Failed Cyber Essentials? Breathe. Then read the feedback like this.

What a fail actually is

The assessor reviews your written answers against the NCSC requirements. Where an answer does not meet them — or is too vague to confirm — they say so, question by question. That feedback is the whole event. A fail isn’t published: only certified organisations appear on the public certificate search. What it costs you is time, possibly money depending on your certification body’s terms, and pressure if a contract is waiting on the certificate.

One thing to establish before it matters: resubmission terms — whether a re-review is included in your fee, how soon it must happen, what it costs if not — are set by each certification body, not by the scheme. Ask yours directly. If you are reading this before buying, ask when you buy; it is a fair and normal question.

The reasons businesses actually fail

• MFA missing somewhere (A7.16, A7.17). Rarely on the main email — usually a forgotten tool, a shared social login, an admin account. One account fails the section. The MFA gap checker finds these in minutes.
• A service wrongly listed as “no MFA available” (A7.15). Listing a tool that can do MFA is an automatic fail even if everything else is on.
• An unsupported operating system (A6.1) — the old laptop, the aged-out phone. No setting fixes this one; see the unsupported software guide.
• The 14-day rule answered honestly as no (A6.4, A6.5) — or answered yes and contradicted elsewhere.
• Answers too vague to confirm. “Yes, we handle that” tells the assessor nothing. These are the cheapest fails to fix: the control was fine, the description wasn’t.

Reading the feedback

1. Sort it into settings, decisions, and descriptions. Settings (turn on MFA, enable auto-updates) are same-day. Decisions (replace a device, retire a tool) need an owner and a date. Descriptions (rewrite a vague answer) need ten minutes and honesty.
2. Fix the named items — then re-check the neighbours. If one cloud service lacked MFA, verify all of them; the second review may read the whole section again.
3. Update the free text to say what changed. “MFA enforced for all users on [date] via security defaults” answers the question and shows the assessor the gap is closed, not papered over.
4. Resubmit when every answer is true — not when the named items are done. The goal is one resubmission, not a correspondence.

If a contract is waiting

Tell the client the truth with a date: “assessment feedback received, fixes under way, resubmitting by [date]”. Procurement teams see this constantly, and a specific date reads very differently from silence. Most fixes on the list above are days, not months — the exception is hardware, which is exactly why it is worth checking devices before paying next time.

Making the second attempt the last

Run the whole assessment again yourself before resubmitting — the checklist takes an hour with the fixes fresh — and treat the automatic fails as a gate: nothing goes back until MFA, supported software and the 14-day rule are clean. Businesses that fail twice usually fixed what was named and nothing else.