Failed Cyber Essentials? Here's what actually happens next
First: nothing is broken that can't be fixed, usually within weeks. A fail isn't a public event, it isn't recorded against you anywhere a customer can see, and under the 2026 rules it's happening to a lot of previously certified organisations. Here's what a fail means in practice, what your certification body should be offering you, the usual culprits — and the fastest honest way back.
What a fail actually means
Your submitted answers didn't meet the requirements — that's all. Nobody is notified, no register records it, and any existing certificate simply runs to its expiry date. The costs are practical: no new certificate (a problem if a tender or contract needs one), and if your old one lapses meanwhile, you drop off the public search and lose the bundled cyber insurance until you're certified again.
Can you resubmit — and what should the certification body do?
Practice varies by provider, which is exactly why our seven checks ask about it before you start: better bodies return feedback identifying the failing answers and allow a fix-and-resubmit window; others treat each attempt as a fresh, chargeable assessment. If you've just failed, ask three questions in one email: which answers failed, what resubmission is included, and by when? The reply tells you whether to resubmit there or take the fixed version of your answers somewhere better — the certificate is identical everywhere.
The usual culprits under the 2026 rules
- MFA missing on one cloud service — the automatic fail since April; one forgotten CRM or file-share does it.
- The 14-day patching questions — answered honestly “no” because nobody owns router firmware or browser extensions.
- Unsupported software — usually a Windows 10 machine someone forgot existed, or an old server quietly running something important.
- Admin accounts used for daily work, shared logins, default passwords — the classic failure list hasn't gone away.
- Scope answers that contradict themselves — declaring “whole organisation” then describing exclusions the rules don't allow.
The route back, in order
① Get the failing answers in writing. ② Fix causes, not wording — enable the MFA, retire or cover the Windows 10 machines, set updates to automatic, split the admin accounts; most fixes are settings, not spending. ③ Re-run the whole question set yourself (our free readiness check does this in minutes) because second fails usually come from fixing only what was flagged. ④ Resubmit — with your current body if resubmission is included, with a better one if you were quoted a fresh fee for the privilege. Typical honest timeline from fail to pass: one to three weeks, driven almost entirely by how fast the fixes happen.
Say so to whoever helps you — deadlines change the plan (which fixes first, which body is fastest, whether basic now and Plus later serves the contract). It's the first question we ask, and a fixed date is usually recoverable.
Failed once — don't fail twice
The free readiness check re-runs the whole standard against your setup and shows every remaining gap before you resubmit. If you'd rather hand the whole thing over: fixed price, feedback-and-fix included, a named human throughout.
Take the readiness check · hello@passcyber.co.uk
PassCyber is a trading name of Edwards Bros (Spaldwick) Ltd