Cyber Essentials: the findings that most often hold up certification

Cyber Essentials applications most often stumble on missing devices, late updates, weak account controls and loose firewall rules. No official failure statistics are public, so this list comes from practitioner commentary. Check the five NCSC controls against your real device list before you apply.

What is being assessed?

The NCSC developed Cyber Essentials and IASME runs certification as its delivery partner. The scheme covers five technical controls: firewalls, secure configuration, security update management, user access control and malware protection.

Cyber Essentials combines a self assessment with independent audit. A board member or equivalent signs off the answers and an assessor marks them. Cyber Essentials Plus covers the same controls and adds independent technical testing to check they work in practice. The NCSC page states prices depend on organisation size and start at £320 plus VAT for the basic level.

What do providers report as common trouble spots?

We searched for official data on failure causes and found none. The points below come from a published practitioner article that lists common failures, so treat them as commentary and verify against your own estate.

• Asset visibility. Missing devices are the first item on that list. Anything that touches company data and is not on your asset list is not in your answers.
• Updates. Delayed updates on operating systems and applications, and unsupported software kept as a normal state. The article notes the scheme expects updates to be applied in a timely way, and that browsers and remote access tools count as well as operating systems. We found no fixed number of days in that article, so read the current NCSC requirements for the exact rule.
• Accounts. Weak account management, poor password controls and unmanaged admin rights.
• Configuration drift. Security settings that change after rollout, and local exceptions that weaken the whole set.
• Firewall and remote access. Overly permissive rules, exposed services and loosely controlled remote access.
• Malware protection. Protection missing or inconsistent across devices.

How do you map these to the five controls?

• Delayed updates, unsupported software: Security update management
• Missing devices: Scope, and every control
• Weak passwords, admin rights, drift: Secure configuration and user access control
• Open rules, exposed services: Firewalls
• Inconsistent protection: Malware protection

Software supply chain hygiene sits under security update management. If you build software, the libraries you ship need the same attention as the operating systems on your laptops.

What to do

1. Make a complete asset list. Laptops, phones, servers, cloud tenants, network devices, printers and any personal devices that reach company data. Scope questions answered from memory are the usual source of surprises.
2. Remove unsupported software. For each application, check the vendor's support end date. Replace or isolate anything past it.
3. Set a patch routine you can prove. Decide a window for critical updates, apply it, and keep dated records.
4. Change defaults everywhere. Include devices that nobody thinks of as computers, such as printers and switches.
5. Tighten accounts. Remove unneeded admin rights, and check the current NCSC requirements for multi-factor authentication on cloud services.
6. Check the five controls against the real answers. Have someone other than the author read your answers aloud and challenge each one.
7. Keep evidence of your dependency updates. For software you ship, a dependency inventory with fix status shows update management for your own code. Safeguard's compliance automation can help gather such records, but it does not certify you. Certification comes from the scheme.

Quick check

Sources

• NCSC, Cyber Essentials overview
• Security Boulevard, Common Cyber Essentials failures and how to avoid them

Last reviewed: 18 October 2026.