, accurate update is more useful than a sweeping promise. If the issue concerns update management, for instance, explain the process change and how you will track completion. Do not claim every device is secure just because one issue has been fixed. Customers need an honest account of the specific change and its scope.

Prepare a consistent response before questions arrive. Agree who will handle customer enquiries, which technical details can be shared and how updates will be approved. If a customer asks whether the failure involved a breach, distinguish the assessment finding from any separate incident investigation. This keeps your message precise and avoids speculation.

For practical support strengthening controls and preparing clear remediation records, discuss your cyber security requirements.

Cornerstone Business Solutions: Cyber Security

Cornerstone Business Solutions can support your organisation with Cyber Security when assessment findings point to technical gaps or ongoing security needs. Its Managed IT Support can help keep business systems maintained, while Microsoft 365 support can help address issues involving cloud accounts and settings.

Bring the assessment feedback and remediation record into the discussion. Together, they show which systems and controls are affected and what actions remain. Support can then focus on the technical changes your business needs instead of treating every failed assessment as the same problem.

If you are working through Cyber Essentials findings or strengthening your defences before a future assessment, contact Cornerstone Business Solutions to discuss the right next step for your business.

Make security part of everyday operations

Understanding what happens if my business fails a cyber essentials audit is only the starting point. The lasting benefit comes from building security checks into everyday decisions, so changes to systems, staff access and software do not create fresh gaps before the next assessment.

Cornerstone Business Solutions offers Cyber Security, Managed IT Support and Microsoft 365. These services can support a more consistent approach to protecting the systems your organisation relies on and maintaining practical security controls as your business changes.

Consider the next step that would make the biggest difference: organising remediation, strengthening ongoing IT management, or reviewing how Microsoft 365 is configured and used. A conversation can help clarify where support fits your priorities, without turning an assessment result into a reason to delay action.

Contact Cornerstone Business Solutions to discuss your cyber security needs and take a considered next step towards stronger day-to-day protection.

Frequently Asked Questions

Can I just fix the devices that failed?

Not always. The declaration covers the full assessment scope, so a fix limited to tested devices may leave the same control gap elsewhere. For Cyber Essentials Plus, the assessor may retest a failed control, the affected devices or a wider set, depending on the finding. Under the 2026 rules, a failed Plus retest includes the original sample and a fresh random sample.

Can preparation guarantee a first-time pass?

No. Preparation can uncover gaps, but certification depends on whether the controls work across the declared scope when assessed. For example, a policy may describe timely updates while an in-scope laptop still runs unsupported software. Use preparation to identify and resolve weaknesses, not as a substitute for applying controls consistently across systems and accounts.

What can you do to reduce the chances of failure?

Start by making a complete inventory of in-scope devices, cloud services and software. Then compare actual settings with the assessment answers, paying attention to supported software, security updates and multi-factor authentication. Record evidence as you complete fixes. A Cyber Security review can help organise these checks, while Managed IT Support can help maintain systems so changes do not leave security controls out of date.

What happens if my business fails a Cyber Essentials audit in the UK?

If you are asking what happens if my business fails a cyber essentials audit, the Certification Body provides feedback on requirements the organisation did not meet. Use it to identify the cause, such as unsupported software, a control setting or a procedure that does not match actual practice. A failed assessment does not, by itself, prove that a breach or malware infection occurred. If an existing certificate is revoked, the business must reapply.

Can a business retake or resubmit after failing Cyber Essentials?

Yes. For Basic, a UK applicant can resubmit answers twice before an outright failure. After two failed resubmissions, it must reapply. For Plus, the organisation addresses the technical findings and undergoes further testing. Depending on the findings and assessment terms, the assessor may check specific controls or devices, or expand the review.

How long does a business have to fix Cyber Essentials assessment failures?

For Cyber Essentials Plus, remediation must be evidenced within 30 days of the audit date, unless the earlier deadline applies: 90 days from the Basic certification date. The earlier of those deadlines governs. Basic applicants work through the permitted resubmissions instead. Plan fixes around the applicable route, and complete them before submitting answers or presenting systems for further testing.