Why small businesses fail Cyber Essentials before the assessment starts
Most failed assessments start with ordinary settings that nobody has checked: old software, excessive administrator access, weak sign-in controls, exposed routers and incomplete malware protection.
Start with the devices in scope
Write down every laptop, desktop, phone, tablet, server and cloud service used for work. Include personal devices that reach company email or files. An assessor cannot accept a control when the business cannot say which devices it covers.
Remove unsupported systems from business use or set a dated replacement plan. Windows, macOS, phone and application updates must still be supplied by the vendor.
Check administrator access
Daily email and web browsing should use a standard account. Keep a separate administrator account for software installation and settings changes. This limits what a stolen password can change.
List the people with administrator roles in Microsoft 365, Google Workspace and each business application. Remove roles that are no longer needed.
Enforce stronger sign-in
Require multi-factor sign-in for cloud services that support it. Test the rule with a normal staff account rather than relying on a dashboard that says the feature is available.
Keep recovery codes under company control. Remove old phone numbers and personal email addresses from recovery settings when someone leaves.
Patch within 14 days
Install high-risk and critical security updates within 14 days of release. The rule applies to operating systems, browsers, office software, routers, firewalls and internet-facing services.
Keep an update report or screenshots showing the device, update and installation date. A written policy without installation evidence is not enough.
Review routers and malware protection
Change default router and firewall passwords, disable internet-facing management and remove services that are not used. Confirm every supported laptop has active malware protection and receives updates.
Run these checks before booking the assessment. Fixing one overlooked machine after submission can hold up the whole result.
Common questions
- How long should we prepare before a Cyber Essentials assessment?
- Allow enough time to list every device, remove unsupported software, enforce sign-in controls and collect evidence. A small, well-managed estate may need days. An estate with old devices or unclear ownership may need several weeks.
- Does an IT provider complete Cyber Essentials for us?
- An IT provider can supply settings and evidence, but the business remains responsible for an accurate scope and accurate answers. Check the submitted answers against how staff and devices work in practice.
- Can one old computer cause a failed assessment?
- Yes. A device in scope that no longer receives security updates can prevent certification. Remove it from business use or replace it before the assessment.
Official UK sources checked
Related UK cybersecurity guides
Cyber Essentials firewall requirements for offices, routers and home workers
Cyber Essentials expects every in-scope device to sit behind a correctly configured firewall, whether that is a router in the office or the software firewall on a home worker's laptop. This guide explains where the line falls for home routers, what a compliant configuration looks like, and which records an assessor is likely to ask for.
How to Switch On MFA for Every Microsoft 365 User in a Small Business
For most businesses with 5 to 50 staff, the quickest route to MFA for every Microsoft 365 user is Security Defaults in the Microsoft Entra admin centre. This guide gives the admin path, the checks to run before enabling it, when Conditional Access is the better fit, and the accounts that deserve extra attention.
Cyber Essentials password policy: what a small business needs to put in place
Cyber Essentials sets rules for password quality and brute-force protection, not a single fixed length. This guide sets out the current wording, how to separate accounts, where a password manager fits, and what to configure for lockout so a small UK business can write a policy that passes assessment and works for staff.